Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Nat in router or firewall?

hi,

  could anyone confirm if doing the NAT in the router is better that doing it in a firewall?because someone told me this is the best practice from cisco.

My topology below:

CoreSwitch==>edge switch-->ASA-->Boarder router

Note: i have server in dmz configured in ASA and accessible thru internet.

thanks.

reymon

2 ACCEPTED SOLUTIONS

Accepted Solutions
Cisco Employee

Re: Nat in router or firewall?

I guess it really depends on what you will be using the NAT for, as there is a number of application inspection that ASA is more superior of.

For example:

You are NATing your FTP server, and ASA is configured to inspect FTP traffic so it will dynamically open a pin hole for the FTP data connection.

If you perform the same on the router, first of all, for tighter security, you would need to create access-list, and then either CBAC or ZBFW to inspect the traffic. Router main functionality is performing routing, with the above example, you have just added security feature on the router which is not very efficient since you already have ASA firewall.

Hope that helps.

Cisco Employee

Re: Nat in router or firewall?

configuring policy nat, dynamic nat, nat exemption, outside nat, destination nat, static 1-1, policy static all of these can be easily done on the ASA.

I would say do the nat on the ASA and let the router do what is is betst to do which is routing.

-KS

5 REPLIES
Cisco Employee

Re: Nat in router or firewall?

Don't see the difference configuring it on router or ASA. Most people configured NAT on their ASA.

New Member

Re: Nat in router or firewall?

Here is what they say:

Cisco Validated Design and best practices recommended dedicating only security features on the ASA. And they propose removing current NAT on the ASA and putting in on the router.

Cisco Employee

Re: Nat in router or firewall?

I guess it really depends on what you will be using the NAT for, as there is a number of application inspection that ASA is more superior of.

For example:

You are NATing your FTP server, and ASA is configured to inspect FTP traffic so it will dynamically open a pin hole for the FTP data connection.

If you perform the same on the router, first of all, for tighter security, you would need to create access-list, and then either CBAC or ZBFW to inspect the traffic. Router main functionality is performing routing, with the above example, you have just added security feature on the router which is not very efficient since you already have ASA firewall.

Hope that helps.

Cisco Employee

Re: Nat in router or firewall?

configuring policy nat, dynamic nat, nat exemption, outside nat, destination nat, static 1-1, policy static all of these can be easily done on the ASA.

I would say do the nat on the ASA and let the router do what is is betst to do which is routing.

-KS

New Member

Re: Nat in router or firewall?

I agree to both of you:) Thanks!

542
Views
0
Helpful
5
Replies