Most diagrams I come across are as follows:
ISP > router > firewall
However, wouldn't you want a firewall before the router to protect the router? E.g ISP > firewall > router
Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.Sign up to join this community
The reason the router is in front of the firewall is that in many/most networks, the transmission media between the ISP and the customer is not supported by the firewall, so a router is necessary.
More recently, many carriers provide a Ethernet handoff to their customers, so having a router in front of the Firewall is not always necessary.
With the rise in everything-is-ethernet, it is increasingly common for the ISP hand off to go directly to a firewall.
However, depending on your networking needs and firewall capabilities, a router may be needed / desired to handle typical "routing" loads -- routing protocols, QoS, rate limits, multi-protocol support (eg. DHCPv6, PPP, VLANs), link authentication (802.1x, MACSec, etc.)
In my office, there are two ISPs (with their associated devices) going directly into my group of firewalls. One handles multi-homing perfectly, the other not so well, and the third is only connected to one ISP. On multiple occasions, I've used the ISP router to filter traffic before reaching the firewalls.
(If I were multi-homed using my own address space, I would have to use a head-end router because none of my firewalls can run BGP.)
Note: this apply mostly to small networks. In big company this is a bit more complex.
You are mostly right but it depends on which router we are talking about.
In some corporate settings (common in Europe, not so in US) the ISP place its own router on site. This is the CPE - Customer-premises equipment
So the business firewall is connected directly behind the CPE, which is usually (but not always) a router, then you can have one or several routers behind this firewall.
Note also that very often the firewall is a function on the main router(s).
ISP (CPE) > firewall > router > LAN
As Ron has pointed out, the firewall may not support the WAN link protocol or authentication scheme. Also, if "router" implies SNAT, the firewall doesn't see specific user IPs, just the public IP (pool) which practically defies logging.
ISP (CPE) > router > firewall > LAN
Now the firewall can distinguish end users accessing the Internet, log properly and use granular policies.