Dual DMVPN with ASA

[Raimund Schimanovits]

Hello

I have to install 2 ASA Firewalls in a dual DMVPN Router system. 

Is it better to install them behind or in front of the router? 

Where do i find some information ?

Thanks 

[Karsten Iwen]

As always: It depends ...

Do you want to protect the routers? Then install the firewalls in front of the routers. Do you want to filter on the user-traffic that leaves the tunnel? Then install them behind the routers. You could also do both by placing the routers inside a DMZ, but that makes the routing-config more difficult.

[Raimund Schimanovits]

It would be nice if i can see the traffic from the VPN´s and the routers protected.

So do you know where i can find some information about the Router inside a DMZ?

Thanks

[dperezoquendo]

Hello,

This design guide might help: http://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Aug2014/CVD-VPNWANDesignGuide-AUG14.pdf

[Raimund Schimanovits]

Thanks i will read this document

best regards