Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Linux Software

Linux on Nokia IP Series Hardware 138

Posted by timothy from the but-it-wasn't-designed-for-that dept.
Anonymous Coward writes "Michael Rash has written a howto for the Linux Journal on getting Linux to run on a Nokia IP 330. Now we can use a free firewall on a platform normally designed to run Check Point Firewall-1. In these troubling times where IT departments all across the landscape are trying to reduce costs, this will allow companies to say 'No' to expensive support contracts and upgrade costs and still maintain security without having to buy new hardware."
This discussion has been archived. No new comments can be posted.

Linux on Nokia IP Series Hardware More

Linux on Nokia IP Series Hardware

Comments Filter:

  • Finally some good news! (Score:4, Informative)

    by Blaine Hilton ( 626259 ) on Tuesday April 29, 2003 @09:16PM (#5839551) Homepage
    This could really take off in the network appliance market. When I calculate [webcalc.net] the costs of buying such a device you must look at costs over the total lifetime such as support, software upgrades and such. When I first started with technology I was shocked to learn that you had to pay for upgrades. This is a big reason why I do not care for Cisco products. However on the flip side you do have support and with that comes somebody to blame. When the whole network is going up in flames its advantageous to have a person to point fingers at if nothing else...

    Go calculate [webcalc.net] something

    • Re:Finally some good news! (Score:5, Insightful)

      by Anonymous Coward on Tuesday April 29, 2003 @09:32PM (#5839652)
      When I first started with technology I was shocked to learn that you had to pay for upgrades

      Yes, I was also shocked when I found out auto makers wouldn't give me the latest car model every time they upgraded the design. Or that I didn't automatically get later editions of textbooks. Or that I didn't get a free sixpack of Vanilla Coke despite all those Classic Cokes I've bought. Or that I don't get a new HDTV, even that I've been a loyal user of my last one for ten years.

      One purchase does not entitle you to free products for life. Networking products are no different. Neither is software. You can't afford to pay the engineers to work on the upgrade unless you pay for the upgrades. (The only alternative is to pay for them all up front -- but then you wouldn't buy that very expensive product compared to its competitors, now would you?)
      • Interesting point, but still I thought that was the case.

      • Unfortunately, the problem arises when I'm buying a product and the support contract so that at the end of twelve months I finally get the working product that I wanted in the beginning.

        I'm going to have to vote in favor of Microsoft's model on this one...charge for new products, but offer service packs for free.

      • >>When I first started with technology I was shocked to learn that you had to pay for upgrades
        >Yes, I was also shocked when I found out auto makers wouldn't give me the latest car model every time they upgraded the design.

        A better analogy would be Car makers recalling and repairing serious design flaws in their product for free... which is what they do (in the UK at least).

    • Unfortunately, in this line of bussines, a support contract is key when the person in charge of the network needs a little hand-holding, wether it be upgrading, installing or troubleshooting, the person on the other end of the phone does get paid. Where do you think the money comes from? Support contracts!

    • Re: Finally some good news!? (Score:3, Insightful)

      by Anonymous Coward
      It really does astound me that so many people think this a good idea.

      First off, the whole cost factor that people continue to bring up blows my mind. Any company with any knowledge of doing risk analysis will know that paying $50k a year, say, on securing your companies life-blood (trade secrets, source code, credit card numbers, etc.) is nothing. If your company can not afford this kind of money for proven security solutions, then you're obviously looking at the wrong supplier, or the wrong product fro
      • Totally agree... nuff said from me.
      • When you chose a reputable company's solutions, you can count on security vulnerabilities being addresses quickly

        Like microsoft. Yeah, that model works really great.
      • having used checkpoint and ccse and ccsa courses I can say that it is a very good firewall but why would anyone want to rip out checkpoint and ipso and install linux? if you want a linux (or for my preference, freebsd) firewall then buy a 1u box and a qfe ffs. why trash a perfectly good nokia box? checkpoint is a damn good firewall even if you don't keep getting updates to the latest and greatest.

        dave
      • First off, the whole cost factor that people continue to bring up blows my mind. Any company with any knowledge of doing risk analysis will know that paying $50k a year, say, on securing your companies life-blood (trade secrets, source code, credit card numbers, etc.) is nothing.

