Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
I'm working with a very flakey piece of network equipment, the uplink between our fiber handoff and our firewall.
While I've seen all kinds of setups that use RFC 1918 addresses, a firewall, an an uplink and a handoff of some sort I've not seen any cases where the firewall is also acting as the router.
All over the place:
But never this:
I'm assuming such a topology exists; if so what is it called and how do I find if a given firewall supports it?
Such a setup isn't horribly uncommon, you'll even see a fair number of 'SMB' or branch firewall devices (such as the Juniper SRX series) with modular WAN/T1 card slots or even built-in DSL modems which can help to eliminate the need for another box, in other cases, the firewall functionality built into a modern Cisco ISR router is plenty sufficient for many basic firewall use cases (NAT, etc.)
If the vendor data sheets even bother to mention it, most non-consumer-grade firewalls support being deployed in what will sometimes be referred to as an 'in-line deployment' both as a transparent bridge or a router between subnets. Often in such cases, NAT is treated like any other firewall rule or policy and is simply a configurable action (just like allow, deny, etc.) that occurs (or doesn't occur) whenever a new state is established to a specified matching source, destination, protocol, zone, or combination thereof.
Depending on your fiber handoff device though, if it's managed customer premise equipment (CPE) leased/loaned to you by the provider, you might want to discuss it with them prior to removing / replacing it, and it's possible that the handoff device is doing anything from QinQ tagging to MPLS VPN that will exceed both the capabilities of your firewall and the provider's patience with you at the same time.
