Having attempted to research this I’m still uncertain of where best to place firewalls in an existing network due to needing to retain a common vlan between 2 core sites. The network has the following requirements:
- Redundancy between 2 x corporate sites to allow network based internet access with L2 adjacency for HSRP between the Cisco1921 routers so that DMZ resources and Customer LAN hosts use the vip as their default gateway
- All internet traffic to/from the Customer LAN should be processed by the local ASA
- All traffic from the internet to the DMZ should be processed by the ASA
- Internet traffic and Corporate data will share the same WAN links and need to retain a common vlan that trunks between SVIs on the L3 switches
Is there a better way of achieving this instead of having to translate and explicitly send everything via the ASA firewalls between the internet access, dmz and lan users? I would prefer to have the firewalls in the direct path between the routers and switches to simplify their configs but not sure how else I can retain the HSRP communication between sites if placed other than depicted in the diagram? Does it actually matter where the ASA sits from a security perspective?