Cisco PIX Firewall Service Upgrade
We recently upgraded our shared firewall offering, replacing the SonicWall units with dual Cisco PIX 515e firewalls. This upgrade affords the servers behind the shared firewall solution with a number of advantages over the previous units, but today I’ll be focusing on only the core reasons for our upgrade of this particular aspect of our environment.
The major reason for the upgrade was an increased range of rule flexibility due to the tried and true IOS software offered on CISCO-branded firewalls. We now have the capability of easily and sanely modifying access lists to prevent and allow individual IP addresses and ranges of IPs access to specific services, something the SonicWall offered though only in a vastly limited manner. Previously, it was extremely difficult for us to block access to all but a certain IP (for example, if the service only needed to listen to a specific IP it was extremely taxing of the unit to listen for this single address while blocking connections from all others), whereas now, it is a single configuration line on the new equipment.
The other primary reason for the upgrade was the built-in, automatic failover configuration of the unit to the secondary 515, in the case of an emergency. The second PIX 515e, which we hope we never need to utilize, automatically grabs all configuration data from the master 515. In the event of a hardware failure on the primary 515 the secondary unit will immediately take its place, allowing seamless failover while ensuring continued operation for all servers located behind the units.
As always, if you have additional questions, comments, or concerns in regards to whether your server is as secure and protected as it could be, our technical support department is always standing by to discuss these items with you. It’s as simple as logging a support ticket in your Pentagon interface, and simply asking if you could benefit from the added protection of a hardware firewall sitting between your server and the rest of the increasingly hostile Internet.



