I'm trying to understand networking and when looking at the different routers, firewalls and switches, I came across Cisco ASA. I've read that these can be used as firewalls and routers but others say if you use a ASA you should use it as a firewall and use a separate router for routing.

So if I was building a network would it be right in saying that I can have a switch connected to an ASA, which is then connected to a router and this is then connected to the internet?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 15 '19 at 19:54

It is good to use devices for what they are designed for.

Routers are good at routing protocols and using one where you connect to the ISP (and perhaps run BGP) is correct.

Switches are good and cost effective for providing large numbers of access ports for your users.

A stateful firewall is generally required in the middle to protect against attacks. ASA’s can route or bridge traffic but their purpose is to firewall, NAT, and (sometimes) site-to-site VPN. The only reason they route or bridge is to get the packets through the firewall logic.

One missing piece is: what device is going to act as the DHCP forwarder and default gateway for all those internal switchports? If the switch was a L3 switch, it could do it. In a small network the ASA could do it. A medium enterprise would add a layer of hierarchy: an L3 switch for internal routing with a bunch of L2 switches for cheap access ports.

While a cisco device can act as DHCP server, it is recommended to have the Cisco forward DHCP to a dedicated server.

You also need to provide DNS. Having your own DNS resolver with malware-domain filtering is good for security.

For redundancy: double all the devices. But understand that every access port only connects to one access switch. The complexity of adding redundancy causes human-configuration outages, but they are generally shorter because you have the hardware to recover on site. Hardware-caused outages are rare but you don’t want to be down for a day waiting for TAC to ship you something. It’s also nice to be able to reboot one device at a time without causing outages (note the switchport exception).

One other point about using ASA’s as routers: stateful firewalls deny “asymmetric” traffic. So you have to use them at chokepoints where you enforce that traffic goes through them in both directions. That’s also why redundant ASA’s are deployed in “clusters” where two physical boxes act as one logical box in the chokepoint.

Edit: it’s also important to consider the “financial layer” of the OSI model:

(Price per 10-gig port)

 Router capable of doing BGP with full internet routes: expensive
 Router capable of doing BGP with small number of routes: moderately expensive
 ASA: very expensive
 L3 switch: moderately expensive
 L2 switch: inexpensive

You don’t buy an expensive ASA where a moderately priced L3 switch will do.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.