Switch vs Router for Multiple WAN IPs

Question

Our ISP provides a /27 block of IPs. I want to assign 5 IP's to one firewall, 1 IP to another firewall for now.

The firewall with 5 IP's will be a Sophos XG - 1 IP will be used for internal network and the other 4 will be assigned to the DMZ. I'm guessing I can do 1:1 NAT for these so each host in the DMZ can have it's own IP natted for services like www, ftp, etc..

My thought was to put something in front of both firewalls to be able to assign the IP space.

ISP -> SWorRTR -> FW1 -> Internal
                      -> DMZ
               -> FW2 -> Service

Would a dumb switch work, or would I need something like a L3 switch? Would using a router be better?

From my understanding routers offer more features, but the routing is slower whereas L3 switch can cache the packets in the route table.

Answer 1

IP address use only for management. It does not affect the switching. Better use of private address and a separate port(or VLAN) for management(more security).

Whether to use a router or a switch at a service provider's edge, it is typically dictated by the manner in which the IP range will be delivered to you.

An address range which the provider gives you with an "upstream gateway", and no routing configuration at your end has to have a layer two connection to the gateway (or simulated as such; cf Proxy ARP) in order for the packets to flow.

When a packet gets to the upstream router, it assumes that the destination address is on the local L2 segment, and will just ARP away for it. That means you need to have a switch (or other L2 network) for all of the consumers of the address space. That doesn't mean everything has to be directly connected, though -- if you place a router at your end and run Proxy ARP on it, you can still do L3 filtering (firewalling) on the traffic before it gets to the destination; you just have a more complicated and hard to debug network environment. Hope this might help!

Answer 2

From my understanding routers offer more features, but the routing is slower whereas L3 switch can cache the packets in the route table.

Correct! Router is used for routing the IP packets between the different L2 networks.(ATM, Ethernet, Serial and so on.) L3 switch is short for L3 Ethernet Switch, which means it only can exchange the Ethernet frames. NAT, IPsec and a lot of features are not supported on the L3 switch.

Would a dumb switch work, or would I need something like a L3 switch? Would using a router be better?

From my point of view, NAT will be more common. Those IP address can be shared by multiple services. Normally, the firewall should be able to configure the PAT to map the internal services to a specific port of the external IP address.

Hope this helps.