What are the benefits and risks associated with consolidating many functions on a single device?
- Cal, Seattle, WA

The docs consult and deliver their opinion:

Dave Roberts of Inkra Networks says:

This question deals with one of the biggest problems IT managers are faced with today: complexity. With networks that often include hundreds or thousands of disparate appliances, each requiring its own management console, simply managing today's data center can be a nightmare. Hence the recent uptake of consolidated appliances, which offer multiple services all from one device. Why deploy five separate appliances if one box can meet all five of those needs?

This leads us into the benefits of consolidated devices. There are many devices on the market today that consolidate functions such as firewalls, VPNs, intrusion prevention or detection services (IPS/IDS), and other services into one appliance. This reduces the cost of purchasing multiple appliances (CAPEX) as well as the cost of configuring and managing these multiple appliances (OPEX). Ten years ago it was common practice to just add another one-box/one-function appliance into the network whenever more services were needed, which has resulted in the extraordinarily complex networks that IT managers are faced with managing today. Drastically reduced IT budgets and the need to reduce overall complexity have created the perfect environment for consolidated devices.

Besides reduced cost and simplified management, consolidated devices also offer the benefit of scalability, albeit limited.  If you are currently in the market for a new firewall but know that six months down the road you are also going to need VPNs, then purchasing a consolidated device that includes both would be beneficial. This would enable you to "turn up" the VPN service when you were ready to make that upgrade, without having to make another trip to the data center to re-cable and configure a new appliance. The limitations, however, are that you can only "turn up" a limited amount of services before needing to purchase additional consolidated appliances.

While consolidated devices definitely have their benefits, there are inherent risks involved as well. One risk to consider when consolidating several services into one appliance is the introduction of a single point of failure in your network. Say you are using a consolidated device for firewalls, VPNs, and intrusion prevention and the device fails. You would immediately lose all connectivity. Depending on how separate appliances were deployed, you might have been able to escape with just a partial failure if the services were separate. In the worst case, however, traffic would still have to flow through the failed appliance and you would be no worse off. In order to avoid this, it is often best to deploy appliances, whether consolidated or not, in pairs to provide a backup in case of device failure.