Slashdot Mirror
Linux on Nokia IP Series Hardware
Anonymous Coward writes "Michael Rash has written a howto for the Linux Journal on getting Linux to run on a Nokia IP 330. Now we can use a free firewall on a platform normally designed to run Check Point Firewall-1. In these troubling times where IT departments all across the landscape are trying to reduce costs, this will allow companies to say 'No' to expensive support contracts and upgrade costs and still maintain security without having to buy new hardware."
a way to void that warranty
... a hardened freebsd. people have been removing IPSO and install fbsd for quite some time.
this is nothing new.
the nokia IP boxes run IPSO
now, why you'd buy a several thousand dollar p2-450 to begin with, i can't say.
vodka, straight up, thank you!
Well we'd better put an end to THAT!
Seriously though... What does the checkpoint hardware have to offer? And even if it has something wonderful, wouldn't it make more sense to use, say, FreeBSD on it?
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
The Nokia IP series hardware is nothing more than older AMD K6 processor with a small amount of RAM by todays standards. You'd be better off with a $300 PC from Wal-Mart and a couple network cards. Don't get me wrong, I love the fact that Linux continues to spread to new area, but it has to be put into perspective.
Okay first off. A Nokia IP330 isnt worth jack!
I have two of them, and basicaly they are a AMD 800mhz rack mountable device. Brand new...around $4,0000 without any Checkpoint software/licenses.
IDE drives, and some other typical stuff.
You would be better off buying a Dell PowerEdge rackmountable server with no OS. Or if you are using Checkpoint then save a bunch of money and skip the Nokia solution. Use checkpoint Secure OS (Redhat with lots of limitations) and put it on a Dell with 4 hour replacement. That alone would save you over $2K a year in support contracts with a Nokia Platform, and you get a faster firewall to boot!
So explain to me...WTF IS THE POINT!
Yes, Nokia IP330 are expensive solutions. And Yes so is Checkpoint. But anyone who compares Checkpoint to a Linux Free solution...well I would like to see a comparison of that. The Checkpoint firewall is a complete solution, with plugins to your security needs, and yes you ahve to pay extra cash to get it all to interact.
The linux solution is hodge podge and not even close to being remotely the same in either quality, or type of solution.
This would be like comparing MS Exchange to Sendmail. Yes, they both send emails. One is very expensive and has some nice options. The other sends mail well and some think its a better solution. The point being that with Exchange you are not paying for just an email server. It has lots of bells and whistles (dont blame exchange for viruses...Outlook yes, exchange no)
Same with Checkpoint! You are not just paying for a firewall.
So you are going to buy a expensive Nokia IP330 and install linux on it. Very amuzing....
There is more to IPSO, the net OS that runs on the Nokia 330, than just a hardened freeBSD. The networking protocols are coded deep into the kernel, and have been highly optimized. To run a vanilla Linux on the box means that net routing will just become another application to the OS, along with the corresponding hit to performance.
On the Nokia series, you pay a premium for A) Nokia's OS (NetBSD-based, I believe, which has VRRP for failover), B) it's interoperability w/programs like CheckPoint and ISS, and C) being able to rack it.
WAY too much of a premium, in my opinion. When the sales guys at the VAR I was at tried to push them on all our customers, I quietly directed them all to PIXen or OpenBSD.
seeing some other posts ...
... i work tech for a dept. the nokias belong to the uni, so i don't work on 'em), mostly 330s and 440s.
... it's (ipso/fw-1) a common platform in that niche, so it'd be much easier to find someone else that knows how to manage them, and, they have nokia to have fix problems.
we have a number of nokia's where i work (it's a university
granted, they are based on older hw (p2-450s, early p3s, etc). however, what you're paying for is CYA and management. if it breaks, you call nokia or whomever is responsible for providing support for it.
IPSO does one thing, *very* well. personally, i'm of the opinion of a decently spec'd out box running obsd w/pf, but only because i manage the box. some may like linux with iptables or whatever.
suppose you go the obsd/linux route on an off-the-shelf i386 machine. 1. you buy the machine. 2. you have to pay someone to manage it. rough guesstimation, but i see it a *lot* cheaper to buy a few nokia boxes and pay the fw-1 license fees. my dept is already incurring my salary, so we decided to get an i386 box (dell pe1650), two 4 port ethernet cards, and get on with it. it works great. if that thing breaks though, it's my ass. plus, if i leave, someone will need to know how to manage it. the uni where i work going with nokias
vodka, straight up, thank you!
