topic Re: ASA firewall design practice in Network Security

ASA firewall design practice

rakesh4 — Fri, 21 Feb 2020 16:36:57 GMT

Hi,

I really need someones help with this I am a bit stumped.

I am configuring the one design latest .but i am struck in this design.let you tell me to how to configuring the ASA firewall ,router and switches to will get the internet and filtering of traffic in laptops.what configuration will make.

i am attached the my design diagram below

please give your outputs those ASA firewall ,Cisco router and Cisco switches.

Re: ASA firewall design practice

Abheesh Kumar — Fri, 28 Dec 2018 08:01:30 GMT

Hi,

My recommendation is to go with Router >> ASA >> Switch >> PC's.

Router will take care the routing features with ISP and ASA, ASA should take care the NAT and filtering of traffic towards your users.

Thanks,
Abheesh
PS: Please don't forget to rate and select as validated answer if this answered your question

Re: ASA firewall design practice

rakesh4 — Fri, 28 Dec 2018 08:47:04 GMT

In My organization we use TATA as a ISP.then
if i am use previously Router--Switch--PC's ,now we moved and previous configuration i am only configuring.but now we use ASA firewall to my Organization this is configured.
Router>>ASA>>Switch>>PC's .Between router interface and ASA interface how to configure and ASA interface and Switch what configuration is I am made.Here I am Using ASA As a Transparent or Routed mode.
Kindly tell me
Thanks,
Rakesh

Re: ASA firewall design practice

Karsten Iwen — Fri, 28 Dec 2018 09:09:57 GMT

You should tell us a little bit about your design goals. For me, the router between the ASA and the switches seem completely useless. If you want different subnets internally, do L3-switching on one of the switches. If you want filtering between the VLANs, then remove the router and configure the VLANs on the firewall. Or you can combine both approaches with some internal VLANs terminated on the L3-switch and some (like guest vlans) terminated on the firewall. And with a small setup like this, it's unlikely that you have to put a router between the firewall and the ISP.

Re: ASA firewall design practice

rakesh4 — Fri, 28 Dec 2018 09:40:01 GMT

Thanks Iwen,
Natting is also we used
My Actual intention is filter traffic in ASA firewall .This my new configuration actually i want to know what is the best configuration i am implemented here,we different Vlans here.
We Have 2 L3 3750 Cisco Switch ,5 2960 Cisco switches ,one 2911 router and one 5520 ASA firewall(9.x) we have also Wireless 2504 Cisco WLC
Kindly tell me how to configure

Re: ASA firewall design practice

Karsten Iwen — Fri, 28 Dec 2018 10:02:53 GMT

In that case I really would dump the router as it is not needed here. And I would replace the ASA as this device is EOL and operating an EOL security device puts your network at risk (and even worse, depending on the rights in your country, you could be legally responsible for that if something happens).

My setup would be the following:

ISP - ASA - L3 3750 - 5* 2960 and WLC

Re: ASA firewall design practice

rakesh4 — Fri, 28 Dec 2018 10:37:00 GMT

Thanks Iwen,
In ASA i am configure the NAT to Isp and then
In ASA---L3 3750,between these what i am configured and what configuration is made in ASA and L3 3750 to L2 Switch
help me here