topic Re: Cisco ASA 5508-X network topology placement in Network Security

Cisco ASA network topology

dereksters — Fri, 21 Feb 2020 14:48:47 GMT

Trying to figure out the best placement for a Cisco ASA 5508-X in our network that already has a Cisco 2900 router in place for the edge WAN and some internal Cisco Catalyst core and distro switches.

In a dilemma whether we should place the ASA in front of the router or behind it? There has been no documented best practice so based on all your experience which works well and is best practice in your environment?

I'm an advocate in leveraging each appliance's or device's key strengths so was thinking of letting the router do what it does best, which is routing and GRE tunnels, and leave the ACLs/filtering/IDS/IPS/IPsec tunneling/etc. of course in the ASA. But ideally where do we NAT (router vs ASA) on either of the options below?...

Option 1. (internal) -- (Cisco ASA 5508-X) -- (Cisco Router 2900) -- [internet]

Option 2. (internal) -- (Cisco Router 2900) -- (Cisco ASA 5508-X) -- [internet]

Thanks and would appreciate feedback. Would also appreciate sample configurations to supplement if any.

Re: Cisco ASA 5508-X network topology placement

Karsten Iwen — Wed, 22 Nov 2017 08:41:03 GMT

I would consider two more options:

Place both outside interfaces of the router and ASA onto the internet and the router inside interface in an ASA-DMZ
Place the router on a stick in an ASA-DMZ

Re: Cisco ASA 5508-X network topology placement

dereksters — Wed, 22 Nov 2017 09:14:59 GMT

Hi Karsten, do you mind putting that out in a diagram like what I did with my post? Also, any reason why I'd want the router and ASA outside interfaces facing out the WAN both? Thing is if I do that though I will have to put a layer 2 switch before them to split out the WAN connection. Thanks.