?
Solved

move from onsite firewall to hosted mpls?

Posted on 2015-02-04
10
Medium Priority
?
88 Views
Last Modified: 2015-02-09
were using managed firewalls at present, and to be frank, had major issues routing between the site for the 2x vlans that we have.
im thinking of ditching this method, spending more and moving the firewalls in the cloud as a hosted service.

can someone confirm the very basics of this and what the impact is/could be?  we use voip and have L3 switches in each site as the local gateway.

thanks
0
Comment
Question by:CHI-LTD
  • 5
  • 5
10 Comments
 
LVL 28

Assisted Solution

by:asavener
asavener earned 1500 total points
ID: 40589344
Are you using the firewalls to protect the sites from each other?

Alternately, are the firewalls involved in routing the traffic?  If the firewall is set up as your default gateway, then it can cause problems due to asymmetric routing.  Basically, the firewall is a security device first, and a router second.  If it doesn't see the full three-way TCP handshake, it will drop traffic.
0
 
LVL 1

Author Comment

by:CHI-LTD
ID: 40590686
no the firewalls are protecting the LANs from unwanted external traffic.

the firewalls are set on the l3 switch as the default gateway.  hosts internally are gatewaying through the l3 switch.
0
 
LVL 28

Expert Comment

by:asavener
ID: 40590985
Dunno why moving the firewalls would affect routed traffic behind them, then.
0
The IT Degree for Career Advancement

Earn your B.S. in Network Operations and Security and become a network and IT security expert. This WGU degree program curriculum was designed with tech-savvy, self-motivated students in mind – allowing you to use your technical expertise, to address real-world business problems.

 
LVL 1

Author Comment

by:CHI-LTD
ID: 40591086
well there must be a way of simplifying the routing of traffic, if my supplier simply is inadequate.
were using cisco asa 5505s and id assume this device is capable of routing traffic from-to multiple networks and vlans?
0
 
LVL 28

Accepted Solution

by:
asavener earned 1500 total points
ID: 40591520
The ASA should be an edge device, not a core device.  No inside-to-inside traffic should hit the ASA at all.

Your Layer3 switch should do all of the heavy-duty routing.
0
 
LVL 1

Author Comment

by:CHI-LTD
ID: 40591560
even across a vpn?
0
 
LVL 28

Expert Comment

by:asavener
ID: 40591587
Since VPNs connect at the edge, then yes VPN traffic will go through the ASA.  It's not exactly routing, though.  It's the crypto engine on the ASA that handles the traffic.

You might try adding this command:  sysopt connection tcpmss 1300
0
 
LVL 1

Author Comment

by:CHI-LTD
ID: 40593671
thanks, not sure what that command does.
in any case they seem to have got the routing working ok between the 2 sites, but now not routing to the www...
0
 
LVL 28

Expert Comment

by:asavener
ID: 40594710
That command sets all TCP sessions to use a maximum segment size of 1300 (basically similar to reducing the MTU size, but only for TCP packets).  It forces the packet size down so that the encapsulation for the VPN won't cause packets to be fragmented.
0
 
LVL 1

Author Comment

by:CHI-LTD
ID: 40597992
here is what the problem was:

 VLAN20 to internet: missing VLAN20 on nat rule , it only had local lan to internet.

VLAN20 to VLAN20 - had gone down all rules with 192.168.2.0 and added
192.168.200.0

VLAN20 was missing off site a end of the VPN.
0

Featured Post

Exciting career futures for women in IT

Education has the power to transform lives and open the door to new career opportunities. By earning an IT degree from WGU, you can become a highly skilled IT professional. Get the credentials and certifications you need to become a leader in this rewarding field.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Considering cloud tradeoffs and determining the right mix for your organization.
In this article, the configuration steps in Zabbix to monitor devices via SNMP will be discussed with some real examples on Cisco Router/Switch, Catalyst Switch, NAS Synology device.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question