topic Routed mode is my preferred in Network Security

dc-firewall

k.adath2015 — Tue, 12 Mar 2019 08:47:09 GMT

Hi,

vpc is running in datacenter ( its not really double sided or single sided ) . Need to put dc firewall ( asa with source fire )

What is the best practices . L3 or L2

Thanks

Can you be a lot more

Philip D'Ath — Tue, 17 Jan 2017 03:37:48 GMT

Can you be a lot more specific.

Hi,

k.adath2015 — Tue, 17 Jan 2017 19:54:50 GMT

Hi,

Sorry for the inconvenience , I have similar toplogy (attached ) in my data center .

All the servers in the dc must be protected . from the agg switch there is l3 connecvity to the core switch . (core switch not shown in the picture )

server subnets are 192.168.15.0/24 16.0/24...20.0/24

vlan interfaces are configured on the agg switches and hsrp is running .

Now want to protect the serevers behind the dc .

So where should be the firewall placed and routed mode or transparent mode is better

Thanks

Routed mode is my preferred

nspasov — Wed, 18 Jan 2017 00:15:57 GMT

Routed mode is my preferred deployment but it requires more network interruption. Transparent mode on the other hand is much easier to be deployed in an existing environment. Thus, it really boils down to preference and design requirements.

I would highly recommend that you check Cisco's Validated Design below. There is a lot of info that might not apply to your environment or setup but it is still a good document to read and reference.

http://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise/design-zone-security/sdc-dg.pdf

I hope this helps!

Thank you for rating helpful posts!

Hi,

k.adath2015 — Wed, 18 Jan 2017 03:41:28 GMT

Hi,

Choosing routed mode ,what was your benefit

Thanks

1. There are several features

nspasov — Wed, 18 Jan 2017 18:30:39 GMT

1. There are several features that are not supported when running the ASA in transparent mode

2. Troubleshooting is easier and less convoluted when running in routed mode

3. In routed mode the ASA is a L3 hop on your network. This allows you to run routing protocols, policy-based routing, etc.

4. For more information about the differences and features for each mode you should reference the configuration guide:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/general/asa-96-general-config/intro-fw.html

I hope this helps!

Thank you for rating helpful posts!