cisco 2921 router

[ayosizzle]

would a firewall be required at a branch office if the 2921 router is deployed or can this cisco router function as a firewall?

[Ven Taylor]

A router, depending on it's IOS, can be configured with access-lists to act like a firewall or configured as a Zone Based Policy Firewall.

Here are a couple links to get you started:

CBAC: http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a0080094e8b.shtml

ZBPF:

http://www.cisco.com/en/US/customer/products/sw/secursw/ps1018/products_tech_note09186a00808bc994.shtml

I had a Pix 501, but changed it an 1811 at home and it's just got NAT and ACL configured.  No real firewall necessary for me.  I can still VPN in from work and access my network.

Hope this helps!

Ven

[ayosizzle]

Thank you so much for your response. Gathering from what you said, and thinking about it properly now, a properly configured access list can enable a rtr to block unwanted packets and perform intrusion prevention and detection from unwanted sources. But if a router can do this why go thru the hassle of buying a firewall an ASA is quite expensive.

[Ven Taylor]

True, but the difference is that an ACL is stateless.  A firewall is stateful.

That means the acl sees every packet as a new one and doesn't care about the packets that came before it or the packets that come after it.  Firewalls can see the entire conversation.

Access-lists have been around a lot longer than firewalls, so people have gotten pretty creative with them.

Zone based and reflexive access lists are an example.

Here's a link to a conversation elsewhere on these forums:

https://supportforums.cisco.com/thread/137697

I think Rick said it best.

For more in-depth understanding, just google "firewall vs. ACL".  There are so many links that you could read for hours.

All that said, I think an ACL will suffice for a simple network, but as you add complexity and require more flexibility, you'll find that a firewall is the easier choice.  Router ACL's can get quite convoluted as they increase in complexity.

Ven

[ayosizzle]

thanks