ASA Firewall Placement

c.fuller — Mon, 11 Mar 2019 21:19:43 GMT

I am trying to determine whether or not it makes sense to add a distribution set of switches as part of a ASA firewall design effort or to just bring the ASA's directly into the existing collapsed core/dist pair.

Basically, we have a site that has a collapsed core/distribution using a pair of 6500s. All access switches are dual homed to this core/dist pair.

We need to implement a redundant ASA solution for a vendor application at this site. On the vendor's side there will be a 3750 stack with one uplink going to ASA 1 and the other uplink going to ASA 2. Right now we are considering a pair of 3560's on the other side of the ASA's which would then connect L3 into the core/dist pair of 6500s. Between the internal 3750 stack and the pair of 3560's will be L3 PTP links. The ASA's will be in transparent mode.

I am wondering what are all the pros/cons of bringing the ASA's directly into the collapsed core/distribution? What is the benefit of adding another L3 hop to the design with the 3560s? If we have a L3 between the vendor's router the core/dist with the ASA's in the middle shouldn't that sufficiently satisfy the security concerns? Below are quick sketches of the two topologies.

Option 1:

--------------ASA1------------3560 dist--------------6500 core/dist-----------

LAN-------3750 stack | | Core

--------------ASA2------------3560 dist--------------6500 core/dist-----------

Option 2:

----------------ASA1---------------------6500 core/dist---------------------

LAN--------3750 stack | Core

----------------ASA2---------------------6500 core/dist---------------------

Any thoughts are appreciated.

Chuck

ASA Firewall Placement

c.fuller — Thu, 01 Sep 2011 17:45:40 GMT

Thinking about this more I think using Option2: with the ASA's in routed-mode would be a good solution. This will provide a L3 boundary between the vendor managed 3750 stack and the core/distribution with less hardware.

Chuck

topic ASA Firewall Placement in Network Security

ASA Firewall Placement

ASA Firewall Placement