One or two firewalls?
-
Hello,
We run a small Hotel with ~100 rooms. At peak we had 240 devices online at the same time.
Until recently we had two separate internet connections, two separate routers/firewalls and two physically separated networks for the backoffice and guests.
Today we had a new internet connection installed (unmetered 400/400 Mbit Fiber, 4 Gbit ports, 4 public IPs) and our old routers/firewalls can't cope with the bandwidth so I'm looking for a replacement.
I've used pfsense on the internal network for years and it never let me down. I feel somewhat comfortable with it too. I don't feel like I've grasped VLANs yet but I shouldn't need them because we will continue to run two physical networks for internal traffic and guest internet.
We don't need a captive portal, our internet is free and we just hand out the WPA2 passwords which we rotate every few weeks.
Traffic shapning would be useful (i.e. max 350/350 Mbit for the Guest LAN, max 30/10 Mbit per device) would be useful but I don't want to end up with one of those sh**y overmanaged hotel networks that's borderline unusable because of 10 proxies and content filters in series.I could either buy two SG-2220s and run each on its own IP with its own network (internal/guest) or buy one SG-4860 and have it handle both networks (two WAN IPs, two LANs).
The two firewall solution would be more foolproof to secure and setup but the single firewall solution would arguably give me more performance, less maintenance overhead and more control over the connection. I'm leaning towards the single box solution. It shouldn't be too hard to set up two WAN- and LAN interfaces and separate them entirely.
Is there something I'm missing? -
Problem with 1 is if breaks, everyone is down.. If you had 2 and one breaks you could decide who is better to have internet guest or employees. Or you could leverage just the 1 box for both at that time.
Maybe you should get 2 and set up a carp ha pair so if 1 fails your still rocking…
-
Maybe you should get 2 and set up a carp ha pair so if 1 fails your still rocking…
Sounds like a plan. 8)
-
One other note on VLANS, if you're mostly supplying customer internet via WiFi then it probably doesn't matter much.
But if you offer hard wire access to rooms there's some definite security advantages to using VLans to isolate each room to it's own subnet.
Not to mention the ability to diagnose where excess download traffic is coming from.