        Absolutely. Besides, the one-time cost of the hardware is trivial and can be depreciated over the course of a few years. The only issue that really matters are the on-going support costs and the headcount to maintain it.

        T
    • I'm going to have to agree with the other poster and say that it's highly annoying to see your spam pasted into your posts. Put that annoying crap in your sig, you look like a car salesman or something.

    • Re:Finally some good news! (Score:5, Insightful)

      by pi_rules ( 123171 ) on Tuesday April 29, 2003 @11:36PM (#5840240)
      When the whole network is going up in flames its advantageous to have a person to point fingers at if nothing else...


      I hate this sentiment. It doesn't do the network or the business any good to be able to point a finger. It does you some good though, as you're not responsible for it in managment's eyes. So, not only are you paying out the arse for support, you're also suffering downtime. Wonderful!

      Nobody considers it your fault though, unless you didn't have a good reason for picking your vendor. If everybody thought the vendor was a good one then you're okay. Well, the end of the fiscal year comes around and your department spent all of it's money and didn't achieve it's goals. The internal IT team sticks their thumbs up their collective asses and points the index finger of their free hand at the vendors. Business conclusion at this point: The department costs too much and provides too little. Outsource it or cut it.

      You still lost your job.

      Maybe I'm idealistic but it frightens me how many people only do enough to keep their job safe without thinking about the company's benefit as a whole.

      Perhaps I'm a bit jaded though. A recent project that I've been working on just illustrates the point that your vendor isn't employing hundreds upon hundres of Supermen. In fact, their employees might be just damned near retarded sometimes. Their engineers have deadlines to meet and they can't meet those deadlines if you're still finding bugs in their recently released product and demanding fixes for them. It really doesn't matter how much money you put into them -- they're still only human. No amount of cash will change that.
      • I hate this sentiment. It doesn't do the network or the business any good to be able to point a finger. It does you some good though, as you're not responsible for it in managment's eyes. So, not only are you paying out the arse for support, you're also suffering downtime. Wonderful!

        damn right. esp as alot of these companies have woefully expensive and just generally woeful support anyways. if there is a problem, it's nice to say "it wasn't my fault, I did all I could" but surely it's more important not t
    • You should be modded down to hell for your webcalc advertisement alone.
    • Cisco Systems, Empowering the Internet Generations! ,,,,,,,,,,,,,,,,,

  • "now we have" (Score:5, Interesting)

    by Triumph The Insult C ( 586706 ) on Tuesday April 29, 2003 @09:19PM (#5839566) Homepage Journal
    a way to void that warranty

    this is nothing new.

    the nokia IP boxes run IPSO ... a hardened freebsd. people have been removing IPSO and install fbsd for quite some time.

    now, why you'd buy a several thousand dollar p2-450 to begin with, i can't say.

    • devil's advocate (Score:5, Interesting)

      by Triumph The Insult C ( 586706 ) on Tuesday April 29, 2003 @09:39PM (#5839686) Homepage Journal
      seeing some other posts ...

      we have a number of nokia's where i work (it's a university ... i work tech for a dept. the nokias belong to the uni, so i don't work on 'em), mostly 330s and 440s.

      granted, they are based on older hw (p2-450s, early p3s, etc). however, what you're paying for is CYA and management. if it breaks, you call nokia or whomever is responsible for providing support for it.

      IPSO does one thing, *very* well. personally, i'm of the opinion of a decently spec'd out box running obsd w/pf, but only because i manage the box. some may like linux with iptables or whatever.

      suppose you go the obsd/linux route on an off-the-shelf i386 machine. 1. you buy the machine. 2. you have to pay someone to manage it. rough guesstimation, but i see it a *lot* cheaper to buy a few nokia boxes and pay the fw-1 license fees. my dept is already incurring my salary, so we decided to get an i386 box (dell pe1650), two 4 port ethernet cards, and get on with it. it works great. if that thing breaks though, it's my ass. plus, if i leave, someone will need to know how to manage it. the uni where i work going with nokias ... it's (ipso/fw-1) a common platform in that niche, so it'd be much easier to find someone else that knows how to manage them, and, they have nokia to have fix problems.

