Skip to main content
Commonmark migration
Source Link

From what I have read and ASA is limited in certain routing protocols, however IOS routers and limited in throughput. But ASA have better security features.. (I think yes?)

Generally, speaking, ASA have better performance for security features such as stateful inspection, packet inspection, logging, etc than routers. Routers have more routing features, and the routing protocols are a bit more mature (fewer bugs) than ASAs. Routers come in all sizes, from home office to carrier grade, so you can have any performance you can afford.

Besides that they pretty much look the same. I can setup static routes, NAT, set ACLs on both.

Yes, for small networks with few features, you can pretty much use one r the other. But many networks need more advanced routing features that ASAs don't have, and they need more security performance or features that a router can easily deliver. That is why you use one or the other.

 

I have found a lot of articles asking the same question on other sites but seems to be a lot of back and forth with no agreement.

That is because there is no "right" answer. Each network has different requirements, so the answer will depend on several factors that vary from network to network. What is right for my network may not be for yours.

For that reason, I can't answer your last question (besides it's not clear what your topology is). I don't know what you're trying to accomplish. Remember that routers communicate with each other, so it isn't necessary to have "failover" pairs, because the routing protocols cam make adjustments if a device fails (that's an advantage over ASAs). Switches and ASA (without routing) don't have that feature, so they have failover, stacking, or other features to add redundancy.

From what I have read and ASA is limited in certain routing protocols, however IOS routers and limited in throughput. But ASA have better security features.. (I think yes?)

Generally, speaking, ASA have better performance for security features such as stateful inspection, packet inspection, logging, etc than routers. Routers have more routing features, and the routing protocols are a bit more mature (fewer bugs) than ASAs. Routers come in all sizes, from home office to carrier grade, so you can have any performance you can afford.

Besides that they pretty much look the same. I can setup static routes, NAT, set ACLs on both.

Yes, for small networks with few features, you can pretty much use one r the other. But many networks need more advanced routing features that ASAs don't have, and they need more security performance or features that a router can easily deliver. That is why you use one or the other.

 

I have found a lot of articles asking the same question on other sites but seems to be a lot of back and forth with no agreement.

That is because there is no "right" answer. Each network has different requirements, so the answer will depend on several factors that vary from network to network. What is right for my network may not be for yours.

For that reason, I can't answer your last question (besides it's not clear what your topology is). I don't know what you're trying to accomplish. Remember that routers communicate with each other, so it isn't necessary to have "failover" pairs, because the routing protocols cam make adjustments if a device fails (that's an advantage over ASAs). Switches and ASA (without routing) don't have that feature, so they have failover, stacking, or other features to add redundancy.

From what I have read and ASA is limited in certain routing protocols, however IOS routers and limited in throughput. But ASA have better security features.. (I think yes?)

Generally, speaking, ASA have better performance for security features such as stateful inspection, packet inspection, logging, etc than routers. Routers have more routing features, and the routing protocols are a bit more mature (fewer bugs) than ASAs. Routers come in all sizes, from home office to carrier grade, so you can have any performance you can afford.

Besides that they pretty much look the same. I can setup static routes, NAT, set ACLs on both.

Yes, for small networks with few features, you can pretty much use one r the other. But many networks need more advanced routing features that ASAs don't have, and they need more security performance or features that a router can easily deliver. That is why you use one or the other.

I have found a lot of articles asking the same question on other sites but seems to be a lot of back and forth with no agreement.

That is because there is no "right" answer. Each network has different requirements, so the answer will depend on several factors that vary from network to network. What is right for my network may not be for yours.

For that reason, I can't answer your last question (besides it's not clear what your topology is). I don't know what you're trying to accomplish. Remember that routers communicate with each other, so it isn't necessary to have "failover" pairs, because the routing protocols cam make adjustments if a device fails (that's an advantage over ASAs). Switches and ASA (without routing) don't have that feature, so they have failover, stacking, or other features to add redundancy.

Source Link
Ron Trunk
  • 68.1k
  • 5
  • 66
  • 126

From what I have read and ASA is limited in certain routing protocols, however IOS routers and limited in throughput. But ASA have better security features.. (I think yes?)

Generally, speaking, ASA have better performance for security features such as stateful inspection, packet inspection, logging, etc than routers. Routers have more routing features, and the routing protocols are a bit more mature (fewer bugs) than ASAs. Routers come in all sizes, from home office to carrier grade, so you can have any performance you can afford.

Besides that they pretty much look the same. I can setup static routes, NAT, set ACLs on both.

Yes, for small networks with few features, you can pretty much use one r the other. But many networks need more advanced routing features that ASAs don't have, and they need more security performance or features that a router can easily deliver. That is why you use one or the other.

I have found a lot of articles asking the same question on other sites but seems to be a lot of back and forth with no agreement.

That is because there is no "right" answer. Each network has different requirements, so the answer will depend on several factors that vary from network to network. What is right for my network may not be for yours.

For that reason, I can't answer your last question (besides it's not clear what your topology is). I don't know what you're trying to accomplish. Remember that routers communicate with each other, so it isn't necessary to have "failover" pairs, because the routing protocols cam make adjustments if a device fails (that's an advantage over ASAs). Switches and ASA (without routing) don't have that feature, so they have failover, stacking, or other features to add redundancy.