dc-firewall

[k.adath2015]

Hi,

vpc is running  in datacenter ( its not really double sided or single sided )   . Need to  put  dc firewall ( asa with source fire ) 

What is the best practices . L3 or L2 

Thanks

[Philip D'Ath]

Can you be a lot more specific.

[k.adath2015]

Hi,

Sorry for the inconvenience , I have similar toplogy (attached ) in my data center .

All the servers in the dc  must be protected .  from the agg switch there is l3 connecvity  to the core switch . (core switch not shown in the  picture ) 

server subnets are 192.168.15.0/24 16.0/24...20.0/24 

vlan interfaces are configured on the agg switches and hsrp is running  .

Now want to protect the serevers behind the dc . 

So where should be the firewall placed and  routed mode or transparent mode is better 

Thanks

[nspasov]

Routed mode is my preferred deployment but it requires more network interruption. Transparent mode on the other hand is much easier to be deployed in an existing environment. Thus, it really boils down to preference and design requirements. 

I would highly recommend that you check Cisco's Validated Design below. There is a lot of info that might not apply to your environment or setup but it is still a good document to read and reference. 

http://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise/design-zone-security/sdc-dg.pdf

I hope this helps!

Thank you for rating helpful posts!

[k.adath2015]

Hi,

Choosing routed mode ,what was your benefit 

Thanks

[nspasov]

1. There are several features that are not supported when running the ASA in transparent mode

2. Troubleshooting is easier and less convoluted when running in routed mode

3. In routed mode the ASA is a L3 hop on your network. This allows you to run routing protocols, policy-based routing, etc.

4. For more information about the differences and features for each mode you should reference the configuration guide:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/general/asa-96-general-config/intro-fw.html

I hope this helps!

Thank you for rating helpful posts!