    • Re:"now we have" (Score:4, Interesting)

      by MoreBeer ( 91936 ) on Tuesday April 29, 2003 @10:50PM (#5840037)
      I manage 11 Nokia devices in B2B site to site VPNs around the world. For the remote managability and the ability to pre-configure and 'parachute' them into their environment, there is absolutely no better piece of hardware out there. I have an IP330 in Japan with an uptime of damn near 2 years.

      Lately, however, I've had differing opinions of Nokia. Why should I pay $4K for an AMD processor and then $1500 a year for support? It's insane! I could take a $4K HPaq DL360 and install Check Point's (free) SecurePlatform on it. Hands down 10000% better performance, and SecurePlatform (RedHat) is a supported Check Point SKU on commodity hardware. A drive pops on an IP330? You're screwed.

      The only major benefit I can think of in regards to this article is the Linux/IPSO performance numbers I've read about... I've heard that Linux will hands down outperform IPSO, but have _not_ done any formal testing myself. If I could take an IP330, install RedHat 7.3 (like I have running my management server), and then FW1, plus still have the remote managability (using the internal modem), I'd think about it. The article doesn't say a thing about the internal modem (an additional option), but I'm betting that it ain't gonna work.

      my .02
  • IPSO is based on FreeBSD, provides advanced routing and failover capabilities and is extremely stable, with uptimes regularly running in the multiple hundreds of days.

    Well we'd better put an end to THAT!

    Seriously though... What does the checkpoint hardware have to offer? And even if it has something wonderful, wouldn't it make more sense to use, say, FreeBSD on it?
    • Well, there are a few points of note.

      CheckPoint is a software firewall package and nothing more. It will run on many platforms including Nokia devices running IPSO; but it will also run on Linux, Solaris and Windows 2000, just to name a few.

      In essence, the Nokia hardware is a security appliance which is optimized for network throughput. IPSO is essentially a hardened BSD; you can run an SSH daemon, a mail server, it also supports cron jobs, etc.

      In all respects, getting Linux to run on a Nokia IP device i
      • In essence, the Nokia hardware is a security appliance which is optimized for network throughput.

        Optomized for throughput, how? It's got an AMD K6 chip, so it certainly couldn't have a 64-bit PCI bus... What is it that makes this better than a $200 1GHz+ machine, with a few Tulip network cards?

  • Not A Big Deal (Score:5, Interesting)

    by TheHulk ( 80855 ) on Tuesday April 29, 2003 @09:23PM (#5839591)
    The Nokia IP series hardware is nothing more than older AMD K6 processor with a small amount of RAM by todays standards. You'd be better off with a $300 PC from Wal-Mart and a couple network cards. Don't get me wrong, I love the fact that Linux continues to spread to new area, but it has to be put into perspective.

    • Re:Not A Big Deal (Score:2, Informative)

      by Anonymous Coward
      Actually, the newer IP330 models (SN's start with 9N instead of 8A) are AMD K6-2 400's with 246megs of ram, and can be found on ebay.

      Good luck getting support on the box from Nokia or a reseller after something like this has been tried, with or without a support contract. You'll be told it's not supported, and nothing can be done.
    • a 300$ PC from walmart? I would have to worry about harware failure with hardware thats that cheap... I would opt for older higher quality stuff from a used parts depot rather than brand spankin new questionable stuff. I have found there's alot more stability and realiability in component based MB's rather than the All in 1 MB's you see today.. not to mention the poor proformance of them aswell..
      • VIA EPIA Mini-ITX. Cheap, reliable, small and quiet. Just add your favorite Free/Open Source Operating System and another nic and you are good to go. Way better than those WalMart specials.
      • a 300$ PC from walmart? I would have to worry about harware failure with hardware thats that cheap

        Oh, expensive hardware never breaks? Good to know that.

