Elminiate Internet border router with ASA

[raymng]

Hi there,

Typically, our remote office has a WAN router with T1 Internet connection.  Then, we put an ASA behind the router LAN for firewall/NAT those kind of function.

Recently, we are planning to replace the T1 Internet connection with Ethernet 10Mbps Internet connection.  I am think to have the Ethernet Internet connection goes directly to the ASA external interface, elminiating the border router. 

Is this a common approach?  Any downside if I decide to go with this option?

Thank you.

-Raymond

[Julio Carvajal]

Hello Ray,

In fact this is a common approach talking about scenarios being used  using an ASA, this because the ASA can route, can nat, can be the end-termination of a vpn, etc,etc. And all of this also with the major security features not seeing before on  any firewal that will protect your internal network from the outside world.

So If you want to do it go for it, the ASA will work for this setup.

Regards,

Julio

[david.tran]

You need to THINK carefully before you are going to do this for several reasons:

- ASA can not terminate combination of GRE/IPSec,

- ASA can not do DMVPN or VTI,

- Complex QoS,

Therefore, if your plan include multicast over VPN, then you should NOT get rid of the router.

my 2c

[raymng]

Thank you both for your input.

Dave, thanks for the note about what ASA cannot do.  Fortunately in my case, I won't need to worry about these limitation in this case, but it is good to be aware of them for future case. 

[Julio Carvajal]

Hello Raym,

My pleasure, please let me know if you have any other questions.

If not we can mark the question as answered.

Regards,

Julio

[r.kukreja]

but if u eliminate router you will not be able to do policing or bandwidth segregation. please rate if helpful

Regards,

rajat

[Julio Carvajal]

Hello R.kukreja,

You would be able to do policing or bandiwth limit on the ASA using the MPF.

Regards,

Julio

[david.tran]

"You would be able to do policing or bandiwth limit on the ASA using the MPF."

A German Porsche is NOT as same as a Toyota Camry.  They are both cars but the Porsche can do a lot of things that the Camry can not do.

The same goes with bw limit and policing on the ASA.  It can be done on the ASA but the router has much more flexibilities with these features. 

You can run ospf and BGP on the ASA too but you don't see many people do that, do you?

[Julio Carvajal]

I do not argue that, it is 100 % correct, but you still will be able to do police bandwith on the ASA , eventough the Router is more flexible.

Thanks for the comment anyway

Julio