denver218
asked on
Cisco 2911 router for routing, firewall, and VPN
I have a small customer I want to deploy an all in one device for. I have chossen a Cisco 2911 router and I'm not sure what part number I need for a router that will do routing, firewall, and VPN. I see they come with a univeral image. Do I also need to purchase a firewal license? I'm looking at datasheets, but I'm still unclear. Any assistance on what part number I need will be greatly appreciated. Thanks.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Using combined devices might be fine, if not great. In my personal opinion, I dislike using cisco isr routers for firewalling purposes. I've had a few bad experiences where iOS firewalls caused issues with poor performance and log messages about too many OOO packets (out of order). Once an Asa was put in place problem solved.
Now other product lines by companies like juniper might present completely different results, but I don't work with those brands so I can't speak to that.
As to the quote, I only mean to say that a firewall (not a combined device but a straight firewall like an Asa) shouldn't be expected to act as a router with 20 vlans to do internal routing. It might work, but that's not what it was intended for.
Now other product lines by companies like juniper might present completely different results, but I don't work with those brands so I can't speak to that.
As to the quote, I only mean to say that a firewall (not a combined device but a straight firewall like an Asa) shouldn't be expected to act as a router with 20 vlans to do internal routing. It might work, but that's not what it was intended for.
Thanks for the clarification.
From an electrical design perspective, it would be very simple to have the firewall on one circuit board / section and the router function on a separate circuit board / section. They need not interfere.
I have had very good success with Juniper and the same with the Cisco RVxx series. I have not used the other Cisco devices so I cannot comment on those.
... Thinkpads_User
From an electrical design perspective, it would be very simple to have the firewall on one circuit board / section and the router function on a separate circuit board / section. They need not interfere.
I have had very good success with Juniper and the same with the Cisco RVxx series. I have not used the other Cisco devices so I cannot comment on those.
... Thinkpads_User
ASKER
Thanks guys. I will be purchasing the Cisco 2911 with the SEC license. The 2911 comes with three ethernet interfaces, which is what I need. I have two internet circuits, and then a connection to my LAN. This is just a small branch office that has 40 users, and requires only two site-to-site VPN's. I've done this many times with the 2800 series routers. I was just confused on the licensing of the 2900 series, but after doing more research its basically just like the 2800 series. Thanks for all you input.
ASKER
Thanks
@denver218 - Thank you and I was happy to assist. ... Thinkpads_User
The same is true in reverse that a firewall is a firewall and not a router
@rauenpc - I am not entirely sure what you mean. In small and medium businesses, Juniper Netscreen are combined firewall, VPN and router machines as I use them as such at clients. They work very well. My RV042G is aimed at small businesses, I use it myself and it functions well.
... Thinkpads_User