NAT question

[scottdware]

I'm in the progress of planning a DMZ for a new facility that our company is building. Anyway, say if we decide to go with a Checkpoint firewall, behind a Cisco router (for the incoming T1's), would you reccomend doing NAT on the Checkpoint firewall, or the Cisco router???

Any help would be appreciated. Thanks!

 

[Cluebird]

The gist of any firewall is NAT, so the firewall will do that. You should consider a PIX instead of Checkpoint IMHO (security by obscurity).

 

[scottdware]

Why would you consider a PIX over Checkpoint...just curious?

 

[Cluebird]

PIX runs on Finesse OS which does not have exploits of the box on which you install Checkpoint (Checkpoint is software overlay on OSes that hackers know intimately). Lately, Cisco has been dropped PIXen prices so they're almost giving away the boxes. If there is an issue and I have Cisco equipment, there isn't the "passing the buck" syndrome with Cisco saying it's a Checkpoint problem and Checkpoint saying it's a router problem. PIX now uses CLI that is more like IOS so you have less retraining if a router person needs to configure the PIX. PIX now supports GUI tools (PDM for one box, CiscoSecure for multiple boxes) for those that are used to Checkpoint GUI.
Again, my opinion only.

 

[lgarner]

I'm not too familiar with Checkpoint, but have set up a couple of Pix's. The failover capability is very well done, the reliability is very high and it's a very well-known firewall type.

Also, if you have Cisco routers then your halfway there in understanding the Pix operation. The Pix FOS is becoming more and more like the router IOS.

I agree with having the firewall take care of NAT. You probably want to NAT your internal addresses to the IP segment given by your ISP, which would be between the router and firewall.

 

[scottdware]

Thanks alot for the insight. I have used a PIX before...but I was just wondering what other's thought about using either one. I think that I will look more heavily into the PIX solution...again, thanks!

 

[NetEng631]

I would recommend a Netscreen firewall over both Pix and Cisco. Netscreen has a great set of products from the very low end home office to the high end enterprise. Everything is done in custom asics aswell has having a simple web UI or a full command line interface. They are easy to learn and very scalable.

NetEng