| |
Firewall Testing About VESARiA |
|
|
3.7 What are the critical resources in a firewall?
It's important to understand the critical resources of your firewall
architecture, so when you do capacity planning, performance
optimizations, etc., you know exactly what you need to do, and how
much you need to do it in order to get the desired result.
What exactly the firewall's critical resources are tends to vary from
site to site, depending on the sort of traffic that loads the system.
Some people think they'll automatically be able to increase the data
throughput of their firewall by putting in a box with a faster CPU, or
another CPU, when this isn't necessarily the case. Potentially, this
could be a large waste of money that doesn't do anything to solve the
problem at hand or provide the expected scalability.
On busy systems, memory is extremely important. You have to
have enough RAM to support every instance of every program necessary
to service the load placed on that machine. Otherwise, the swapping
will start and the productivity will stop. Light swapping isn't
usually much of a problem, but if a system's swap space begins to get
busy, then it's usually time for more RAM. A system that's heavily
swapping is often relatively easy to push over the edge in a
denial-of-service attack, or simply fall behind in processing the load
placed on it. This is where long email delays start.
Beyond the system's requirement for memory, it's useful to understand
that different services use different system resources. So the
configuration that you have for your system should be indicative of
the kind of load you plan to service. A 700 MHz processor isn't going
to do you much good if all you're doing is netnews and mail, and are
trying to do it on an IDE disk with an ISA controller.
Table 1:
Critical Resources for Firewall Services
| Service |
Critical Resource |
| Email |
Disk I/O |
| Netnews |
Disk I/O |
| Web |
Host OS Socket Performance |
| IP Routing |
Host OS Socket Performance |
| Web Cache |
Host OS Socket Performance, Disk I/O |
|
 |
Vesaria
3640 Fords Lane, Suite D
Baltimore, MD 21215
443 - 501 - 4044
|
