For Site-to-site IPSec VPN what is better option IOS (IOS-XE) router or ASA?

[amp512_nyph]

We are building a new VPN infrastructure for site-to-site IPSec VPN for about 200 vendor connections with IPSec throughput of about 300Mbps. We also need high availability so whatever we choose - routers or ASAs, would have to be setup with active/standby failover and all our vendors will receive a single IP address (via HSRP or ASA failover setup) for peering. What is a better option to satisfy these needs a pair of Cisco IOS-XE routers (4000 Series ISR - 4431) or a pair Cisco ASAs (5555-x)?

What are pros and cons of using routers versus ASAs for VPN termination?

Thanks.

[Philip D'Ath]

Hands down take the ISR 4431.  ASA is good for simple site to site VPNs.  ASA is excellent for user to site.  I often deploy routers for site to site VPNs, and an ASA beside it for user to site VPNs to get the best of both worlds.

Things you can only do on a router:

* VRFs (can be great when you have customers with overlapping address spaces)

* "Proper" PBR

* Sophisticated routing

* GRE over IPSec

* iWAN / FlexVPN / VTI's

* Complex NAT without tying yourself in knots.

* Dynamically assigned IP addresses for remote VTIs for low touch mass VPN configuration.

* You can do simultaneously active/standby for those you can only do simple VPNs via hsrp, and at the same time active/active for those who can support it.

Note on the routers you need both an HSEC licence and the performance licence to get increased crypto throughput.  And do yourself a favour, and get the AppX licence as well.

[amp512_nyph]

Philip,

Your comment on complex NATs can you give me an example? I always though firewalls in general so ASA included do a better job at NATs than routers.

Thanks.

[Philip D'Ath]

Complex NAT example: You have two customers with overlapping addresses spaces, so you please them into separate VRFs, and NAT them them back into your global VRF.

On an ASA you pretty much can't have multiple connections using the same address space.

On a router you can use route-maps to control NAT.  Route-maps are incredibly flexible and powerful, and if I thought long enough about it could probably come up with other unique things you can do on an ASA.

Really modern ASA's software have route-maps, but only for routing and PBR.