(12-31-2020 11:07 AM)georgia_tech_swagger Wrote:  

(12-31-2020 01:08 AM)king king Wrote:  I love that you're blocking whole /16 subnets of public IP's. F$&k em.

Ahhhhhh the power.

There are several WAF's that run as a service that offer proactive bot mitigation so you wouldn't have to manually mess with it.

I've only got 3U of space and I'm using nearly all of it. If I can fit a pfsense build into something the size of a 1U 1/4 depth switch then I can back mount that on the same U the switch is on.

C'mon man...the cloud, er other peoples' schit, will do it for you and you can keep that 3U.

(12-31-2020 12:07 PM)king king Wrote:  

(12-31-2020 11:07 AM)georgia_tech_swagger Wrote:  

(12-31-2020 01:08 AM)king king Wrote:  I love that you're blocking whole /16 subnets of public IP's. F$&k em.

Ahhhhhh the power.

There are several WAF's that run as a service that offer proactive bot mitigation so you wouldn't have to manually mess with it.

I've only got 3U of space and I'm using nearly all of it. If I can fit a pfsense build into something the size of a 1U 1/4 depth switch then I can back mount that on the same U the switch is on.

C'mon man...the cloud, er other peoples' schit, will do it for you and you can keep that 3U.

Thats what I was thinking but that comes at a cost. What specs do you need for a pfsense virtual appliance? If I decommissioned a asa next year and get it up to date prior to removing from production it might work. But don't believe they can ever be put back on maintenance unless 3rd party?

https://aws.amazon.com/marketplace/pp/Ne...B076TCMRWJ

Ewww @ old ASA. I've got no problem buying the baby Intel Netgate if it gets to that for pf-sense. And I'm very anti-cloud. Bare metal ftw.

Sent from my Pixel 4a (5G) using CSNbbs mobile app

(12-31-2020 05:03 PM)georgia_tech_swagger Wrote:  Ewww @ old ASA. I've got no problem buying the baby Intel Netgate if it gets to that for pf-sense. And I'm very anti-cloud. Bare metal ftw.

Sent from my Pixel 4a (5G) using CSNbbs mobile app

Old school, I love it.

Oh, and at least 3 of you are nerds. Not that there's anything wrong with that. I tried to be a nerd once but couldn't get past CCNA even though I started working on networks back when token ring was state of the art.

(12-31-2020 05:03 PM)georgia_tech_swagger Wrote:  Ewww @ old ASA. I've got no problem buying the baby Intel Netgate if it gets to that for pf-sense. And I'm very anti-cloud. Bare metal ftw.

Sent from my Pixel 4a (5G) using CSNbbs mobile app

You and my infrastructure manager would get along. :)

I've slowly but surely turned cloud first and we have some fun debates.

(12-31-2020 05:13 PM)TigerBlue4Ever Wrote:  Oh, and at least 3 of you are nerds. Not that there's anything wrong with that. I tried to be a nerd once but couldn't get past CCNA even though I started working on networks back when token ring was state of the art.

Ew. Glad I missed token ring. Just had to read about it.

(12-31-2020 09:47 PM)bit_9 Wrote:  

(12-31-2020 05:03 PM)georgia_tech_swagger Wrote:  Ewww @ old ASA. I've got no problem buying the baby Intel Netgate if it gets to that for pf-sense. And I'm very anti-cloud. Bare metal ftw.

Sent from my Pixel 4a (5G) using CSNbbs mobile app

You and my infrastructure manager would get along. :)

I've slowly but surely turned cloud first and we have some fun debates.

There is no cloud. There's only other people's computers.

Only now instead of paying for your hardware and then owning it and paying for colocation and bandwidth, your pricing is now very "cloudy". You get to pay for your CPU time. And your number of CPUs. And your RAM use. And your uptime. And your IOPS. And your storage use. And your bandwidth. And your node count. Did sir want HA on that? $$surcharges$$. And then after you've finally discovered the real pricing and want to leave you're going to find out how difficult it can be to move between clouds.

Site used to be slow for me when I used Google chrome. Switched to duckduckgo a while ago and it's fast again.

(01-01-2021 05:07 PM)georgia_tech_swagger Wrote:  

(12-31-2020 09:47 PM)bit_9 Wrote:  

(12-31-2020 05:03 PM)georgia_tech_swagger Wrote:  Ewww @ old ASA. I've got no problem buying the baby Intel Netgate if it gets to that for pf-sense. And I'm very anti-cloud. Bare metal ftw.

Sent from my Pixel 4a (5G) using CSNbbs mobile app

You and my infrastructure manager would get along. :)

I've slowly but surely turned cloud first and we have some fun debates.

There is no cloud. There's only other people's computers.

Only now instead of paying for your hardware and then owning it and paying for colocation and bandwidth, your pricing is now very "cloudy". You get to pay for your CPU time. And your number of CPUs. And your RAM use. And your uptime. And your IOPS. And your storage use. And your bandwidth. And your node count. Did sir want HA on that? $$surcharges$$. And then after you've finally discovered the real pricing and want to leave you're going to find out how difficult it can be to move between clouds.

True. Didn't say it was cheaper. I think it depends on the business and environment.

Example: we spent 300k+ for redundant environments between our colo and hq [extreme io = $$$] on just hardware and licensing for recovery point, avamar, etc. That would get you 3 to 5 years max or head to 3rd party support and milk the investments. DMZ or DR is a perfect play for someone else's computer to start with. No capital investment and only pay for what you use. The burden is on them to maintain and update. Our last 2 deployments were vxrails and that's been really nice to deploy and easy to update. We can get good 9s for a fair price but not the level of 9s a data center could provide with the scale they're investing in and the sheer numbers they stripe data across.

Another example is vdi. We've outgrown our vdi environment in the first 18 months. Thats actually a good thing. We wanted to before investing in a 4th and 5th node to see just how many we could get in it and profile. We have a diverse environment so the first 3 nodes work for architects but not as well for the engineers. Some calc apps work best with multiple cores while other disciplines need less cores and more ghz. Someone else's computer is a good play there, daas. Especially given the tools to scale up and out easily and most importantly quickly. It's more expensive but it allows for nimble response and from a cfo standpoint measurable opex tracking. X number of staff = x cost. So I need to run the numbers and figure out if we can add 1 node with one profile to address some users needs, another for those users, and then hope they don't want to buy another software that doesn't have different requirements. And forget lumion or twin motion. Rendering applications that need 8gb of gpu. Or daylight analysis anf structural collapse software and the amount of cpu those need. Ugh and point cloud data. F that data. :)

But on the flip side the stability from a IT perspective of this is my metal, I own it, I can manage and see it is optimal. If you're firm is in growth mode IT would have to scale at the same rate as the firm which is costly and slower to respond to when you're small to mid-sized.

At the end tho I could argue for both schools of thought but you gotta pick the path that serves the business and the users most effectively.