Placement of firewall for VPN RA and L2L tunnels

Question

For Remote Access (RA) and LAN-to-LAN (L2L) VPN, I currently operate a pair of Cisco VPN 3005 Concentrators tied to Internet edge routers on the outside and the inside tied to an internal pair of PIX 535s on what is the firewall outside interface before being allowed to pass through to our real internal networks. Both the VPN 3005s and the PIX 535s are being replaced with the ASA-5545X platform. These firewalls are not for our primary Internet traffic, only VPN, and they may also serve as an internal firewalls for traffic going into the data center across private lines.

With the internal firewall ACLs being combined in a single firewall that serves VPN traffic and potentially other private line traffic, for security boundaries and to eliminate any potential routing issues, should the inside interface of the VPN-firewall (5545) stay in a separate subnet from the main Internet firewall or does it really not matter? OSPF is currently running on the Internet firewall (w/default-originate) and the VPN 3005. As this data center is our primary DC for web traffic -- our bread and butter -- I must eliminate any potential issues with the placement of the VPN firewalls that could interfere with this even in the slightest way.

**Should the inside interface of the 5545 land first on the L2 edge switches and then trunk to the agg switches for better security or just have the inside drop straight into the Agg layer, also considering that private line traffic may come through yet another interface on the 5545 in the future.

Only the relevant parts of the L3 connectivity are shown below with the ASA-5545X* that's in question.

                     Internet
                        |
               Edge rtr + Edge rtr
                        |
5545* (VPN/Internal fw) + 5540 (Internet fw for traffic in/out DC)
                        |
                  Agg-1 + Agg-2
                        |
                       etc

A pair of L2 switches connect all the edge devices before reaching the Agg switches.
Public IP space outside of firewalls, private on inside.
(Each firewall is part of a separate failover pair not shown; the 5545 and 5540
have no interaction.)

Looking for answers/comments that could be considered best practice or what you've found works best in a typical enterprise network.

Answer 1

Should the inside interface of the 5545 land first on the L2 edge switches and then trunk to the agg switches for better security or just have the inside drop straight into the Agg layer, also considering that private line traffic may come through yet another interface on the 5545 in the future

Since you did not say that the L2s would be running ACLs, I would not see a difference. I am guessing you will run tagging on the inside ASAs to the distribution layer. My firewalls connect directly to aggregation switches with a dedicated vlan that runs HSRP/VRRP between each set of firewalls and the agg switches.

As to private line traffic, I do not use ASA but I think they have the zones construct like IOS ZBF and you will keep VPN traffic from going to/from the private line traffic without going through packet filtering.

It sounds like default route points to the 5540 and you will use more specific routes to get to your internal VPN access pools and the private line addresses. The 5545 has the default route pointing to the 5540 and it is ok for VPN traffic to hit the internet directly (don't know if you split tunnel on your VPN clients) and other routes to your internal address space.

So I can not see any real problems with your plan. But some of my above assumptions may be wrong

Answer 2

From what I understand of your scenario, it does not matter if you have two different firewalls internal interface on the same internal subnet. You need to keep the following in your mind when making this decision:

1. Does having them on the same subnet make configuration simpler and easier?
2. Will it help if they were on separate subnets in any way?
3. Have I done proper routing and I understand the path of any connection scenario? For example, internal traffic will pass though which devices before reaching the destination?
4. Have I all configured all rules on the firewalls properly to make sure no inter-Domain routing is occurring? This means that traffic on the same subnet that belongs to other device (other firewall) is not routed. This might be the most critical thing in your setup which you are concerned about. Again it depends all on your required traffic paths.

Answer 3

I have deployed ASAs in similar scenarios and all went well, with careful planning and maintenance.

For the outside interface, first of all secure your OSPF process using MD5. You are to connect this interface to your L2-aggregate switches.

On your inside interface we can dive into: - technically you can connect it to your L3 switch so you will split the role or the load between your network devices, also makes sense for a regular firewall (if at some moment you will have issues with your L2-aggreg devices, at least the network from bottom to the firewall is working) - for this scenario as ASA is VPN-used it means you can also connect your inside to the L2-aggregation switches. Without those L2-aggreg switches your 5545 will become useless for your network. Nevertheless for this choice you have to think about monitored interfaces as all your firewall physical interfaces will be connected to one physical device. Bottom line: if I have ports and capacity for better logical and troubleshooting I would connect inside straight to L3-bottom-switches.

Finally regarding your 1st question: I have used inside interface both as a shared network with the other inside firewall (you could run into some details with same-security-traffic command and also as a dedicated network, than using bottom switches connect to the rest of the network.

I prefer the last one as in this case VPN L2L filtering is done on the firewall (ASA 5545) instead of group-policy ACL (and then applying it to the tunnel-group). It is easy to manage, view, troubleshoot (for me) and also it keeps me away from some ASA more delicate traffic hairpin scenarios.