Multitenant FWs

Mon May 2 04:20:55 UTC 2011

> -----Original Message-----
> From: christopher.morrow at gmail.com
> [mailto:christopher.morrow at gmail.com] On Behalf Of Christopher Morrow
> 
> one thing to keep in mind is that as near as I can tell no vendor (not
> a singl eone) has actual hard limits configurable for each tenant
> firewall instance. So, one can use all of the 'firewall rule'
> resources, one can use all of the 'route memory' ... leaving other
> instances flailing :(

Ahem, actually ScreenOS does support just such a thing through the use of
resource profiles - with this you can limit the amount of CPU, Sessions,
Policies, MIPs and DIPs (used for NAT), and other user defined objects such
as address book entries, etc. that each VSYS can avail.  This was one of the
primary drivers behind our decision to utilize the NS-5400 for Verizon's
NBFW (you remember that place right Chris, heh')

Stefan Fouant