        Too bad no-one told our Cisco 7513 (enormously expensive when purchased) that went belly-up today and stayed that way through repeated power-cycles, in spite of dual processor cards and redundant power supplies.
        • You do have a support contract, do you ? With 4h "time back to service" or some such ?
          • I know there is some sort of Cisco support contract. The support is manintined by our central IT, so I don;t know the dtails, I suspect it's as you stated.

            But that's not the point. The point is that even famoulsy expensive stuff can break. The support contract adds to the cost. The cheaper stuff might be the better deal if you can buy 2 or 3 of them and have them ready to in the event of failure.
        • Yeah I bet ya you picked it up from Walmart aswell :) I wasn't saying that there are never hardware failures... the 300$ PC's at walmart are 300$ because they are made of the cheapest stuff they can find to get the price down... They take very little consideration into Quality when choosing parts.

  • I don't get it. (Score:2, Insightful)

    by Anonymous Coward
    What is any different from this box and a normal linux box with serveral NICs? The reason people buy something from Nokia is to run Checkpoint. Why not just buy a 2u and put quad intel nics in it?

  • WTF IS HE THINKING! (Score:5, Interesting)

    by Anonymous Coward on Tuesday April 29, 2003 @09:27PM (#5839614)
    Okay first off. A Nokia IP330 isnt worth jack!
    I have two of them, and basicaly they are a AMD 800mhz rack mountable device. Brand new...around $4,0000 without any Checkpoint software/licenses.

    IDE drives, and some other typical stuff.

    You would be better off buying a Dell PowerEdge rackmountable server with no OS. Or if you are using Checkpoint then save a bunch of money and skip the Nokia solution. Use checkpoint Secure OS (Redhat with lots of limitations) and put it on a Dell with 4 hour replacement. That alone would save you over $2K a year in support contracts with a Nokia Platform, and you get a faster firewall to boot!

    So explain to me...WTF IS THE POINT!

    Yes, Nokia IP330 are expensive solutions. And Yes so is Checkpoint. But anyone who compares Checkpoint to a Linux Free solution...well I would like to see a comparison of that. The Checkpoint firewall is a complete solution, with plugins to your security needs, and yes you ahve to pay extra cash to get it all to interact.

    The linux solution is hodge podge and not even close to being remotely the same in either quality, or type of solution.

    This would be like comparing MS Exchange to Sendmail. Yes, they both send emails. One is very expensive and has some nice options. The other sends mail well and some think its a better solution. The point being that with Exchange you are not paying for just an email server. It has lots of bells and whistles (dont blame exchange for viruses...Outlook yes, exchange no)

    Same with Checkpoint! You are not just paying for a firewall.

    So you are going to buy a expensive Nokia IP330 and install linux on it. Very amuzing....

    • Re:WTF IS HE THINKING! (Score:1, Insightful)

      by Anonymous Coward
      What is more entertaining is that they are only replacing Checkpoint with IPTables.

      IPTables in not a Inspection type firewall.

      So another reason this would not make sense.
      • Wrong. Netfilter (iptables is just the normal tool to configure it from the command line) does use stateful inspection (as does *BSD's [i]pf). Its predecessor (ipchains) was a stateless filter.

        What is true is that CheckPoint's SMLI architecture has a lot of flexibility inherent in its design that Netfilter doesn't. OTOH, I haven't seen anything that uses it. I would have thought that CKPT would have added better support for sophisticated protocols by now (e.g. NetBIOS, NetMeeting, DCE-RPC).

        --

        • Wrong again (Score:2, Informative)

          by Fatty ( 21358 )
          Checkpoint inspection refers to layer 3-7 inspection, not just stateful inspection of IP flows. Without going into userland or writing your own module, you can't crack into headers with iptables the way you can with CP. ie, write me an iptables rule that stops all GIF images from being loaded from an arbitrary website.

