topic Re: HQ and 4 Branches Firewall devices (VPN Connection) topology! in Network Security

HQ and 4 Branches Firewall devices (VPN Connection) topology!

Imma — Fri, 21 Feb 2020 17:29:41 GMT

Hello all,

I have to create a topology for VPN connection of the branches with the HQ, to access the servers. My question is: Which FW series (ASA, FRP...) to employ at the HQ and which one to the branches. Branches are small offices up to 10 employees.

Specification are as below:

Dual WAN ports with automatic fallback
IPSec VPN capability (up to 8 simultaneous connections for HQ)
VPN licenses (8 connections for HQ, 1 connection for other sites)
DHCP Server and Relay DHCP (DHCP relay over VPN)
DNS Service

Can anyone advice please?

Thank you,

Kind Regards,

Dena

Re: HQ and 4 Branches Firewall devices (VPN Connection) topology!

Karsten Iwen — Fri, 13 Sep 2019 12:19:36 GMT

If you really need to have DNS-services, there is only the IOS router in the cisco portfolio.

If you can live without, my preferences would be:

Cisco Meraki MX on HQ and the branches. These are most easily to setup and the VPN will work instantly.
Cisco ASAs on all sites with manually configured route-based VPN. This will give you also a good firewall for the branches.
IOS routers on all sites. Maximum flexibility but the firewall implementation is most complex compared to the other solutions.
Personally I don't like Firepower Thread Defense as you always need two IPs reachable from your headquarter. One for the Data-Plane and one for management. That can get quite tricky to setup and is a more advanced topic.

Re: HQ and 4 Branches Firewall devices (VPN Connection) topology!

Imma — Fri, 13 Sep 2019 13:08:59 GMT

Thank you for your help Karsten,

I am not sure if I understood well. If I choose one of four solutions proposed by you, then I have to build a DNS server. Right?

Or should I use ISP /open DNS?

Re: HQ and 4 Branches Firewall devices (VPN Connection) topology!

Karsten Iwen — Fri, 13 Sep 2019 13:24:00 GMT

It just means that you can't point your clients to that device to resolve names. Most likely you have a DNS-server inside of your HQ and you can point your clients to that one. With that all clients can resolve your internal resources. Or you could install DNS-servers in each branch. But that could be overkill for 10 employees.

Re: HQ and 4 Branches Firewall devices (VPN Connection) topology!

Imma — Fri, 13 Sep 2019 13:27:38 GMT

Thank you Karsten. Very helpful indeed.

Kind Regards,

Dena