topic Re: Doubt - ASA and Firepower as Gateway in Network Security

Doubt - ASA and Firepower as Gateway

crusier2015 — Fri, 21 Feb 2020 15:55:52 GMT

Hi Friends,

I will implement the follow topology, I have the follow doubts, can you help me?

1-) What model of ASA do you recommend to running firepower , with URL filter and Antimalware to Internet access, and IPS and Antimalware beetween all subnets to protect communication beetween these subnets? I need security and perfomance(throughput).

2-) Do you recommend any change on this topology?

Re: Doubt - ASA and Firepower as Gateway

Francesco Molino — Fri, 29 Jun 2018 03:51:22 GMT

Hi

Can you detail what are your requirements in terms of throughput?
What's your wan bandwidth?
How many users will go through this asa/ftd?
Do you need vpn? If yes how many remote users?

For the design:
- will you have done layer 3 at the core level?
- is your goal to filter all communications between all ftd zones?

Re: Doubt - ASA and Firepower as Gateway

crusier2015 — Sat, 30 Jun 2018 13:39:06 GMT

Hi Francesco

Follow answers, tks !!

Can you detail what are your requirements in terms of throughput?

The custommer will access internet over this ASA, im afraid if i enable antimalware and IPS beetween interfaces , decrease internet access and server access, for example file server.

What's your wan bandwidth?

Two Internet Links of 100 Mb, one active another as backup.

How many users will go through this asa/ftd?

Around 300 users

Do you need vpn? If yes how many remote users?

We need around 50 connections anyconnect simulaneous

For the design:
- will you have done layer 3 at the core level?

I have a layer, but i want ASA as default gateway of these 13 subnets, to security.

- is your goal to filter all communications between all ftd zones?

I will block communication between these 13 subnets, these subnets will only access some ports of server subnet, for example file server.

Re: Doubt - ASA and Firepower as Gateway

Francesco Molino — Sat, 30 Jun 2018 17:02:01 GMT

Ok, then yes you can use ASA as default gateway and when activating NGFW features, for sure your throughput will be decreased.

Don't know the exact asa/ftd model, but you can check on this link to see the throughput and nb of sessions, nb of VPN users allowed simultaneously:
https://apps.cisco.com/ccw/cpc/guest/content/ucsSeriesDetails/series_asa5500