Need Suggestion On Best Practice Solution

[pauzi123@]

Hello,

Im currently in midst of optimizing site network that have more than 4100 users (currently). I would like know whether is it better to put:

1. Firewall in-front of router OR
2. Router in-front of firewall

My Firewall is ASA 5508-X (FirePower)

My Router is Cisco 2911-HSEC+/K9

Currently the router is handling only NAT-ing. The memory utilization is 79%

I attached current overall drawing for the site.

[marce1000]

  - Your keyword 'in-front of' is undefined because it can be explained in 2 ways; it's better to have the router at the real edge, and only let it  handle routing; you should handle NAT on the firewall to take advantage of using firewalling properties/actions  when doing NAT.

M.

[pauzi123@]

Thank you for the information. What i mean by in front is, is better to put firewall or router first?

My current setup is firewall first having public IP, the router is connected at the firewall.

[marce1000]

  - Check the remarks from Leonardo

M.

[Leonardo Gama · Accepted solution]

Hi,

Considering your current topology and the fact that your ASA has far more horsepower than 2911, I would remove the 2911 from the topology (less point of failure) and let all routing and NAT with the firewalls, logically if you do not need any fancy feature from ISR routers.

Moreover I would insert a redundant 3850 switch with the second ASA.

Cheers.