Advice: Firewall behind router

[matthew.norman]

Hello all,

I have been doing a bit of reading and most articles have suggested that it is better to have an edge router with the firewall sitting behind the router.

In this case would you still control access to the internal network using the firewall or would you do it on the router with access lists?

What other purpose would the firewall have if the router takes over access control?

Regards

Matt

[Hector Gustavo Serrano Gutierrez]

Hello matthew.norman@ers.com,

In my humble opinion, if the the case is Firewall --> Router --> ISP, I would let the Firewall do its duty managing the rules on it. Since Firewalls are there for that purpose, those usually have more advance features to log the allowed/blocked traffic.

Cisco Routers have the 'log' parameter that can be appended to an ACL. However, I would not use that command to monitor all the traffic since it might increase the CPU on the Router. That feature should be used only for troubleshooting purposes.

I hope this helps.

Best Regards.