DMVPN With ASA Firewall ( Hub and Spokes behind firewalls, respectively)

[nwekechampion]

Hi all,

I have a use case for a client to design and implement a DMVPN Solution with both hub and spokes behind their respective ASA firewalls.

Would it be a good/feasible desing to implement a firewall in this case or would Ipsec over DMVPN solution suffice for security?

Also, what measures can be put in place to simultaneously protect the internet/WAN link, if the firewall behind the tunnel is an overkill?

Regards

Champs

[balaji.bandi]

Depends on use case and how the organisation looking to deploy :

here is he best examples given by cisco CVD for reference, both is possible.

https://www.cisco.com/c/dam/en/us/products/collateral/security/dynamic-multipoint-vpn-dmvpn/dmvpn_design_guide.pdf

If this links are private links not coming over internet, you do not need FW, you can have FW internally to protect your Servers/ Service.

[nwekechampion]

Hi Balaji,

The loink you sent through could not be accessed.

Could you help out with this please?

Regards

[nwekechampion]

I get the error below:


403 - Forbidden Page or Application

The file or application you are trying to access may require additional entitlement or you are trying to access a file with an invalid name. Additional entitlement levels are granted based on a users relationship with Cisco on a per-application basis.

If you feel you have reached this page in error, please try one of the following methods to locate your document:

1. If you are manually entering the URL into your browser location bar, be sure to include the file name of the page you are trying to access (file names typically end in .htm, .html or .shtml).
2. Use the Search feature located in the upper right section of this page.
3. Return to the Cisco.com Home or select a primary site area from the top navigation bar.
4. Consult with your Cisco Account Manager to confirm you have the appropriate entitlement to access this page.

If you would like to contact someone about this problem, please click on the Contacts & Feedback link below.

[balaji.bandi]

Not sure some what messed up and not able to open that myself, added the the one i have downloaded.

[nwekechampion]

Thanks Balaji
I will have a read and come back to you..
Thanks again