Hello!
I'm working with a small business to upgrade their current networking equipment. I'm defintely interested in solutions Cisco has as they are known to be very reliable, but also very configurable, both important. One of the goals is to replace the networking equipment with devices that support IPv6. The current Zyxel firewall in place does not support IPv6, so that must go. Another goal is to implent a more relaible VPN solution. VPN is currently handled by the Windows server on the network. This solution has worked, but idealy I'd like to have a peice of hardware handleing VPN connections.
I will post a link below to a rough map of the network setup. Some things have changed but the overall config is the same.
The current firewall is in transparent "bridge" mode because the business uses entirely public IP space for clients, so it doesn't not handle routing.
If a Cisco router with firewall built in would be better than a standalone Cisco firewall, thats fine, just keep in mind that on the LAN side there would still be public IPs in use, not NAT so the router must be able to handle that. (Not sure a router would provide any benefit over a firewall)
VLANs would also be a nice feature. If you look at the diagram at the link below, you will see the public WiFi router is not behind the firewall. The current firewall doesn't support VLANs so the only way to keep the public WiFi from having access to the internal network is to have it before the firewall. My understanding is if we used a device that supported VLANs the public WiFi could be behind the firewall, but could be separated from the internal network?
Lastly with VPN support, just need to make sure that whatever device we use would be able to handle distrubutng public IPs for VPN clients. As you can see in the diagram, the current VPN range is 108.x.x.110-119.
I appreciate your consideraton and am excited for your recomendations!
http://www.gliffy.com/publish/3236634/
One final note, I'm sure some of you will want to recommend using NAT for the internal network. For now I'd like to just leave the numbering as is and purchase a device or devices that support the use of public IPs on the network.
