I will be installing a 10Gb Ethernet direct Internet access circuit, of which we will be using between 1-3 Gbps on average. We will have a set of static public IPs routed to the WAN IP address. The application we will be supporting is a HTTP based streaming application. Almost all of the bandwidth will be outbound.
I am wondering if whether it would make more sense just to plug the circuit directly into a big ASA box or front end it with a router.
When you look at the prices for a 7600 or ASR1000 to front end the 10Gb Ethernet it can get very expensive. The ASA will be expensive enough
I know just based on the numbers I will need something like the ASA-5580 or ASA-5585-X.
Besides the one outside interface, I will have 4 internal interfaces. the HTTP based streaming application will all come from one interface and the other three will need a strict amount of bandwidth carved out of the total Internet circuit. Each will need around 50Mbps.
The other three are real-time streaming applications and I cannot have them crushed by the bursty nature of the HTTP streaming application.
Can i reliably ensure (by policing, shaping, etc.) that the 3 other interfaces can actually get their needed bandwidth protected on the ASA? I've read the documentation and it looks to be there, but not as robust as the IOS features. I will need to police based on Interface and also by source/destination IP.
Would it make more sense to trust an IOS router in front of the firewall to really police/shape the traffic?
Thanks,
Damon