          CP has a language called INSPECT that lets you build any filtering rules you want. That code is compiled into the CP driver which wedges in between layers 2 and 3 on the host's network sta
          • ie, write me an iptables rule that stops all GIF images from being loaded from an arbitrary website.

            iptables -I INPUT -j DROP -p tcp -s 101.102.103.104/32 --sport 80 -m string --string "GIF89a"

            OK, that's a bit brutal, and it could do with a "only match between byte ranges xx and yy of the stream", but that'll come, I'm sure (besides, you said "all GIF images", and it's as hard to do that completely [i.e. including GIFs embedded in other file types such as .doc and .tar] and solely with iptables as it

            • iptables -I INPUT -j DROP -p tcp -s 101.102.103.104/32 --sport 80 -m string --string "GIF89a"

              OK, that's a bit brutal, and it could do with a "only match between byte ranges xx and yy of the stream", but that'll come, I'm sure (besides, you said "all GIF images", and it's as hard to do that completely [i.e. including GIFs embedded in other file types such as .doc and .tar] and solely with iptables as it is with INSPECT - using a filtering proxy would be a better approach).

              That exactly command in iptabl

              • Only if the source IP address (-s 101.102.103.104) matches that of Slashdot's servers. :-P

                But yes, that is a problem with doing it at this layer, rather than with a filtering proxy. To do it properly you need to build all sorts of recursive file decomposition stuff (.doc, .tar, .gz, .zip, etc.) into a kernel module or INSPECT code (ewww!) or your policy ends up being too weak, or too strong. That's probably a hint that this is the wrong place to be performing this kind of filtering.

                If all you wanted to

          • write me an iptables rule that stops all GIF images from being loaded from an arbitrary website.

            Write me an INSPECT rule. :)
            I can't see how this is done, except by using the Security Servers, which are Proxys. (and god-awful proxys, besides)

  • I use CheckPoint (and am a certified CCSA).

    Licensing and pricing suck , but it sure is nice to quickly push a firewall policy to several endpoints at once. Failover solutions are hella easy also.

    (Although typing in "failover" on PIX [cisco.com] is hella nice)

  • It's not even a hack anymore (Score:3, Insightful)

    by ObviousGuy ( 578567 ) <ObviousGuy@hotmail.com> on Tuesday April 29, 2003 @09:30PM (#5839635) Homepage Journal
    You find the debug port, download your OS and voila you've got Linux running!

    Running an OS isn't something to crow about.

    Neither is replacing a BSD with Linux.

  • IPSO is More than Security (Score:4, Interesting)

    by SonOfFlubber ( 14544 ) on Tuesday April 29, 2003 @09:31PM (#5839639)
    There is more to IPSO, the net OS that runs on the Nokia 330, than just a hardened freeBSD. The networking protocols are coded deep into the kernel, and have been highly optimized. To run a vanilla Linux on the box means that net routing will just become another application to the OS, along with the corresponding hit to performance.

    • Re:IPSO is More than Security (Score:5, Informative)

      by convolvatron ( 176505 ) on Tuesday April 29, 2003 @10:05PM (#5839838)
      actually no. i was in the group that did the kernel work for ipso. it has a custom ip forwarding path and forwarding table machinery. the routing is done using a largely rewritten version of...gated

      these three things and the management system make ipso a good software routing platform.

      which doesn't really offset the cost of what is a pretty sluggish pc

  • But WHY? (Score:5, Insightful)

    by subreality ( 157447 ) on Tuesday April 29, 2003 @09:31PM (#5839641)
    I'm a network guy for a fairly large company. We use Linux all over the place, including firewalls. Frankly, I'm quite impressed; we've found it to be far more supportable than even the best commercial products.

    But why would I want to run it on a Nokia box? Typically, firewall vendors sell the box's hardware and software support together. So, if you're not paying the software support, you have no hardware support. If you're using Linux to save costs, and it fries its power supply, you're SOL.

    For the amount of CPU power that you get in the Nokia, you're better off if you buy a good, high-quality PC (We use Dell PowerEdge), throw a few NICs in it, and run Linux on it. The PC will be cheaper, include hardware support, and be easily field-servicable by any PC tech.

    • If you're using Linux to save costs, and it fries its power supply, you're SOL.

      If you're using Linux to save costs, and the hardware fries it's PSU, how will they find out before they replace the PSU and try to power the unit up again?

      I know they probably ask questions like that, but until the hardware boots up, they only have your say-so as to what's installed on it.

