topic Router or Firewall for S2S VPN in General Topics

Router or Firewall for S2S VPN

jsanford — Thu, 15 Dec 2016 21:33:23 GMT

We are standing up a new data center and there is some disagreement about whether the Firewall or the Router should host the IPSec VPN.

The Security Team suggests the Firewall for a few reasons (Logging being the biggest)

while the Networking Team would like to use the Cisco Router (Speed and ease being their reasoning.)

Has anyone run into a similar situation? How would you recommend designing it?

Re: Router or Firewall for S2S VPN

Raido_Rattameister — Thu, 15 Dec 2016 22:20:28 GMT

Do you know bandwidth between sites?

Firewall datasheet will reveal it's VPN capabilities.

Compare firewalls page will give you good overview.

https://www.paloaltonetworks.com/products/product-selection

For example 3050 vs 5060 = 500Mbit vs 4Gbit

https://www.paloaltonetworks.com/content/pan/en_US/products/product-comparison.html?chosen=pa-5060,pa-3050

Re: Router or Firewall for S2S VPN

santonic — Fri, 16 Dec 2016 07:33:57 GMT

I'd always go for firewall if you have enough resources there. And 'ease of use' argument goes in PA favour imo. Other benefits are security features, logging, traffic control by direction....

In any case; if you go for Cisco router make sure the decrypted traffic passes through your PA.

Re: Router or Firewall for S2S VPN

BPry — Fri, 16 Dec 2016 13:50:33 GMT

Really depends on what equipment you are using, as for a S2S I really would just recommend whatever can provide the most bandwidth. Reason being is that you probably have a static IP on all your sites correct? If so then your just as 'secure' running it through the Router with a good ACL as you are with the Firewall and as long as the equipment is on the same 'level' and roughly the same age the Router is always going to win looking at just bandwidth.