topic IPS design in Network Security

IPS design

chiangfong — Sun, 10 Mar 2019 11:29:48 GMT

I have 2 unit ASA 5520 with AIP-SSM-20 for front-end and 2 units ASA5520 with AIP_SSM-20 for back-end.I also have 2 units catalyst 6509. How should my design looks like.

Re: IPS design

rhermes — Tue, 10 Feb 2009 16:46:01 GMT

You need to provide much more detail on the goals your design is trying to achieve.

Are the asa pairs for reduntancy?

What do you mean front-end and back-end, to what?

What networks feed into and out of this hardware?

Re: IPS design

chiangfong — Wed, 11 Feb 2009 01:35:38 GMT

Yes. Pairs of ASA is for redundancy. Front end mean to internet edge.Back end means internal network.

Re: IPS design

rhermes — Wed, 11 Feb 2009 19:27:36 GMT

ASA pairs for redundancy makes sence, but I do not understand why you are using two sets of firewalls? what is between these two ASA pairs?

Re: IPS design

chiangfong — Thu, 12 Feb 2009 01:43:57 GMT

Between these two ASA pairs is a pair of catalyst 6509. The internal network is purely flat network. Do i need two pairs of ASA?

Thanks.

Re: IPS design

rhermes — Thu, 12 Feb 2009 17:18:11 GMT

It all depends on what you are trying to accomplish and what features you are using in each ASA. The outside ASA, as a firewall can host serveral inside networks (limited by the number of interfaces in the ASA) each netowrk can have a different firewall policy assigned. If that meets your firewall needs, then you might not require a second set of ASAs.

You have not provided enough network requirements detail to even make an guess of what you need.