  • What's the point? (Score:2, Insightful)

    by Morthaur ( 108553 )
    The Nokia IP series are just PCs in nifty-lookin' rack cases. And they're already running OpenBSD, right from the factory. Which, last time I checked, had far better security (and hence made a better FW) than GNU/Linux. If you don't like FW-1, just don't run it! Set up whatever BSD FW you prefer. Duh.

    Also, given the very high cost of these boxes, and the fact that (with FW resource usage so low) they won't become obsolete any time soon, why not just leave it alone? How does this save anyone any money

  • Nokia IP440 running Windows 98 (Score:3, Interesting)

    by scubacuda ( 411898 ) <scubacuda@gmai[ ]om ['l.c' in gap]> on Tuesday April 29, 2003 @09:38PM (#5839680)
    I actually installed Windows 98 on one of the Nokia IP440s. They have CD drives (unlike the IP330s) and are really nothing more than a souped up version of the PC you have at home.

    On the Nokia series, you pay a premium for A) Nokia's OS (NetBSD-based, I believe, which has VRRP for failover), B) it's interoperability w/programs like CheckPoint and ISS, and C) being able to rack it.

    WAY too much of a premium, in my opinion. When the sales guys at the VAR I was at tried to push them on all our customers, I quietly directed them all to PIXen or OpenBSD.

  • DMCA? (Score:1, Funny)

    by Anonymous Coward
    Would this not violate the DMCA?

    I mean you just hardware hacked a device to make it work.

    For example spoofing the NIC's that were designed to work only with an IPSO solution.

    Just a thought....

    Dude! Your going to Jail!

    Next time buy a Dell-

  • Compiler -- on a firewall? (Score:5, Interesting)

    by Scumbag Tracker ( 650383 ) on Tuesday April 29, 2003 @09:42PM (#5839714)
    Some thoughts I had when reading the article:

    > Once the new partition table is saved there is no going back; both IPSO and Check Point FW-1 are gone.

    Of course, if I were the one doing the installation I'd backup the original drive contents so I could always go back to original configuration (in case of screw up, or if I wanted to sell the unit on e-bay, etc.) It's only 8 Gb...

    > When it comes time to install the various packages, select only Network Support and then go into the Select Individual Packages section and add GCC, autoconf and ncurses.

    GCC on a firewall box?! Sounds like a new tool of terror for the scrip7 kiddies. ;-) It might be a good idea to delete the compiler after everything has been configured, or even better, don't install it and build any necessary packages on another server, then transfer the binaries to the firewall.

    Nice article though. Nothing like putting the screws to those closed source, code hoarding, proprietary software vendors. :-D
    • GCC on a firewall box?! Sounds like a new tool of terror for the scrip7 kiddies. ;-) It might be a good idea to delete the compiler after everything has been configured, or even better, don't install it and build any necessary packages on another server, then transfer the binaries to the firewall.

      This seems to be a common misconception. Cutting down software present on a fw brings you NO extra security. Even if you're running it from a read-only meadia it makes no difference, because you'd still need som
      • I have to take back a bit, ditching shell, login and such applications does indeed make things quite a bit more difficult and may even prevent some remote exploits, but even then incorporating a minimal shell into a buffer-overflow-return-address-trickery should not be too difficult for an experienced cracker.

        And don't come telling me that it's worth something to prevent most script kiddies, because that's just not true for two things :
        1) preventing only some crackers, however large portion of them, is not
    • Yeah, no one will be able to compile their own x86 GNU/Linux binary.

  • I've thought about this.. Not enough $$ to start (Score:1, Interesting)

    by Anonymous Coward
    I've thought about entering the appliance market too, but dealing with Cisco and similar types would be too hard. Still, the OS and network components are already taken of. It' sthe inetrface that needs work on.

    My idea is to have a small box (running a via cpu) and have 3 nics in it. Lets call then eth0, eth1, and eth2. Eth0 and Eth1 would be a frame and packet discriminatory firewall capible of maintaining quotas. The quotas would be set up in user/group/all settings which would bind MAC or IP for quota s


  • Hey, WatchGuard has been running on a Linux 2.x kernel for a while now - - sure would be nice to be able to put their software on a box of my choosing. Their stuff is pretty pricey . . . .