Some thoughts I had when reading the article:
;-) It might be a good idea to delete the compiler after everything has been configured, or even better, don't install it and build any necessary packages on another server, then transfer the binaries to the firewall.
:-D
> Once the new partition table is saved there is no going back; both IPSO and Check Point FW-1 are gone.
Of course, if I were the one doing the installation I'd backup the original drive contents so I could always go back to original configuration (in case of screw up, or if I wanted to sell the unit on e-bay, etc.) It's only 8 Gb...
> When it comes time to install the various packages, select only Network Support and then go into the Select Individual Packages section and add GCC, autoconf and ncurses.
GCC on a firewall box?! Sounds like a new tool of terror for the scrip7 kiddies.
Nice article though. Nothing like putting the screws to those closed source, code hoarding, proprietary software vendors.
I track known Slashdot scumbags on my foes list!
I've thought about entering the appliance market too, but dealing with Cisco and similar types would be too hard. Still, the OS and network components are already taken of. It' sthe inetrface that needs work on.
My idea is to have a small box (running a via cpu) and have 3 nics in it. Lets call then eth0, eth1, and eth2. Eth0 and Eth1 would be a frame and packet discriminatory firewall capible of maintaining quotas. The quotas would be set up in user/group/all settings which would bind MAC or IP for quota setting.
Whatever passes through Eth0 or 1 is totally transparent (eg: transparent bridge). Eth2 would be your maintenance/interface. Https and ssh would be available for configs.
All the hardware and most of the software is there. It's just the glue work that needs to be done.
Ive installed probably over a hundred of Nokias in the field, so ive seen a lot with these machines...
;)
:)
/boot patition on a Linux box - its does not contain BIOS stuff...
In terms of support, everyone here is right - stick with IPSO so you dont void your warranty! Nokia IPSO is a great os for Check Point, and supports all the features Check Point supports (except the Reporting Module server - its Wind0ze only - well until NG FP4...
I have a few customers that have installed Secure Platform (customized, hardended RedHat 7.2 with a shell to ease administration - in NG FP4 contains a web gui similar to their SOHO Home products) All of these customers have expired hardware contracts so its no big deal to them. The IP330 and IP440 are quite out-dated now... Netfilter does not need much power though
I agree CheckPoint is a little pricy, but they have a feature set that nothing else touches.. yet... Cool stuff, like single-sign on transparent authentication with user logging, and centralized logging with a decent gui with reporting features. (all for a price...)
My only beef with the product is NO LINUX GUI! aarrgg... At least i can run Windows in a VM on Linux and OSX... (well, i also dont like the fact that it is closed source, but i cant do much about that...)
As for the Boot Manager, you can safely wipe that out on the IP330 if your going to Linux... Its similar to the
Wouldnt it be nice if there was a decent, cross-platform gui for distributing Netfilter rulebases to multiple Linux firewalls with a centralized logging database and a nice PHP/MySQL frontend for reporting...
Ralph Bonnell - CISSP, LPIC-2, CCSI, CCSE+, CCNA, RSA/CSE, CSFE, MCSE 2000
Cybie! aka Ralph Bonnell
having used checkpoint and ccse and ccsa courses I can say that it is a very good firewall but why would anyone want to rip out checkpoint and ipso and install linux? if you want a linux (or for my preference, freebsd) firewall then buy a 1u box and a qfe ffs. why trash a perfectly good nokia box? checkpoint is a damn good firewall even if you don't keep getting updates to the latest and greatest.
dave
We recently replaced the Nokia/Checkpoint boxen with PIX firewalls. I don't care to get into a PIX vs Checkpoint war, but lets just say it saved us TONS of $$$$ on a yearly basis.
/dev/hda for the /boot partition works like a charm.
Having seven of these IP650's sitting on a shelf, I had to wonder... what can I use them for??? Then it hit me... I need RMON type probe capabilities in my call centers around the country, and with the four port NIC's installed, these might make good candidates.
I pull the compact flash card from the 650, put it in my reader on my RH8 desktop, dd bootnet.img to it, put it back in the IP650, and boot it. Once it boots, a simple FTP load, using the compact flash card at
I've got squideral, NTOP, ethereal, and a couple of in house scripts running on each of them now collecting traffic stats, doing WCCP transparent caching, and allowing me to do remote sniffs of the call centers.
Sig??? I don't need no stinkin Sig!