Cisco ASA deployment on internal LAN

[HAMID HUSSAIN]

i have Created a design for data center security with having internal firewall, please help me out to configure this firewall as i am not good in security.

the design is consist of  following,

2 Nexus N3K-C3524P-10GX switches for Server farm 

2 4507 Switches 

1 DC Firewall FPR2120-BUN 

1 WS-C2960X-24PS-L Switch

Have the attach diagram for reference.

[Florin Barhala]

Hello,

Couple observations:

1. It seems you spent some money to provide redundancy still you have only one firewall? Are the stakeholders aware of the risk of running this one FW only?

2. How do you intend to connect the FW to both HSRP enabled core SWs? Since you have one firewall only I would link it to only one core SWs.

3. What's the role of 2960 SW? 

4. What's behind the 2960 SW? Another firewall ? Is it just one FW or cluster?

5. What's the role required for the FPR2120 box? InterVlan routing? Internet access aka SNAT?

[HAMID HUSSAIN]

Q1, Can e connect a 2120 Firewall to both HSRP Enabled Switches? 

Behind 2960 there is a single firewall wwhich is connecting to Router, the firewall is using for internet trafic using PAT and VPN connectivity.

FPR 2120 firewall is protecting Server farm which is connected with two N3K-C3524P-10GX Switches.

[Florin Barhala]

I just reviewed your new design. It looks better if you ask me.

I think you can link the DC firewall to both 4500 SWs using a bridge group to bind two ASA interfaces. But then you will rely on STP which I wouldn't do unless this two wire requirement is very important for you.

Now let's address some old questions:
3. What's the role of 2960 SW?

4. What's behind the 2960 SW? Another firewall ? Is it just one FW or cluster?

5. What's the role required for the DC Firewall ? Internet access aka SNAT or just simulating a sort of DMZ?

[HAMID HUSSAIN]

Now let's address some old questions:
3. the role of 2960 switch is to connect Core switching and connectivity to Parameter firewall

4. there is only one firewall on edge of the network

5. the role of DC Firewall is provide web server proxy and Web server for the wan users 

[Dennis Mink]

Have you thought about a DMZ?  or do you not need one?

[HAMID HUSSAIN]

NO, in proposed design we do not need the DMZ

[HAMID HUSSAIN]

Please review, i have re deign the network.