Jason Dixon escreveu:
quoted text
> On Fri, Jul 11, 2008 at 10:10:04PM -0400, Geoff Steckel wrote:
>   
>> Jason Dixon wrote:
>>     
>>> On Fri, Jul 11, 2008 at 06:47:13PM -0300, Mart?n Coco wrote:
>>>       
>>>> Hi misc,
>>>>
>>>> I'm currently looking for hardware alternatives for firewalls that   
>>>> should have more than four NICs.
>>>>         
>>> Why could you possibly need 6 physical interfaces?  Even if you have a
>>> failover pair of firewalls and switches, with a dedicated pfsync
>>> interface, you could get by easily with three interfaces.  The first two
>>> interfaces are trunked, one to each switch.  Use vlan(4) interfaces with
>>> carp(4) on top of that.  Your third interface would crossover between
>>> firewalls for private pfsync traffic.
>>>       
>> Hmmmm.  "Why would you ever want to do that?" - really not a good thing
>> to say to someone...  Saying that means you lack respect for the person
>> or lack imagination. "What are you using them for" is a better response.
>>     
>
>   
>> I've frequently used 5 ports on my firewall for multiple isolated subnets.
>>     
>
> That you frequently use 5 ports on your firewall shows a lack of respect
> for your switches, or a lack of imagination.
>
>   
Wow... I've used 5 interfaces also, but for different internet links.
Try do multi routing when you have lot's of different ip's of different
ranges on the same if. Your pf rules will be a mess and, in some cases,
it just does not work. Also, it is like we never heard of switch
vulnerabilities allowing people on one vlan to see traffic of other
vlans. Blindly trusting the switches is like being driven by a blind
guy, it can crash every moment. I believe that there is a reason for
everything, even using lots of network cards. Martin, i believe that
using 4-port cards can have it benefits. Heard a lot of good things from
the intel 4-port cards. Also, their performance isn't hit that hard,
because the intel one s are pci-e.

My regards,

-- 
Giancarlo Razzolini
http://lock.razzolini.adm.br
Linux User 172199
Red Hat Certified Engineer no:804006389722501
Verify:https://www.redhat.com/certification/rhce/current/
Moleque Sem Conteudo Numero #002
OpenBSD Stable
Ubuntu 8.04 Hardy Herom
4386 2A6F FFD4 4D5F 5842  6EA0 7ABE BBAB 9C0E 6B85