About Configuring Stateful Firewall on Catalyst9300X

[Translator]

I want to run a stateful firewall on two stacked Catalyst9300X.

Reference: Stateful Firewall on Cisco Catalyst 9300 Series Switches - Stateful Firewall on Cisco Catalyst 9300 Series Switches [Cisco IOS XE 17] - Cisco

Is the following configuration possible with the above equipment?

The ASAc provides only firewall functions, the C9300X on the external network side is BGP, and the internal network is assumed to be static routing.

[Configuration]

C9300X <—> ASAc <—> C9300X

※ The above is a physical configuration within the C9300X.

[Image]

Thank you.

[Azizi123]

Yes, your proposed configuration is technically possible using stacked Catalyst 9300X switches, provided that you are leveraging Cisco IOS XE 17.7 or later and have the necessary licenses (such as network advantage, securityk9, and app-hosting). In this setup, one C9300X switch handles external BGP routing, traffic is passed through an ASAc (which can be a virtual ASA hosted inside the Catalyst 9300X via the App Hosting feature), and then forwarded to the second C9300X using static routing for internal network access. This configuration allows for a stateful firewall function either directly on the switch using zone-based firewall (ZBFW) or through the hosted ASAv, with proper VLAN/interface segmentation and routing to ensure all traffic is inspected. However, care must be taken to design the L2/L3 topology correctly to avoid bypassing the firewall and to ensure service chaining works as intended.

[Translator]

Thank you for your instruction.

With the above configuration, is it common to configure VLANs for ASA inside/outside?

[wajidhassan]

Yes, your setup is possible and should work fine. The two stacked C9300X switches can route traffic, with BGP on the external side and static routes internally. The ASA will handle all firewall duties in the middle. Just make sure routing is correct and VLANs/interfaces are properly configured. No need to use the C9300X's built-in firewall if ASA is handling it.

[Leo Laohoo]

The question is not about "is this possible" but, rather, WHY?

Why put all the proverbial eggs in one basket?  IOS-XE is not stable enough to support a switch let alone a switch with an ASA on top.  

[Translator]

Thank you very much!

VRF is used to control the internal and external, but is it necessary to configure VRF between the ASA and the internal L3/external L3 as well?