Cisco ASA vs Router or Both

Question

I have found a lot of articles asking the same question on other sites but seems to be a lot of back and forth with no agreement.

I am new to networking working with VIRL and trying to learn Cisco stuff.

From what I have read and ASA is limited in certain routing protocols, however IOS routers and limited in throughput. But ASA have better security features.. (I think yes?)

Besides that they pretty much look the same. I can setup static routes, NAT, set ACLs on both

I could not figure out if IOS routers and be setup in any kind of active - active failover, or stacked, can they?

Could i have a configuration like below if so what are the pros and cons?

ASA <--> ASA (Active Active)

Router1 <--> Router2 <--> Routern

Switch1 <--> Switch2 <--> Switchn

Node1 <--> Node2 <--> Noden

Answer 1

It's hard to completely generalize any of the above. Particularly toward the higher end of the spectrum routers will move massively more data than any firewall. That said, as the speed of the router increases the sophistication and completeness of security features will tend to decrease.

So - for example - one can buy a 36-port 100GE switch for less than a mid-range firewall. Such a switch will be able to move more packets in less time than racks full of high-end firewalls. At the same time, though, the switch will only be capable of enforcing a relatively small number of stateless rules (in the form of ACL's).

Similarly there are a whole bunch of things that routers do really well that firewalls frankly don't. If you're trying to home to multiple ISP's with BGP and want to gracefully and sanely control policy, buy a router/switch. If you want to build out a user access environment with dozens of downstream devices? Router/switch. Fancy QoS? Router. Lots of port density? Switch.

Firewalls are really, really good at security functions. Some routers have firewall functionality but, ultimately, such features tend to be add-ons intended for small installations. Full stateful analysis? Firewalls. Add in IDS/IPS? Firewalls (well, some of them). Lots of app-level analytics to intelligently filter traffic based on user identity, app heuristics, etc? Firewall. Hopefully you get the idea.

The place where the two options tend to run together are VPN's - and, honestly, cases can be made for either device depending on the context. User access VPN's are almost always better served by firewalls nowadays but most of the really heavy site-to-site work (..especially over public MPLS) seem to be performed by routers. Even so, there are plenty of valid counterexamples to both of my generalizations.

So... Routers can also provide firewalling and firewalls can do limited amounts of routing. They both have their place and part of the value of experienced architects and engineers is understanding both where the pieces could fit and where they ought to fit.

Answer 2

From what I have read and ASA is limited in certain routing protocols, however IOS routers and limited in throughput. But ASA have better security features.. (I think yes?)

Generally, speaking, ASA have better performance for security features such as stateful inspection, packet inspection, logging, etc than routers. Routers have more routing features, and the routing protocols are a bit more mature (fewer bugs) than ASAs. Routers come in all sizes, from home office to carrier grade, so you can have any performance you can afford.

Besides that they pretty much look the same. I can setup static routes, NAT, set ACLs on both.

Yes, for small networks with few features, you can pretty much use one r the other. But many networks need more advanced routing features that ASAs don't have, and they need more security performance or features that a router can easily deliver. That is why you use one or the other.

I have found a lot of articles asking the same question on other sites but seems to be a lot of back and forth with no agreement.

That is because there is no "right" answer. Each network has different requirements, so the answer will depend on several factors that vary from network to network. What is right for my network may not be for yours.

For that reason, I can't answer your last question (besides it's not clear what your topology is). I don't know what you're trying to accomplish. Remember that routers communicate with each other, so it isn't necessary to have "failover" pairs, because the routing protocols cam make adjustments if a device fails (that's an advantage over ASAs). Switches and ASA (without routing) don't have that feature, so they have failover, stacking, or other features to add redundancy.

Answer 3

From what I have read and ASA is limited in certain routing protocols, however IOS routers and limited in throughput. But ASA have better security features.. (I think yes?)

ASA cannot tunnel GRE tunnels meaning you can't setup typologies like DMVPN. Right now its a possibility, but before the ASA firmware update, only routers could do routed interfaces for site to site VPN. Not long ago, ASA was only able to do policy based VPN. I'm probably oversimplifying but there are many more differences.

Not quite sure if its 100% true ASA has better security features, however, out of the box ASA defaults are more security oriented. - For example, it has protocol inspection - I had used third party VoIP system through VPN, and had to disable VoIP inspection (or RTP). (No problem with CISCO VoIP of course) - ASA configuring zones (Name and security number) - it already has stateful packet inspection enabled (zone name and security number), whereas in a router, you have to configure longer lines of CLi for ZBF or CBAC.

Basically in my experience, to make ASA act as a router, to make packets go through without restrictions, it takes more lines of command to do that. To make router to do the security features of the ASA, it take more commands on a router than an ASA to achieve that.

Besides that they pretty much look the same. I can setup static routes, NAT, set ACLs on both

The best way to see for your self is to actually configure the technologies you mentioned and compare yourself. For example, while configuring the technologies ask yourself -- Did it take much more lines of CLi to achieve this? -- Is this feature even available for this device? -- Some examples to configure -- Configure protocol inspection in a router as in the default ASA config. -- Cisco NBAR with QoS; ASA has QoS but your HW is to find out the difference with a router. -- Site to Site VPN with Dynamic routing protocols. ASA had done OSPF through IPSEC, can it do EIGRP? Same deal with router? -- DMVPN? -- MPLS? -- MP-BGP?

These are only small samples so take a grain of salt and do your hw!

ASA <--> ASA (Active Active)

Router1 <--> Router2 <--> Routern

Switch1 <--> Switch2 <--> Switchn

Node1 <--> Node2 <--> Noden

Take simple topologies and try it yourself -

• Router - ASA firewall - multi-layer switch
• Router - ASA firewall(transparent L2 mode) - multi-layer switch
• Router - multi-layer switch
• try sticking in HA for router or firewall. Firewall will have active - passive or active - active mode while with a router, practice HRSP, VRRP, or GLBP.

By doing HW, you will find out -- you see, networking career is a marathon, not a race.