I have to create a topology for VPN connection of the branches with the HQ, to access the servers. My question is: Which FW series (ASA, FRP...) to employ at the HQ and which one to the branches. Branches are small offices up to 10 employees.
Specification are as below:
Dual WAN ports with automatic fallback
IPSec VPN capability (up to 8 simultaneous connections for HQ)
VPN licenses (8 connections for HQ, 1 connection for other sites)
If you really need to have DNS-services, there is only the IOS router in the cisco portfolio.
If you can live without, my preferences would be:
Cisco Meraki MX on HQ and the branches. These are most easily to setup and the VPN will work instantly.
Cisco ASAs on all sites with manually configured route-based VPN. This will give you also a good firewall for the branches.
IOS routers on all sites. Maximum flexibility but the firewall implementation is most complex compared to the other solutions.
Personally I don't like Firepower Thread Defense as you always need two IPs reachable from your headquarter. One for the Data-Plane and one for management. That can get quite tricky to setup and is a more advanced topic.
If you really need to have DNS-services, there is only the IOS router in the cisco portfolio.
If you can live without, my preferences would be:
Cisco Meraki MX on HQ and the branches. These are most easily to setup and the VPN will work instantly.
Cisco ASAs on all sites with manually configured route-based VPN. This will give you also a good firewall for the branches.
IOS routers on all sites. Maximum flexibility but the firewall implementation is most complex compared to the other solutions.
Personally I don't like Firepower Thread Defense as you always need two IPs reachable from your headquarter. One for the Data-Plane and one for management. That can get quite tricky to setup and is a more advanced topic.
It just means that you can't point your clients to that device to resolve names. Most likely you have a DNS-server inside of your HQ and you can point your clients to that one. With that all clients can resolve your internal resources. Or you could install DNS-servers in each branch. But that could be overkill for 10 employees.
