layer 2 firewalls

[daddum61]

not sure if best to post this here or security

I have customer that has a large layer 2 network, basically its a fibre ring with 25 sites

each site has a switch, and there are a number of VLAN's running over the network.

Rapid Spanning Tree is on the ring

the whole system is a critical network, but not really high bandwidth.

The customer has decided that he want to install a firewall on each of the 25 sites, and i suggested that we just drop in layer 2 firewalls, and keep the existing network addresses the same

But i did wonder, am i better migrating the whole thing to a layer 3 network ?

the existing VLAN's have different priorities and the number of devices on each site less than 20, but there are 25 sites spread over a very large area, the fibre ring is around 120miles long

[balaji.bandi]

You can install FW in Transparent mode keep exiting network intact.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa95/configuration/general/asa-95-general-config/intro-fw.html

[gerardothink]

I would not use firewalls if the sites are not going to the internet, firewalls are not intended to be use to do hardcore routing, that is why you have routers or L3 Switches, you have to be very careful service policy if you use them to route.