I am at a small firm (12 PC on the internal network). We use this network architecture now:
Internet(Modem) --> Router --> Firewall --> Switch -- > Internal Network (clients PCs) | | |- Wifi Router |- DHCP & AD Server |- HTTP file server
The Main server and the clients PCs are (relatively) new (to other components), they were bought in 2005. But the other hardwares are creepy old ones, lot of them is older than 15 year. They became the bottlenecks of the network.
Here I describe all of the components in a short shoot:
- The Router is an old ASUS (Rx3041)
- Firewall is a MS Server 2003 R2 with ISA 2006 installed (now formerly Forefront Threat Management Gateway) Definitely this is the main bottleneck of our network, we need to restart this server more than one per week, because it randomly start to drop allowed connections.
- DHC & AD Server is a MS SVR 2008 R2 and it also operates as an internal file server and internal HTTP server (We run a Redmine issue tracker on it. But not on IIS.)
- Wifi Router is just simply an access point to the internet outside of our firewall for our wireless devices such phones and tablets (but no laptops or computers, which we use for work.)
- HTTP File server is an old laptop, which is out of the firewall too (However we have a rule for it to reach it from internal network, so we use it as a network drive to publish some stuff.
While our programmers work out of office, so we don't have any sensitive information on most of the client PCs except one. Our server store sensitive information too. (source code, our clients information, etc..)
We want to fresh up our network a bit. We plan to use only one router instead of 2 routers and a firewall. It looks like this:
Internet(Modem) --> Router with wifi --> Switch -- > Internal Network (clients PCs) | |- HTTP file server (DMZ maybe?)
We want to use the Asus RT-AC66U router.
I read this great answer from Bill Frank, but that question is three year old and things change fast. Maybe routers evolved enough to be able to secure a network. So my question: is this a viable option? Could a router protect us? Or must we use (still) a hardware firewall to protect our network? (We should, but must we?)
We choose this option because of the matter of money. If I could I setup a new router and place the whole network behind a firewall (on new machine) but management say there is no easy money can be spent for that. Should I fight for a new firewall server? Or the router will be enough?