[link|http://www.openbsd.org/cgi-bin/man.cgi?query=pfsync&sektion=4&arch=&apropos=0&manpath=OpenBSD+3.8|http://www.openbsd.o...npath=OpenBSD+3.8]

Time to install OpenBSD on a pair of boxes - 10 minutes.
Time to setup a NATting firewall - 10 minutes.
Time to setup a pair of failover/failback NATting firewalls - 11 minutes.

Time for seemless failover to backup firewall, maintaining all active connections - 5 seconds.

Currently running in my office, "protecting" me from the rest of the company.

IF (and that is a big IF) we continue along this path, it will be part of a line-of-business segmentation of the network.

We'll probably end up getting a bunch of 3 Gbit port utility boxes to run it on.
[link|http://shopping.hacom.net/catalog/product_info.php?products_id=76|http://shopping.haco...hp?products_id=76]

I figure I'll need 8 boxes for 4 networks worth of isolation.

Right now I have 1 bridging OpenBSD box used to firewall a bunch of vendor equipment. The boxes used to crash about every 5 days. Vendor said it was our crappy network (their code was REALLY fragile). It has been in place for a month with no crashes.

The boss really like OpenBSD for security / utility boxes.

We have a new security guy starting in a couple of weeks. He might quash any non-Cisco solution. So I'll have to get not so attached to this.

On the other hand, I'm going to CISSP boot camp in the next month or so, which means I'll be "qualified" to argue with him.