    Too bad I'm not a real coder, maybe I'd try it myself. As firewalls go, WatchGuard's a pretty good one.

  • Why do this? (Score:5, Insightful)

    by rjbrown99 ( 144423 ) <rjb.robertjbrown@com> on Tuesday April 29, 2003 @10:44PM (#5840011) Homepage
    As a bit of background, I work for an established Check Point and Nokia partner. We regularly sell large numbers of these firewalls to enterprise customers. They are as reliable and full-featured as a firewall gets.

    This article brings up the question: why would anyone consider installing Linux on the Nokia appliance? The answer: they wouldn't. Here are the reasons.

    1. If the hardware is used/old, it is outdated by today's standards. For $800 including hardware support you can get a nice rackmount Dell server and run Linux on it. The performance boost would be many many times what you can get on the Nokia.

    2. The Nokias hold their resale value better than a system with the same hardware specs. An older 330 can still fetch a decent amount on Ebay. Right now, there is one that has a buy-it-now price of $1,199.00. Why do you want an AMD 233 with no hardware support when you can sell it and buy yourself an 850MHz Celeron with support and then pocket $300?? It doesn't make sense.

    3. Presumably, if you already have the Nokia then you have Check Point as well. Why ditch it for a the Linux firewall? The management, logging, and OPSEC features of Check Point outweigh the benefits of switching to Linux.

    I think the Nokia/Check Point solution is great. I just don't think that trying to run an unsupported OS on the platform is worth it. Look at the cost/benefit of a new system. It makes a lot more sense to "budget-strapped IT departments."

    -shox

  • The poster must be joking... (Score:5, Informative)

    by Gruturo ( 141223 ) on Tuesday April 29, 2003 @11:00PM (#5840089)
    Fist of all, the Nokia firewall appliances already run a stripped-down and hardened *nix (freeBSD-derivative) so this is not exactly new. People have been replacing it with a home brewed distro for a while, for the fun of it.

    Second you'd be crazy to ditch Checkpoint FW1 for iptables. I run a few FW1's at work, and have Linux+iptables at home, but I'd never exchange the two. Try to create a distributed, system-wide network policy with 5 clustered (stateful failover capable) enforcement points, some of which doing CVP-based email antivirus on the fly and tell me how easy it is with Iptables. And, get it to NAT Oracle sqlnet v2 sessions when someone decided not to run it on port 1521 "for added security" (aargh).

    Third, don't *have* to pay for yearly support contract, but usually you *want* to. You have an initial cost depending on the FW1 license (50-node, 250-node or unlimited) and then you keep paying for two things called support and accountability, which matter a lot in the business sector. And that's exacly why Linux, to really flourish in the business sector, at the moment has more need of companies professionally supporting it (for $$$) than developers.

    Don't get me wrong, I am a loyal, happy, avid Linux supporter and make my living out of it. I love Slackware and have come to rely on it like I could do with nothing else, but from the AC's comment it looks like he really got it totally wrong and never wondered *why* someone should pay for a professional product.
    • I'm not disagreeing with you on this...in fact I totally agree. However, don't think that IPSO is a totally hardened OS. It's an extremely good start, but its not the cats meow. :) There are a few things that need to be done.
    • I wish I had some mod points right now... Gruturo hit the nail on the head.

      To turn a Nokia IPSO/Checkpoint firewall into a Linux based firewall would be down right silly.

      I used to work for a company doing Nokia IPSO/Checkpoint firewall management. My job was a dream there because of how well the system is put together.

      I've never seen any specs on how well iptables handles connections, and I would imagine it would depend greatly on how well your system is set up, but I've seen a Nokia IP440 running I

  • As a large Nokia / Checkpoint shop who has recently been looking at alternative solutions to the high maintenance cost and fingerpointing that goes on between the two companies nowadays when there's a problem; the opportunity to load Linux and enventually Checkpoint's Secure OS on an IP330 is very compelling from the standpoint we would be able to use the hardware we purchased but be able to go to one source for OS and FW support.

