Dynamic routing on firewalls.

Thu Feb 5 19:15:23 UTC 2015

Some Juniper models actually do a very good job of being both.

In reality, a Firewall _IS_ a router, even if it's a bad one. Anything that moves packets from one interface to another is a router. Of course, the support for routing protocols is a useful feature in a router and one of the areas where firewalls often fall short.

Where you want to put things (in front, behind, etc.) really depends on your topology and the problem you are trying to solve.

Personally, I like to keep the firewalls as close to the end hosts as possible. This tends to greatly simplify security policies and make them MUCH easier (and more reliable) to audit.

Owen

> On Feb 5, 2015, at 2:49 PM, Ralph J.Mayer <rmayer at nerd-residenz.de> wrote:
> 
> Hi David,
> 
> a router is a router and a firewall is a firewall.
> 
> Especially a Cisco ASA is no router, period.
> 
> A router in front of the firewall is my choice, it also keeps broadcasts from the firewall + can do uRPF.
> 
> 
> rm