Internet Router and Firewall

[miked554]

When installing for example a new site, why is it necessary to have an internet facing router?

Why can you not connect the ISP connection directly to the Firewall for example?

Is it simply best practice or is there a fundamental reason?

Thanks.

 

[burtsbees]

You can, if the firewall is a routing device as well. To separate your private network from the outside internet (public), you need a router, or, for example, a Cisco PIX firewall, which also serves as a router.

Burt

 

[Robroy2003]

Agreed. A few years ago, everyone had a router then the firewall. The main reason for that was, most of the internet connections were BRI, T1, or fractional T1. You typically needed something other than a firewall to terminate the internet connection to. Now, that same router could have been used as a firewall as well, just not as good of a firewall. Eventually, Cisco and other router manufacturers started adding firewall feature sets to their routers for the added functionality of the better firewall.

 

[miked554]

So connecting the ethernet terminated ISP connection directly in to a Cisco PIX would now be common practice?

 

[Robroy2003]

That is correct. If you have an ethernet handoff from your isp, direct termination to a Pix Firewall would be common practice

Mark Spencer

 

[miked554]

Okay understood.

But just one more question. In my last place of work the ISP connection handed off to an internet routers outside interface on 1 Telco IP address range and our Public address pool was then behind that and assigned on the inside interface of the Router and the outside of the firewall.

ie..

TELCO
23.4.77.89
23.4.77.90
INTERNET ROUTER
63.3.45.7 (public addresses)
63.3.45.8 (public addresses)
FIREWALL
172.16.1.1

Is this kind of setup normal? And if so how could you connect this directly in to a firewall? In other words where would you assign the public address if the Outside interface of the firewall is directly connected to the ISP?

Sorry for the confused message I hope you can decipher what I am trying to get across.

Thanks.