Solved: Need Suggestion On Best Practice Solution

pauzi123@ · ‎02-21-2017

Hello,

Im currently in midst of optimizing site network that have more than 4100 users (currently). I would like know whether is it better to put:

Firewall in-front of router OR
Router in-front of firewall

My Firewall is ASA 5508-X (FirePower)

My Router is Cisco 2911-HSEC+/K9

Currently the router is handling only NAT-ing. The memory utilization is 79%

I attached current overall drawing for the site.

Leonardo Gama · ‎02-21-2017

Hi,

Considering your current topology and the fact that your ASA has far more horsepower than 2911, I would remove the 2911 from the topology (less point of failure) and let all routing and NAT with the firewalls, logically if you do not need any fancy feature from ISR routers.

Moreover I would insert a redundant 3850 switch with the second ASA.

Cheers.

View solution in original post

marce1000 · ‎02-21-2017

- Your keyword 'in-front of' is undefined because it can be explained in 2 ways; it's better to have the router at the real edge, and only let it handle routing; you should handle NAT on the firewall to take advantage of using firewalling properties/actions when doing NAT.

M.

-- ' 'Good body every evening' ' this sentence was once spotted on a logo at the entrance of a Weight Watchers Club !

pauzi123@ · ‎02-21-2017

Thank you for the information. What i mean by in front is, is better to put firewall or router first?

My current setup is firewall first having public IP, the router is connected at the firewall.

marce1000 · ‎02-21-2017

- Check the remarks from Leonardo

M.

-- ' 'Good body every evening' ' this sentence was once spotted on a logo at the entrance of a Weight Watchers Club !

Leonardo Gama · ‎02-21-2017

Hi,

Considering your current topology and the fact that your ASA has far more horsepower than 2911, I would remove the 2911 from the topology (less point of failure) and let all routing and NAT with the firewalls, logically if you do not need any fancy feature from ISR routers.

Moreover I would insert a redundant 3850 switch with the second ASA.

Cheers.