Here is our Network Topology
INTERNET-->SProuter---->PIX515E---->2621XM-->LANandWANtoOtherSites
2621XM: Dual 10/100 router with a 4-port Ethernet Module (1 LAN, 1 WAN, 1 going to PIX to get to Internet, 3 Free Ports)
96MB Dram
All Branch Sites hit our router to get to the PIX to get to the Internet (8 Sites, about 800 Nodes)
I recently installed the PIX515E as our corporate firewall, the inbound filters are set there. Since I can't tamper with the SP's router, I am looking to filter outbound traffic at the 2621XM ethernet interface that is attached to the PIX (ACLs to block Morpheus, Kazaa, etc,). Along with that I would like to use NBAR to weed out some virus signitures before they even make it to our Web and Mail Servers or trip off our Snort IDS box. I have heard alot about the performance impact of running NBAR, but has anyone had any experience with this? Is it so great that it greatly hinders the router? Any input greatly appreciated.
