DEV Community: Sistro Networks

Your Storage Network Is Part of Your Storage System

Sistro Networks — Sun, 13 Sep 2026 05:11:28 +0000

In a traditional SAN architecture, storage networking is obviously critical.

In a hyperconverged Ceph cluster, engineers sometimes forget the same rule.

Imagine three Proxmox nodes.

Each has multiple fast NVMe drives.

The disks can generate several gigabytes per second.

Now connect the nodes using a slow or oversubscribed network.

The storage system is no longer limited by NVMe.

It is limited by Ethernet.

Ceph traffic includes more than guest I/O:

replication
recovery
backfill
rebalancing
client I/O

A node failure makes this even more interesting.

At exactly the moment VMs may need to restart elsewhere, Ceph may also be moving large amounts of data.

This is why storage traffic and latency-sensitive cluster communication such as Corosync should be carefully separated.

The broader engineering rule is simple:

Distributed storage performance is bounded by the network connecting the storage nodes.

And redundancy is not backup.

I used Proxmox + Ceph as a practical architecture example here:

https://sistro.net/proxmox-ceph-cuando-conviene-hci

Tags: proxmox ceph virtualization infrastructure

TLS Inspection Turns Your Firewall Into a PKI Problem

Sistro Networks — Fri, 11 Sep 2026 23:29:33 +0000

You enable TLS inspection.

Immediately a few applications stop working.

Why?

Because the firewall isn't simply reading encrypted packets.

It becomes part of the TLS trust path.

A simplified flow:

Client
→ Security Gateway
→ Decrypt
→ Security Inspection
→ Re-encrypt
→ Server

The client now needs to trust the certificate authority used by the gateway.

That creates several engineering problems:

CA distribution
endpoint management
certificate pinning
application compatibility
bypass policy
performance
privacy

Managed corporate laptops are relatively straightforward.

Unmanaged BYOD isn't.

A useful deployment strategy is:

Deploy the inspection CA
Select a small pilot group
Enable inspection
Identify application failures
Create narrow exclusions
Measure gateway load
Expand gradually

SonicWall DPI-SSL is a useful real-world example because it supports inspection policies and granular exclusions.

The lesson applies beyond SonicWall:

TLS inspection is part firewall, part PKI, part endpoint management.

Practical example:

https://sistro.net/sonicwall-dpi-ssl-inspeccion-https

Tags: cybersecurity tls networking security

A 39 Gbps Firewall May Not Be a 39 Gbps Security Appliance

Sistro Networks — Mon, 07 Sep 2026 16:10:45 +0000

Firewall throughput numbers can be misleading when used without context.

A next-generation firewall may perform multiple operations on every flow:

Firewall
→ IPS
→ Application Control
→ Malware Inspection
→ Logging
→ TLS Inspection

Each layer adds work.

Fortinet's current product matrix gives a useful example.

The FortiGate 120G is rated at up to 39 Gbps raw firewall throughput.

Its published NGFW throughput is 3.1 Gbps.

Threat Protection is 2.8 Gbps.

SSL Inspection is 3 Gbps.

Nothing is wrong with the appliance.

The tests simply represent different workloads.

This leads to a useful rule:

Never size security infrastructure using the largest number on the datasheet.

Instead ask:

Which security profiles will be enabled?
How much encrypted traffic exists?
How much VPN traffic?
What WAN speed?
How many concurrent sessions?
How much growth?

The same principle applies regardless of vendor.

I used FortiGate 70G, 90G and 120G as a practical comparison:

https://sistro.net/fortigate-70g-vs-90g-vs-120g

Tags: networking cybersecurity security infrastructure

Two Firewalls Can Have the Same Throughput and Still Be Very Different

Sistro Networks — Sat, 05 Sep 2026 01:40:16 +0000

Firewall sizing often starts with one metric:

Throughput

But consider two appliances with the same 1 Gbps firewall rating.

Appliance A:

50,000 concurrent sessions
75 site-to-site VPN tunnels
200 recommended devices

Appliance B:

125,000 concurrent sessions
200 site-to-site VPN tunnels
250 recommended devices

Same firewall throughput.

Different scale.

This is exactly what makes the Cisco Meraki MX75 vs MX85 comparison interesting.

It demonstrates that firewall sizing should consider:

flows
VPN tunnels
device population
security services
interface requirements
growth
topology

There is another complication.

Advanced security features change effective throughput.

Cisco currently rates both MX75 and MX85 at lower NGFW throughput when prevention features are enabled than their raw firewall figure.

