Pix vs. Linux Firewall Vulnerability

What sort of Linux Firewall do you wish to compare PIX with ?

A basic Linux Box running IPTABLES ?

To an install of Check Point Firewall 1 NG on Linux?

Basically I?m considering a Red Hat Linux
Firewall which run on IPTABLES as a net filter.

I have no data to support any real recommendation either way, but I can tell you this.

IPTABLES has had known serious vulnerabilites and if you checkout Cisco's site you will find only one or two ever since the started with PIX

At home I use IPTABLES and also have configured it for a few friends. At work I do nothing but PIX.

I have experience in both. What I have learned is to taylor the needs based on the skillset that is going to maintain it. Both can be a handle to config but IPTABLES under Linux can be a breeze if you use Webmin to do the setup. The developer of Webmin has a great book out on setting it up
http://www.webmin.com

As far as a PIX, Well if you have ever opened one of the larger PIX series they are basically a PC without the harddrive. All packet checking is done in RAM which is faster, but consider this...the faster PIX is a PIII 733MHZ processor where Redhat can run on something much faster. As far as throughput I have seen very little difference in the both

Being a CCNP I am more towards PIX because of the lack of moving parts plus the ability to handle 64000+ connections per second. And not to mention reliability, PIX's just normally do not die

Now comes cost. A PIX 506 series will run you around a grand (US) and only does 10mb full and no failover, The larger the PIX the more it costs, of course, BUT you now get failover abilities which you do not get with Redhat and IPtables unless you use Redhat Adavnced server at two grand per server

IPTABLES will be cheaper to impliment at first, but in any case you need to be familiar with the specific terms used on each platform. The end result in both is the same

BTW...With the new versions of IPTABLES you now have stateful packet filtering as in a PIX