From owner-freebsd-security@FreeBSD.ORG Wed Mar 26 13:18:55 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9429137B404 for ; Wed, 26 Mar 2003 13:18:55 -0800 (PST) Received: from isber.ucsb.edu (research.isber.ucsb.edu [128.111.147.5]) by mx1.FreeBSD.org (Postfix) with ESMTP id 2431F43F3F for ; Wed, 26 Mar 2003 13:18:55 -0800 (PST) (envelope-from randall@isber.ucsb.edu) Received: from research.isber.ucsb.edu ([128.111.147.5]) by isber.ucsb.edu with esmtp (Exim 3.36 #2) id 18yIIK-0009wu-00; Wed, 26 Mar 2003 13:18:48 -0800 Date: Wed, 26 Mar 2003 13:18:48 -0800 (PST) From: randall ehren To: Michael Richards In-Reply-To: <3E82142E.000017.64676@ns.interchange.ca> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Scanner: exiscan *18yIIK-0009wu-00*V7xKhgQYadM* (ISBER - Institute for Social, Behavioral, and Economic Research) X-Spam-Status: No, hits=-12.3 required=5.0 tests=IN_REP_TO,QUOTED_EMAIL_TEXT,USER_AGENT_PINE autolearn=ham version=2.50 X-Spam-Level: X-Spam-Checker-Version: SpamAssassin 2.50 (1.173-2003-02-20-exp) X-Mailman-Approved-At: Thu, 27 Mar 2003 23:46:41 -0800 cc: freebsd-security@freebsd.org Subject: Re: Multiple Firewalls with ipfilter? X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Mar 2003 21:18:56 -0000 > We're supposed to provide redundant firewall service. I'm wondering > if anyone has ever tried to do this and if it's realistic. Basically > 2 firewall machines hooked up so if one fails the other will > transparently step in. I've googled it to death without much luck. > > The security issue here lies in that the 2 firewalls can't talk to > each other. So if I'm keeping state on a connection then the second > firewall has to know about that connection otherwise it will close if > that firewall dies. http://www.isber.ucsb.edu/~randall/firewall/redundant/ i have this setup in use at work, it's an automatic failover but does not keep existing connections, so things like SSH sessions would be dropped. -randall -- :// randall s. ehren :// voice 805.893.5632 :// systems administrator :// isber|survey|avss.ucsb.edu :// institute for social, behavioral, and economic research