So the useful engineering question is not:

“How fast is the firewall?”

It is:

“How does it perform with my actual traffic and feature set?”

Practical comparison:

https://sistro.net/cisco-meraki-mx75-vs-mx85

Tags: networking cybersecurity sdwan infrastructure

Unknown Malware Is a Behavioral Analysis Problem

Sistro Networks — Thu, 03 Sep 2026 00:14:05 +0000

Signature-based detection is extremely useful.

But it has a fundamental limitation:

The indicator needs to be known.

Consider a new malicious document.

Its hash is unknown.

No existing signature matches it.

Static inspection looks mostly normal.

Then it runs.

It creates a process.

The process injects code into memory.

It contacts an external host.

It downloads another payload.

Now we have something more useful than a hash:

behavior.

This is why sandboxing remains an important security architecture pattern.

A simplified flow looks like:

Unknown File
→ Isolated Analysis
→ Static + Dynamic Analysis
→ Memory Inspection
→ Verdict

SonicWall Capture ATP combines sandboxing with RTDMI, its Real-Time Deep Memory Inspection technology.

It can also use a pattern called Block Until Verdict where selected unknown files are held before delivery.

The broader principle is vendor-neutral:

Known threats can often be identified by indicators. Unknown threats frequently require behavior.

And neither approach replaces endpoint security, backups or segmentation.

Practical SonicWall example:

https://sistro.net/sonicwall-capture-atp-rtdmi-ransomware-zero-day

TLS Inspection Is a Certificate Management Problem Too

Sistro Networks — Tue, 01 Sep 2026 13:17:23 +0000

Enabling TLS interception on a firewall looks simple.

The architecture is not.

In a deep inspection flow, the security appliance effectively sits between the client and destination:

Client
→ Firewall
→ TLS inspection
→ Destination

To avoid certificate errors, the client must trust the CA used by the firewall.

This immediately creates operational questions:

How will the CA be distributed?
Are the endpoints domain joined?
Is an MDM available?
What about BYOD?
What about mobile apps?
Which applications use certificate pinning?
How are exceptions documented?

There is also a performance problem.

Decrypting, inspecting and re-encrypting traffic requires CPU resources.

This means firewall sizing based only on raw L3/L4 throughput can be misleading.

The general rule:

TLS inspection is not just a security feature. It is an endpoint, PKI and capacity-planning project.

Practical FortiGate example:

https://sistro.net/fortigate-ssl-deep-inspection-cuando-conviene

A 3-Node Cluster Is Not Automatically Highly Available

Sistro Networks — Fri, 28 Aug 2026 14:06:13 +0000

Three-node virtualization clusters are common because they provide a useful quorum model.

But quorum solves only one part of availability.

Consider:

Node 1: 90% RAM
Node 2: 90% RAM
Node 3: 90% RAM

The cluster has quorum.

Then Node 1 fails.

Now the important question is not whether the cluster is quorate.

It is:

Where do Node 1's workloads run?

A useful HA design must account for:

Compute capacity

Can the surviving nodes absorb the protected workloads?

Network

Is cluster communication isolated from congestion?

Storage

Can another host access the VM disks?

Switching

Is there a single upstream switch?

Backup

Can deleted or corrupted data be recovered?

This is why N+1 capacity planning matters.

High availability is not a feature checkbox.

It is a resource and dependency model.

I used a three-node Proxmox architecture as a practical example here:

https://sistro.net/proxmox-cluster-3-nodos-ha-hardware

Proxmox Backup Server: Enterprise Backups for Virtualization, Business Continuity, and Ransomware Recovery

Sistro Networks — Tue, 25 Aug 2026 19:27:55 +0000

Business continuity is not only about keeping infrastructure running.

It is also about being able to recover when something fails.

Many organizations invest in virtualization, servers, storage, networking, and cybersecurity, but still operate with weak backup strategies.

Common problems include:

Backups that are never tested.
No clearly defined RPO or RTO.
Backup repositories inside the same compromised environment.
No encryption.
No retention policy.
No off-site copy.
No monitoring.
No documented restore process.

Proxmox Backup Server can become a key component in a Proxmox VE infrastructure strategy.

It provides tight integration with Proxmox VE, incremental backups, deduplication, encryption, integrity verification, and more efficient backup operations.

But the real value is not only installing a backup platform.

The real value is designing a complete recovery strategy that includes:

Virtualization.
Backup architecture.
Storage.
High availability.
Cybersecurity.
Monitoring.
Managed operations.
Restore testing.

