Can you tell me what is the difference between having both a Cisco router and ASA appliance in a network and having only the ASA?

I remember that my ISP had set a router in front of our network and I've set a router and an ASA in transparent mode behind it, so I think if I now set the ASA into router mode and I don't do dynamic routing there's no need to have a router in front of it. Correct?

closed as unclear what you're asking by Chris S Feb 11 '14 at 4:09

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Looking at your comment to the answer of @dcsln you either have to read his answer more carefully or provide a lot more detail on how the network is designed (and what problem you are trying to solve with router/asa placement). – ErikE Feb 6 '14 at 23:02
  • you should determine the reason for the ISP deploying their equipment. Is there some items they are managing etc ? then there is the question of why is there an additional router. the firewall is standard however the router could do that as well for some deployments. my guess is you should discuss the design with the ISP and make sure its optimized. shaun – Shaun Hummel Feb 11 '14 at 4:05

IOS does things that ASA doesn't, and vice versa.

For example:

  • IOS does BGP. ASA does not.
  • IOS has AnyConnect VPN support and an SSL VPN, but the ASA one is substantially better
  • IOS supports IPv6 over PPPoE, but ASA does not (but ASA does support IPv6, just not over PPPoE)
  • ASA can only route a certail volume of bandwidth and has limited connectivity options. IOS supports a lot of different media and typically can route much more efficiently (don't be fooled by the ASA5510's gigabit license; it can still only pass ~200-300Mbps).

It really comes down to your use case. I have just Cisco ASA 5505's at some sites, and just Cisco 887-VA's at some other sites. I'm designing a datacenter that will probably have a Cisco 1700-series router and an ASA5515-X.

You can also both route and firewall with the Cisco Catalyst line of switches, so there's a lot of crossover in their products these days.


A router is mainly better at routing via routing protocols, especially dynamic routing protocols like RIP, OSPF and BGP. Some firewalls will do RIP routing (and occasionally BGP or OSPF), but it's generally discouraged -- you don't want to store an entire internal-network routing table on an external access-control device.

For non-Ethernet services, like T1 or T3 circuits, a router is often necessary to convert from one media type to another.

The router may give you more flexibility if you want to add service from a second ISP.

It's not inherently worse - is there a problem you're trying to solve by removing the router?

  • What is better to have the ASA in front of the router to protect network or the router ? – Ali Mezgani Feb 6 '14 at 22:46
  • @mezgani - router goes in front of the firewall – Mark Henderson Feb 6 '14 at 23:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.