Joe
The suggestion to connect the outside of the router to the same subnet as the outside ASA and the inside interface of the router to the ASA DMZ isn't in your original designs although it is generally the one i would recommend. Having the outside interface of the router in parallel with the ASA removes any NAT issues by having to go through the ASA first.
Having the inside interface of the router on a DMZ then allows you filter the traffic after it has been decrypted.
With this setup it is important to lock down the outside router interface to only allow IPSEC connections.
The problem you have is whether the firewall supports passing multicast traffic. If it's an ASA in routed mode then it doesn't ( ** see below) so the solutions are -
1) run the ASA in transparent mode but i suspect this would mess up the whole topology
or
2) create a GRE tunnel from the inside router interface through the ASA to a L3 device on the inside. Unfortunately if your device is a L3 switch ie. no router, then there is a strong possibility it will not support GRE tunnels (from memory i think 6500s do but not sure). Even if you could use GRE tunnel this is not necessarily a good choice because anything inside the GRE tunnel cannot be statefully checked by the firewall.
Really not keen on the first option because if the router is compromised then you have basically bypassed the firewall. Also if any of the remote sites are compromised then they have a direct path to your internal LAN.
The second option allows you to protect the outside interface of the router so you can control who can connect via IPSEC and if there is a bug in the IOS on the router there is some protection. You could then filter the traffic with an outbound acl on the inside interface of the router but this is not stateful (unless you were prepared to run stateful firewalling on the router). A lot depends on how much you trust the traffic being sent down the IPSEC tunnels.
The third option is probably the most secure because you can apply stateful firewalling to the decrypted traffic. Again whether or not you need to do this really depends on just how comfortable you are with the trustworthiness of the IPSEC traffic.
A final option would be if you had another interface on the ASA that you could use for another DMZ for the inside interface of the router but you may not and it may be wasting an interface you need further on.
So to summarise, if you didn't need to pass any multicast traffic i would go with router outside parallel to ASA outside (same subnet) and router inside on DMZ. If you do need to pass multicast then perhaps the 3rd option or if you really do trust the IPSEC connections the 2nd option..
** Edit - as noted by Marwan the ASA will support multicast routing but this may not be what you need. But even if it did IPSEC tunnels will not pass the mulitcast traffic anyway. For that you need to run IPSEC within GRE so you would need your tunnels to the router to be using GRE, something like DMVPN.
** Edit 2 - sorry Joe. You could actually run PIM on the ASA and have the inside interface of the router on a DMZ and the outside parallel to the ASA firewall. This may be the best solution but it would need testing as i have never done this before.
Jon
