Router or Firewall for S2S VPN

[jsanford]

We are standing up a new data center and there is some disagreement about whether the Firewall or the Router should host the IPSec VPN. 

The Security Team  suggests the Firewall for a few reasons (Logging being the biggest)

while the Networking Team would like to use the Cisco Router (Speed and ease being their reasoning.)

Has anyone run into a similar situation? How would you recommend designing it?

[Raido_Rattameister]

Do you know bandwidth between sites?

Firewall datasheet will reveal it's VPN capabilities.

Compare firewalls page will give you good overview.

https://www.paloaltonetworks.com/products/product-selection

For example 3050 vs 5060 = 500Mbit vs 4Gbit

https://www.paloaltonetworks.com/content/pan/en_US/products/product-comparison.html?chosen=pa-5060,p...

[santonic]

I'd always go for firewall if you have enough resources there. And 'ease of use' argument goes in PA favour imo. Other benefits are security features, logging, traffic control by direction....

In any case; if you go for Cisco router make sure the decrypted traffic passes through your PA.

[BPry]

Really depends on what equipment you are using, as for a S2S I really would just recommend whatever can provide the most bandwidth. Reason being is that you probably have a static IP on all your sites correct? If so then your just as 'secure' running it through the Router with a good ACL as you are with the Firewall and as long as the equipment is on the same 'level' and roughly the same age the Router is always going to win looking at just bandwidth.