IOS Firewall Router versus PIX Firewall applicance
Features:
- PIX and IOS FW (Router) are both stateful Firewall so there is no diffrence.
- IOS Firewall supports a full range of interfaces which the PIX does not, eg ADSL, Serial.... PIX supports Ethernet 10/100/1000.
- IOS Firewall has more Routing protocol support.
- IOS FW supports QOS which is currently not available for the PIX. Will come in version 7.0.
- The IOS Firewall is more a Edge Firewall to the Internet see in the SAFE Blueprint the design fundamentals.
http://www.cisco.com/go/safe
- Both have a minimal IDS fonctionality, have spoofing prevention and helps again SYN Floods ....
I think there are a lot of diffrent opionions arround about this topic.
In security perspective there is no big diffrence if both are configured correctly.
Definition in SAFE Blueprint is:
At many points in the network design process, an enterprise will need to choose between a network device with integrated functions and a specialized functional appliance. Integrated functioning is attractive because you can implement it on existing equipment, the features can interoperate with the rest of the device to provide a better functional solution, or the features can be deployed incrementally to facilitate increased bandwidth requirements. Appliances are often used when the depth of capability required is advanced or when performance needs require using specialized hardware (see Appendix D for information regarding integrated security blades for Layer 3 switches versus appliances). Decisions should be based on the capacity and capability of the appliance, not the integration advantage of the device. For example, sometimes you can choose an integrated higher-capacity router operating Cisco IOS® Software with the firewall feature, as opposed to a smaller Cisco IOS Software-based router with a separate firewall device. Throughout this architecture, both types of systems are used. Historically, most critical security functions have migrated toward dedicated appliances because of the performance requirements of large enterprise networks. Recently, however, integrated equipment has become much more attractive because of performance and capability enhancements. A security specialist now has more viable options when choosing between security appliances and integrated devices.
sincerely
Patrick
