- If I have a /28 for example from the service provider and I want to use redundant links to the SP or whatever, I'd likely place a router on the outer edge because I need multiple interfaces.
I think for the most part that sounds right. I believe that if you intend to load balance the traffic that's being passed through in any way, then the router is the man for the job. When you say "redundant link" though, I think of something that can "be removed without loss of function" -- which an ASA is capable of. From ciscopress: "To keep an ASA interface up and active all the time, you can configure physical interfaces as redundant pairs. As a redundant pair, two interfaces are set aside for the same ASA function (inside, outside, and so on), and connect to the same network. Only one of the interfaces is active at any given time; the other interface stays in a standby state. As soon as the active interface loses its link status and goes down, the standby interface becomes active and takes over passing traffic."
- And if I have that same /28 and have web, DNS, and SMTP servers in a DMZ, I'd likely perform a NAT over the ASA from my pool of public IPs. Am I getting that right?
If you have DNS, SMTP, servers, and they only need to be accessed internally (or internally through a s2s or gre tunnel), then they can have a private IP address. If, however, you intend to have your DNS server, or your Web Server, for example, publicly accessible, then you would want to have them assigned a public IP address directly.
Q. Is it usually best practice to configure the outside interface on the ASA with a public IP, even if it's inside an edge router? Why or why not?
It depends on the use of the ASA. If it's simply to filter traffic coming into / going out of your network then no. If it's publicly accessible, meaning will be used to terminate IPSec VPN tunnels or SSL VPN connections, then yes, it should be configured with a public ip address. That's so it is routable from the internet.
Q. If you're connecting to remote sites via VPN or MPLS or whatever, you use your own internal addressing. Such a scenario would make it more likely that you'd place a router on the edge outside of the ASA, right, because then you'd need multiple links?
Not necessarily. Maybe there's a router (or l3 switch) behind your ASA and edge router -- and you route VPN traffic to your ASA and internet traffic through your router. Maybe there's another router down the line further that's connected to the MPLS. Your setup here is probably going to highly depend on the sensitivity of your network and whether you need to follow certain government regulations such as TIC Compliance. If not, you're pretty free to do your thing, route however you see fit, and have devices for.
Q. If that IS the case and it was of the VPN variety, would one be better off terminating the VPN on the edge router or on the ASA?
The ASA in my opinion is a much better device to terminate S2S tunnels for a few reasons. First, that's what it was designed to do. Second, the underlying operating system is much easier to work with (in my opinion) when it comes to NAT'ing, TWICE-NAT (multiple vendors accessing the same internal resource, at the same time), testing connectivity, and capturing packets for troubleshooting purposes.
If you could point me to any cool discussion of various ASA scenarios I'd be grateful. I've looked, but only found an older Cisco webpage that seems pretty limited in its scope...
I'd say start making a topology and play around with s2s connections and just have fun. I recommend GNS3 (and ASA 8.4) -- as the ASA 5505 that is available in packet tracer is rather limited...basically any time I try to do anything in packet tracer, I end up quitting because something isn't included.
Get your network up and running, monitor with Solar Winds, and just leave it running on a spare machine. As you get interested in different topics, start adding on to your network with different topologies.
Sometimes I have fun playing around in GNS3 with some of the exact things you asked about -- trying to make things work with a small pool of one or two public IP addresses. My organization has a pool of over 800,000 public IP addresses -- so sometimes that takes the fun out of a lot of stuff. Sometimes it also narrows the scope down of what you can and can't do as well. That's what GNS3 is for...fun.
