Error - View Single Post - Need firewall recommendation in order to use 2 data circuits provided by ISP

**ps3cheats** · 26-Mar-2007, 12:58 AM

Yes, a router would actually handle it much better with many more options. I would recommend the 2811 model, but only if you take the Adtrans out of the picture.
You have options to load-balance/load-share/failover.
However, I would not consider a router as a firewall. yes, they can have firewall 'features', but they're still routers. Keep the PIX between the router and the LAN
Inbound NAT for internal servers (web) would be the most difficult to handle because you can't NAT 2 different public IP's to the same internal IP. Email is not such an issue because you can use MX records with priority settings.
If it was me, I'd still go with an ASA5510 firewall and keep the isp managed Adtrans. There is some advantage to having the ISP be responsible for everything down to the Ethernet hand-off to you. Since they are both from the same ISP, they can setup BGP to load-balance between them. Then you still only need a good firewall..

26-Mar-2007, 12:58 AM	#2 (permalink)
ps3cheats Fixed Error! Posts: 1,497 Join Date: Mar 2007 Rep Power: 3 IM:	Re: Need firewall recommendation in order to use 2 data circuits provided by ISP Yes, a router would actually handle it much better with many more options. I would recommend the 2811 model, but only if you take the Adtrans out of the picture. You have options to load-balance/load-share/failover. However, I would not consider a router as a firewall. yes, they can have firewall 'features', but they're still routers. Keep the PIX between the router and the LAN Inbound NAT for internal servers (web) would be the most difficult to handle because you can't NAT 2 different public IP's to the same internal IP. Email is not such an issue because you can use MX records with priority settings. If it was me, I'd still go with an ASA5510 firewall and keep the isp managed Adtrans. There is some advantage to having the ISP be responsible for everything down to the Ethernet hand-off to you. Since they are both from the same ISP, they can setup BGP to load-balance between them. Then you still only need a good firewall..