topic Re: Cisco ASA deployment on internal LAN in Network Security

Cisco ASA deployment on internal LAN

HAMID HUSSAIN — Fri, 21 Feb 2020 15:32:13 GMT

i have Created a design for data center security with having internal firewall, please help me out to configure this firewall as i am not good in security.

the design is consist of following,

2 Nexus N3K-C3524P-10GX switches for Server farm

2 4507 Switches

1 DC Firewall FPR2120-BUN

1 WS-C2960X-24PS-L Switch

Have the attach diagram for reference.

Re: Cisco ASA deployment on internal LAN

Florin Barhala — Tue, 20 Mar 2018 09:14:18 GMT

Hello,

Couple observations:

1. It seems you spent some money to provide redundancy still you have only one firewall? Are the stakeholders aware of the risk of running this one FW only?

2. How do you intend to connect the FW to both HSRP enabled core SWs? Since you have one firewall only I would link it to only one core SWs.

3. What's the role of 2960 SW?

4. What's behind the 2960 SW? Another firewall ? Is it just one FW or cluster?

5. What's the role required for the FPR2120 box? InterVlan routing? Internet access aka SNAT?

Re: Cisco ASA deployment on internal LAN

Dennis Mink — Tue, 20 Mar 2018 10:32:14 GMT

Have you thought about a DMZ? or do you not need one?

Re: Cisco ASA deployment on internal LAN

HAMID HUSSAIN — Tue, 20 Mar 2018 19:28:26 GMT

NO, in proposed design we do not need the DMZ

Re: Cisco ASA deployment on internal LAN

HAMID HUSSAIN — Tue, 20 Mar 2018 19:35:55 GMT

Q1, Can e connect a 2120 Firewall to both HSRP Enabled Switches?

Behind 2960 there is a single firewall wwhich is connecting to Router, the firewall is using for internet trafic using PAT and VPN connectivity.

FPR 2120 firewall is protecting Server farm which is connected with two N3K-C3524P-10GX Switches.

Re: Cisco ASA deployment on internal LAN

HAMID HUSSAIN — Wed, 21 Mar 2018 06:14:08 GMT

Please review, i have re deign the network.

Re: Cisco ASA deployment on internal LAN

Florin Barhala — Wed, 21 Mar 2018 14:06:43 GMT

I just reviewed your new design. It looks better if you ask me.

I think you can link the DC firewall to both 4500 SWs using a bridge group to bind two ASA interfaces. But then you will rely on STP which I wouldn't do unless this two wire requirement is very important for you.

Now let's address some old questions:
3. What's the role of 2960 SW?

4. What's behind the 2960 SW? Another firewall ? Is it just one FW or cluster?

5. What's the role required for the DC Firewall ? Internet access aka SNAT or just simulating a sort of DMZ?

Re: Cisco ASA deployment on internal LAN

HAMID HUSSAIN — Tue, 27 Mar 2018 06:17:23 GMT

Now let's address some old questions:
3. the role of 2960 switch is to connect Core switching and connectivity to Parameter firewall

4. there is only one firewall on edge of the network

5. the role of DC Firewall is provide web server proxy and Web server for the wan users