Need Best practice guide for Putting Firewall or Router on Edge?

[Learnercisco]

Hi Teck Guys.

Please share a cisco validate design for putting FPS 2130 or Router ASR1K on edge. i have attached my block diagram. suggest the validate design. Thanks All. 

[balaji.bandi]

A best possible way is :

Access Switch ( where users connect) --- Core ----FW---ASR----Internet

A couple of questions :

1.  what is mean by Access switch - where the users PC or device connected, in this case above is bet example.

2. or if that is WAN Aggregation switch to connect, then your design should be ok.

[Learnercisco]

Thanks BB for your Valueable reply,

My design is related to the following:

Access---Distributiion----Core----FW----WANaggregSwitch----ASR1K- Internet. 

I suppose your  reply  is related the above design. Please Confirm. 

2.  if that is WAN Aggregation switch to connect, then your design should be ok.

[balaji.bandi]

Access---Distribution----Core----FW----WANaggregSwitch----ASR1K- Internet

This make sense.

But  WANaggregSwitch - this switch only connect to internet or your satellite sites or Branch office?

[Learnercisco]

Hi BB,

Thanks for reply,

we could use this WAN Agg Switch between Firewall and Router for Internet traffic.we have 3 remote branches in campus network, shall directly connect to ISR1K via Fiber Optic Link or we can connect to WAN Aggregate Switch.  i prefer to connect to ASR1K for Routing in one place on upstream. Thanks 

[balaji.bandi]

If the branch office point to point to link

i prefer to take inside the network, but if you do not have any other device dedicated to WAN Aggregation inside network.

I will use ASR and make necessary FW rules for the device to access internal resources.

[Seb Rupik]

Hi there,

You may want to take a look at the CVD guide for the internet edge:

https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Oct2015/Internet_Edge_Design_Oct2015.pdf

cheers,

Seb.

[Learnercisco]

Thanks SR for the valueable reply.