From what I have read and ASA is limited in certain routing protocols,
however IOS routers and limited in throughput. But ASA have better
security features.. (I think yes?)
ASA cannot tunnel GRE tunnels meaning you can't setup typologies like DMVPN.
Right now its a possibility, but before the ASA firmware update, only routers could do routed interfaces for site to site VPN. Not long ago, ASA was only able to do policy based VPN. I'm probably oversimplifying but there are many more differences.
Not quite sure if its 100% true ASA has better security features, however, out of the box ASA defaults are more security oriented.
- For example, it has protocol inspection - I had used third party VoIP system through VPN, and had to disable VoIP inspection (or RTP). (No problem with CISCO VoIP of course)
- ASA configuring zones (Name and security number) - it already has stateful packet inspection enabled (zone name and security number), whereas in a router, you have to configure longer lines of CLi for ZBF or CBAC.
Basically in my experience, to make ASA act as a router, to make packets go through without restrictions, it takes more lines of command to do that.
To make router to do the security features of the ASA, it take more commands on a router than an ASA to achieve that.
Besides that they pretty much look the same. I can setup static
routes, NAT, set ACLs on both
The best way to see for your self is to actually configure the technologies you mentioned and compare yourself. For example, while configuring the technologies ask yourself
-- Did it take much more lines of CLi to achieve this?
-- Is this feature even available for this device?
-- Some examples to configure -- Configure protocol inspection in a router as in the default ASA config.
-- Cisco NBAR with QoS; ASA has QoS but your HW is to find out the difference with a router.
-- Site to Site VPN with Dynamic routing protocols. ASA had done OSPF through IPSEC, can it do EIGRP? Same deal with router?
These are only small samples so take a grain of salt and do your hw!
ASA <--> ASA (Active Active)
Router1 <--> Router2 <--> Routern
Switch1 <--> Switch2 <--> Switchn
Node1 <--> Node2 <--> Noden
Take simple topologies and try it yourself -
- Router - ASA firewall - multi-layer switch
- Router - ASA firewall(transparent L2 mode) - multi-layer switch
- Router - multi-layer switch
- try sticking in HA for router or firewall. Firewall will have active - passive or active - active mode while with a router, practice HRSP, VRRP, or GLBP.
By doing HW, you will find out -- you see, networking career is a marathon, not a race.