andrew

many thanks for your reply - greatly appreciated

i have the asa (5540) on the outside with a pretty simple rule base but the internal firewall is a bigger box which will host approx 8 - 10 dmz'z including an SSL VPN

my thoughts are that the bigger internal box provides better logging but then i'd lose visibilty of traffic on the outer firewall

thanks again

Hi,

If you are planning to do the NAT on the internal ASA FW box then you need to have two public IP pools :

- one between ASA1 outside and Inernet router

- other between ASA2 outside and ASA1 inside

<>---<>---<>---<>

Generally what we do is configure the ASA1 box in this scenario in Transparent mode (L2), which does the filtering for the permitted traffic at the 1st level of perimeter.

And the NAT, VPN and DMZ are configured on the ASA2 box. This config only requires one public IP pool.

OK - that makes sense,

In this situation, as stated before, have the Big firewall facing the internet and the ASA in a DMZ. This allows you to control the flow of traffic with a higher degree. You could if you wanted to also use the Big firewall in a dule layer topology with the ASA for l2l & remote SSL VPN's.

As the big firewall has all the logging power - you can log Everything. For the ASA you have have a physical interface or VLAN interface for the outside of the ASA. And a physical or VLAN interface for the inside - you can control what comes into the ASA, and of course what comes out of it onto the internal network.

Or you can keep your setup as you suggest - you should not have to loose the logs from the ASA, just configure the large firewall to allow the syslogs thru to your internal syslog server?

HTH.

patrick and all those who read and replied

many thanks for your views

i've a few more thoughts and things to go over so again, many thanks