I have a question about how I should setup NAT on our 6509's with relation to the FWSM and MSFC.
Is it better to NAT at the MSFC or FWSM? We do plan on having at least 1 DMZ in addition to the "inside" and "outside" networks if that helps.
If we put the NAT on the FWSM, then option 1 would have our FWSM connected directly to the ISP 2811 routers. We could also use Option 2 where the MSFC is connected directly to the ISP 2811 routers. This would require us to extend the public network down to the FWSM. That is why I have the virtual connection between the MSFC and FWSM in option 2 as "Network Unknown."
If we put NAT on the MSFC, then we could use option 2 where the MSFC is connected directly to the ISP 2811 routers. This would allow us to use a private network for the virtual link between the MSFC and FWSM.
I have read somewhere that, for security reasons, it is best to place the MSFC between the Internet and the FWSM. I am looking for any help or suggestions.
Thanks,