    Not to mention you usually need to upgrade the IPSO when you upgrade to the l
    • Yeah, right, Checkpoint on Linux on IP330.
      Get the half-assed Linux support of Checkpoint
      together with the sub-par performance of the overpriced IP330. Now THATs a real good point...
  • You might want to remember something important... On IP330s I believe the Boot Manager resides on the hard drive itself and formatting/repartitioning or otherwise altering it might render the Nokia device no longer able to use IPSO.

  • Opinions from LOTs of experience... (Score:3, Interesting)

    by Cybersonic ( 7113 ) <ralph@ralph.cx> on Wednesday April 30, 2003 @01:32AM (#5840619) Homepage
    Ive installed probably over a hundred of Nokias in the field, so ive seen a lot with these machines...

    In terms of support, everyone here is right - stick with IPSO so you dont void your warranty! Nokia IPSO is a great os for Check Point, and supports all the features Check Point supports (except the Reporting Module server - its Wind0ze only - well until NG FP4... ;)

    I have a few customers that have installed Secure Platform (customized, hardended RedHat 7.2 with a shell to ease administration - in NG FP4 contains a web gui similar to their SOHO Home products) All of these customers have expired hardware contracts so its no big deal to them. The IP330 and IP440 are quite out-dated now... Netfilter does not need much power though :)

    I agree CheckPoint is a little pricy, but they have a feature set that nothing else touches.. yet... Cool stuff, like single-sign on transparent authentication with user logging, and centralized logging with a decent gui with reporting features. (all for a price...)

    My only beef with the product is NO LINUX GUI! aarrgg... At least i can run Windows in a VM on Linux and OSX... (well, i also dont like the fact that it is closed source, but i cant do much about that...)

    As for the Boot Manager, you can safely wipe that out on the IP330 if your going to Linux... Its similar to the /boot patition on a Linux box - its does not contain BIOS stuff...

    Wouldnt it be nice if there was a decent, cross-platform gui for distributing Netfilter rulebases to multiple Linux firewalls with a centralized logging database and a nice PHP/MySQL frontend for reporting...

    Ralph Bonnell - CISSP, LPIC-2, CCSI, CCSE+, CCNA, RSA/CSE, CSFE, MCSE 2000
    • Checkpoint has a GUI that works under Linux (albeit with the limitation that it needs to be run in either 8-bit or 24-bit color). I use an SSH session to my Checkpoints and X-forward "fwui" and "fwlv" every day.
      • Are you sure your not using 'fwui' on Solaris (and Xforwarding to Linux)? If your not, enlighten us! :) I would *LOVE* to access the newest GUI in Linux.

        Keep in mind that the Solaris Motif GUI costs 1000$ per firewall, and is licensed on the firewall. (not the client itself) Which means that in a reseller scenario, I would have to sell every one of my customers that 1000$ Motif GUI license :(
  • In these troubling times where IT departments all across the landscape are trying to reduce costs, this will allow companies to say 'No' to expensive support contracts and upgrade costs and still maintain security without having to buy new hardware."

    Well, the choice actually is, pay another company to maintain/support it, or pay a linux geek in-house to do it. I would argue that for many reasons, the former is more economical than the latter. If you pay for a support contract, you benefit from the econom
    • Very good post. A good summary of the main argument. All too often, technical minded people ignore they overall business considerations. They seem to believe the cheapest technical solution to a problem is the best, but often they don't account for all the related costs. At the end of the day, you want to minimize $$$ to the business as a whole.
  • We recently replaced the Nokia/Checkpoint boxen with PIX firewalls. I don't care to get into a PIX vs Checkpoint war, but lets just say it saved us TONS of $$$$ on a yearly basis.

    Having seven of these IP650's sitting on a shelf, I had to wonder... what can I use them for??? Then it hit me... I need RMON type probe capabilities in my call centers around the country, and with the four port NIC's installed, these might make good candidates.

    I pull the compact flash card from the 650, put it in my reader on my
  • Every time I've run a firewall on my nokia, it becomes totally unusable for calling people. But then again, I do get fewer telemarketers.

Slashdot Top Deals

The Tao is like a glob pattern: used but never used up. It is like the extern void: filled with infinite possibilities.

Close