A backup does not matter only because it exists.

It matters when it can be restored during a critical incident.

Read the full article:

https://salixing.com/proxmox-backup-server-respaldos-empresariales/

Related services:

Enterprise Virtualization with Proxmox:
https://salixing.com/virtualizacion-con-proxmox/

VMware to Proxmox Migration:
https://salixing.com/migracion-vmware-a-proxmox/

Managed Infrastructure Services:
https://salixing.com/servicios-administrados/

NAS Storage with TrueNAS:
https://salixing.com/almacenamiento-nas-con-truenas/

High Availability Is Not Just Two Firewalls

Sistro Networks — Mon, 24 Aug 2026 20:37:21 +0000

A common infrastructure mistake is assuming that deploying two firewalls automatically creates high availability.

It doesn't.

Consider:

ISP
↓
Firewall A / Firewall B
↓
Single Core Switch
↓
Servers

The firewall layer is redundant.

The network is not.

The core switch is now the single point of failure.

A proper HA assessment should identify failure domains across:

WAN connectivity
firewalls
heartbeat links
switching
power
routing
applications
monitoring

FortiGate FGCP is a good practical example.

It supports HA clustering and synchronization between members, while session pickup can help preserve TCP sessions after failover.

But the broader engineering principle is vendor-neutral:

Availability is an end-to-end property.

Do not ask only whether a component is redundant.

Ask:

What happens to the service when this component fails?

Spanish FortiGate HA architecture example:

https://sistro.net/fortigate-high-availability-ha-cuando-conviene

Firewall TCO: Why Hardware Price Is the Wrong Comparison

Sistro Networks — Sat, 22 Aug 2026 15:25:06 +0000

Two firewall quotes can look very different on day one.

But the real comparison begins after deployment.

A useful five-year model should include:

hardware
security subscriptions
renewals
support
engineering time
monitoring
upgrades
replacement caused by growth

For example:

TCO = Hardware + Licensing + Support + Operations + Growth

This also exposes an important distinction:

Licensing and support are not the same thing.

A platform may not require a recurring license for its core firewall functionality and still require proper maintenance, monitoring and technical support.

Conversely, a subscription-based firewall may deliver cloud security services that fully justify the recurring cost.

There is no universally better model.

The objective is to compare equivalent capabilities over the same three or five-year horizon.

Business-side Spanish analysis:

https://sistro.net/firewall-sin-licencia-vs-suscripcion-costo-total

Tags: cybersecurity, networking, infrastructure, security

Firewall Sizing: Why User Count Is a Bad Metric

Sistro Networks — Thu, 20 Aug 2026 23:22:25 +0000

“How many users does this firewall support?”

It sounds like a reasonable sizing question.

Unfortunately, it tells us very little about the actual workload.

Consider two companies with 100 users.

Company A:

SaaS applications
light browsing
one office
limited VPN

Company B:

multiple branches
site-to-site VPNs
SSL inspection
public servers
VoIP
cameras
hundreds of connected devices

Same number of employees.

Completely different firewall workload.

Better sizing inputs include:

inspected throughput
concurrent sessions
new connections per second
VPN traffic
security services enabled
WAN bandwidth
branch topology
growth
availability requirements

This is also why moving between firewall product families should be based on architecture, not a simple user-count table.

I used SonicWall TZ vs NSa as a practical example here:

https://sistro.net/sonicwall-tz-vs-nsa-que-firewall-elegir

Network Security Is More Than the Firewall

Sistro Networks — Mon, 17 Aug 2026 16:47:46 +0000

A firewall can control north-south traffic extremely well while the internal network remains poorly segmented.

Consider a typical office containing:

corporate endpoints
guest devices
IP cameras
VoIP phones
wireless clients
IoT devices
servers

If all of these devices share broad Layer 2 access, the firewall alone cannot solve every lateral-movement problem.

A better architecture considers multiple layers.

Perimeter
NGFW, VPN, WAN and application policies.

Access Layer
VLANs, port policies, switching and device segmentation.

Wireless
Corporate SSIDs, guest networks, authentication and isolation.

Visibility
Understanding which device is connected, where it is connected and what it can access.

Fortinet Security Fabric is one example of an architecture that connects these layers through FortiGate, FortiSwitch, FortiAP and other components.

The important principle applies regardless of vendor:

Security architecture should extend from the WAN edge to the access layer.

Spanish business-side guide:

https://sistro.net/fortinet-security-fabric-fortigate-fortiswitch-fortiap

Tags: networking, cybersecurity, security, fortinet