Hello. In a big network with +60,000 hosts and a media BW of 700 Mbps to the Internet, what would be the best FW solution to protect the network?

A big FW with a centralized perimeter?

Or, some little FW per area and a last resort FW pointing to Internet?

Currently we have a cluster of firewalls in a centralized perimeter, but from time to time some latency issues affect the network, it seems the FW is unable to inspect so much traffic.

Thanks!

I would probbaly setup 2 big firewall, active/active redundancy , running multiple firewall contexts.
by than again, I have alot of customers,

I also would have dedicated IPS/IDS devices to inspect traffic.

_________________
"If you're good at anticipating the human mind. It leaves nothing to chance."
-Jigsaw

HA firewall pair, geographically separated if possible. Much easier to manage all access from a single point. All vpn/etc will come from that firewall

_________________
www.mellowd.co.uk/ccie/

I agree with ristau5741. We have a similar need, and are looking at a large cluster HA pair for this purpose. I would rather deal with complexity within the pair rather than complexity in a multitude of boxes/cables/switches, etc.

Presuming you're using ASAs, you won't be terminating VPNs if you're in multiple context mode (as you would be if you're going for active/active). Might be worth bearing that in mind.
http://www.cisco.com/en/US/docs/securit ... texts.html

I think hes looking for recommendations on hardware as well.

I think it would depend on what features you want turned on to determine what hardware you would want to use... What features were you looking at? Standard stateful firewall inspection? Or IPS, IPSec tunnels and all the other colorful lights/bells and whistle you can have on a firewall?

I've been informed by Cisco, that ASA version 9.0 will allow IPSec and dynamic routing while in multiple context mode. It will also align the operating systems of both, the 5500 and 5500-X series hardware lines.

This should be available later this year.

hope that wasn't discussed outside your NDA with Cisco.

_________________
"If you're good at anticipating the human mind. It leaves nothing to chance."
-Jigsaw

They were talking about it at Cisco Live back in January - but as with all things Cisco, I'll believe it when I see it.
So is anyone else waiting for Cisco to announce the successor to the ASA?
http://www.bradreese.com/blog/4-9-2012.htm