Bandwidth shaping solution evaluation

Overview

At OSAF, the office network is all behind a 2.3Mbps SDSL line. This works well, but since there is no throttling, proxying, or bandwidth shaping, the network can get congested by any single box transferring "too much too fast" from any server.

We've undertaken a project to add bandwidth shaping and management to the office network.

Background

• Slashdot Discussion: http://linux.slashdot.org/article.pl?sid=05/08/06/1933229&tid=163&tid=4
• Mastershaper (Web interface to tc/iptables similar to fwbuilder): http://shaper.netshadow.at/shaper/
• Wikipedia on ALTQ: http://en.wikipedia.org/wiki/ALTQ
• Good read about traffic shaping: http://www.usenix.org/publications/library/proceedings/usenix99/full_papers/cho/cho.pdf

Evaluation matrix

Applications

Consolidate

• Bandwidth shaping

Open issues

• Routing
  • Firewall rules
  • Inter-subnet routing
  • SNAT/DNAT
  • VPN (IPsec)
  • DMZ
  • ARP/RARP/Proxy ARP
  • 802.1Q VLAN trunking
• Bandwidth management
  • HTTP proxy
• Services
  • DHCP
  • DNS
  • DDNS
  • RADIUS
• Analysis
  • nFlow collector
  • Traffic analysis
  • Bandwidth measurement
  • rrdtool (MRTG/Cricket)
  • Consolidate syslog
  • SNMP for traffic
  • ntop
• Security
  • Port knocking
  • Wireless supplicant
• Reliability
  • CARP/VRRP

Separate box

• Intrusion detection
• Intrusion prevention
• Wireless network routing

Not needed

• PPPoE
• VPN (PPTP)
• FTP server
• HTTP server
• MTA
• Spam/virus filtering

Product notes

-------------------------------------------------
M0n0wall ( http://m0n0.ch/wall/features.php )
+ reliable/tested firewall (currently v1.2)    
+ focus on stability, embedded hw, and ease of use
+ easy to deploy/manage (can be cd or flash based)
+ cheap/supported hardware available: (http://www.logicsupply.com/default.php/cPath/73)
+ provides full firewall, vpn, and traffic shaping 
- traffic shaping is 'minimal', not advanced
- VPN requires separate user management      
- no direct HA support (tho config backup is possible)

pfSense ( http://www.pfsense.com/index.php?id=26 )
+ m0n0wall++
+ most adv features for both fw/vpn/traffic shaping
+ focus on adv features and extensibilty
+ allows vpn integration into AD   
+ easy HA configuration
+ more adv monitoring
- ***alpha software (not tested)

Cisco PIX ( http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/index.html )
+ reliable, tested, supported product
+ adv vpn support
+ adv traffic shaping 
+ easy to use GUI   
+ easy HA configuration
- costly (not free)
- requires knowledge of IOS

Homegrown (iptables/pf + fwbuilder)
+ very flexible 
+ most adv vpn and traffic shaping capabilities
- hard to manage/upgrade/support
- most time intensive to setup/debug/troubleshoot
          
-------------------------------------------------
Others:
redwall: http://www.redwall-firewall.com/index.php?option=com_content&task=view&id=14&Itemid=29
netscreen: http://www.juniper.net/products/integrated/
netboz: http://www.netboz.net/
ipcop: http://www.ipcop.org/
astaro: http://www.astaro.com/
pfsense packages: http://www.pfsense.com/packages/All/
m0n0wall device: http://www.netgate.com/product_info.php?products_id=209