Re: Problem with IP-Pools

[Roberto Nibali <ratz@tac.ch>]

Hello,

> You see, we're doing Gigabit ethernet here (about 600 MBit upstream
> bandwidth), and our largest host group currently has 9497 Entries.
> That's just too much for the usual O(n) method, one table containing one
> match rule per host, and building some tree-like tables to cut down the
> pass time to O(log(n)) is a maintenance nightmare.

I'm in kind of the same situation but I have solved it more or less. Please 
contact me privately so we can discuss about it.

> Not to mention the time to load an iptable with some tens of thousands
> of entries, we cannot wait half an hour for our firewall to boot up.

:) I know that problem. I'm working on a solution myself.

> If you know another method of managing such high traffic and host number
> combinations, we'd love to hear about it, because we _really_ want to
> leave Checkpoint.

I am surprised that checkpoint could handle such a configuration. We had to give 
up on checkpoint long ago because it wasn't able to handle hundreds of different 
NAPT configuration per interface correctly without stumbling over its own 
internal tables.

Just contact me offline so we can discuss things. Regards,
Roberto Nibali, ratz
-- 
echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc