SRX性能测试VSEV15幻灯片.ppt

OK, so network routing works if you have many different subnets. What do you do if you have one big path in your network that needs to be scaled? How do you secure that? This is where we typically look at load balancers. We take a device that is less intelligent from a security perspective but they can distribute across multiple firewalls. Now much like a router here, except that we take one common network path, maybe even one subnet or an Internet path and we simply distinguish flows and distribute flows symmetrically. Each direction of a conversation for a given flow is placed onto the same firewall path. So in this way we can scale to multiple firewalls down a single network path. Now the challenge here is on the one hand a load balancer is not a security device. So we loose the ability to have one common security perspective for this network path. Now each firewall only sees its small piece of the traffic and on the other hand load balancers are themselves stateful devices that are hampered by the need to watch for conversations, to be cognizant of flows. One alternative, is the use of MT or MX routers where we can use filter based forwarding to distribute different conversations statelessly across multiple firewalls or with the MX it’s even easier with symmetrical equal cost multipath where we can simply turn on hashing to distribute different flows across multiple firewalls. But here we end up with the same deficiencies as with the network routing models for firewall scaling , rapidly escalating costs, more boxes to manage, more power, more cooling, more space. It’s just too expensive to scale a network this way. * So if you’re a leading network security vendor and you have this cacophony of customers unable to scale their network with your security products without exorbitant costs, how do you answer them? What do you do? Well, if you’re Cisco, you take the chassis based Volton solution. You take a big chassis, the 6500 and you put functions,