Solved

Adtran TA612 / SonicWall TZ190 / Cisco Router connection advice

Posted on 2008-10-13
2
727 Views
Last Modified: 2012-05-05
Current network layout is:

DSL Modem -> SonicWall -> Cisco 2950 -> LAN

The DSL modem is in bridge mode and the SonicWall is pulling the current static IP and handling NAT.

We just had out new T1 installed today with an Adtran TA612 handling voice and data. The ISP has given us a class A block with a /29 mask.

I'm wanting to add a Cisco 2621XM in the mix for a couple of reasons. I'd like to move NAT to the Cisco and also I need to throttle the bandwidth so my streaming audio users don't hog it all.

Should I put the Cisco behind or in front of the firewall? Do I assign an address out of my block to each device or use private addresses?

I keep getting my self confused with this many devices connected inline.

Sam
0
Comment
Question by:Indy197902
2 Comments
 
LVL 12

Accepted Solution

by:
hfraser earned 500 total points
ID: 22914789
I always prefer to have the firewall exposed to the Internet (that's what it was designed for) and leave the switches and routers to do those functions without having to worry about low-level IP hacker tactics. In this context, I'd be installing the router behind the firewall.

Since you have been using the firewall for NAT, I presume your address space internally is probably 192.168, or one of the other non-routable address spaces. You know have a routeable address space to play with, but beware of the pitfalls and unforeseen problems that come from re-addressing all the infrastructure you already have. Inevitably, you incur more downtime and hidden problems than expected. So if your environment is anything non-trivial, I would not suggest re-addressing.

There may be an issue, though. If you move NAT to the new router, you need to check first to see if the firewall has any rules based upon IP address. At this time, it sees all the internal address space, but NAT on the router reduce the traffic to a single address. So while you can certainly use the router for traffic shaping, I'd suggest leaving NAT to the firewall.

It's always easier if you have a greenfield site.
0
 

Author Comment

by:Indy197902
ID: 22927322
Ok, I just went ahead and took the router out of the mix and let the firewall face the internet and provide all the NAT. I didn't see any loss of performance on the internet, so I guess we aren't producing enough traffic to overload the firewall.

Thanks for the insight.

Sam
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

I have seen some questions on problems with SSH/telnet access to Cisco routers that may occur despite the fact that from a PC connected to your LAN, Internet connectivity is in place and users can access Internet sites without any issues.  There are…
Imagine you have a shopping list of items you need to get at the grocery store. You have two options: A. Take one trip to the grocery store and get everything you need for the week, or B. Take multiple trips, buying an item at a time, to achieve t…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now