Showing results for 
Search instead for 
Did you mean: 

ASA Firewall Placement

Level 1
Level 1

I am trying to determine whether or not it makes sense to add a distribution set of switches as part of a ASA firewall design effort or to just bring the ASA's directly into the existing collapsed core/dist pair.

Basically, we have a site that has a collapsed core/distribution using a pair of 6500s.   All access switches are dual homed to this core/dist pair.

We need to implement a redundant ASA solution for a vendor application at this site.   On the vendor's side there will be a 3750 stack with one uplink going to ASA 1 and the other uplink going to ASA 2.   Right now we are considering a pair of 3560's on the other side of the ASA's which would then connect L3 into the core/dist pair of 6500s.   Between the internal 3750 stack and the pair of 3560's will be L3 PTP links.   The ASA's will be in transparent mode.  

I am wondering what are all the pros/cons of bringing the ASA's directly into the collapsed core/distribution?  What is the benefit of adding another L3 hop to the design with the 3560s?   If we have a L3 between the vendor's router the core/dist with the ASA's in the middle shouldn't that sufficiently satisfy the security concerns?  Below are quick sketches of the two topologies.  

Option 1:

                              --------------ASA1------------3560 dist--------------6500 core/dist-----------

LAN-------3750 stack                                       |                          |                           Core

                              --------------ASA2------------3560 dist--------------6500 core/dist-----------

Option 2:

                              ----------------ASA1---------------------6500 core/dist---------------------

LAN--------3750 stack                                                |                                       Core

                              ----------------ASA2---------------------6500 core/dist---------------------

Any thoughts are appreciated.


1 Reply 1

Level 1
Level 1

Thinking about this more I think using Option2: with the ASA's in routed-mode would be a good solution.   This will provide a L3 boundary between the vendor managed 3750 stack and the core/distribution with less hardware.  


Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card