On Thu, Feb 11, 2010 at 08:46:22PM +0100, Henning Brauer wrote:
quoted text
> * Diana Eichert <deichert@wrench.com> [2010-02-11 17:02]:
> > 
> > yes, people run firewalls on 10G circuits
> > 
> > I am not aware of anyone filtering at 10G who is using off the shelf
> > hardware, with open source O/S.
> 
> I know of some.
> 
> I don't remember specifics, dunno wether anybody does linerate and
> with what kind of packet characteristics.

I'm interested in this discussion in a low-key sense; I don't need
10Gbps firewalling, but would like to move beyond 1Gbps. 2Gbps would do
nicely for a start.

My current firewall hardware, which is a carp failover pair of now-oldish
Dell 1750s with Intel 1000/pro MT nics, is probably close to the limit of
what it can do, at around 600-700Mbps (the switch from openbsd 4.4 to
4.6 did make a night and day difference for them - the recent network
stack tuning has been amazing).

I wonder if it's a viable option simply to run an active-active carp/pf
pair, since the pfsync changes in 4.6? In principle it should even be
possible to add nodes to the pfsync cluster to scale bandwidth beyond
2Gbps. For my specific situation, where the high-bandwidth
transfers tend to be applications like gridftp, involving many different
hosts, it seems like this could work well. Obviously no single stream
could exceed the bandwidth of one node, but besides that, are there any
big shortfalls to this approach?

Graham
--