| 2.1 |  | General Router and Switch Security |
| 2.1.1 |  | Router topologies |

| The most basic routed network consists of a corporate LAN connected to the Internet using a single perimeter router . This router must secure the corporate, or trusted network from malicious activity originating on the Internet, or an untrusted network. These types of installations are typical of small enterprises.

The perimeter router, being the only line of defense for the network, is relied upon to both authenticate Internet users and prevent as many attacks as possible. The router must also be secured to prevent attacks from the inside.

Medium-sized networks typically employ a firewall appliance behind the perimeter router . In this scenario, the perimeter router now acts as a screening device, passing all packets destined for the corporate network to the firewall for further processing. The firewall, with its additional security features, can perform user authentication as well as more in-depth packet filtering. Firewall installations also make it possible to build a demilitarized zone (DMZ) where servers that are commonly accessed from the Internet are placed.

An alternative to a dedicated firewall appliance is a perimeter router which has integrated firewall capabilities . Although this approach does not provide the same security features and throughput that a dedicated firewall appliance offers, a router with an integrated firewall feature may solve many small-to-medium business perimeter security requirements. Interoperability is greater when using an integrated device versus several stand-alone devices.

Finally, many medium-to-large size enterprises use internal routers along with perimeter, or premises routers and firewall appliances . Internal routers provide even more security to the network by screening traffic to various parts of the protected corporate network.

Sometimes internal routers are replaced by high-end Cisco Catalyst series Layer 2/3/4 switches, which contain their own security features. In fact, many security-specific modules, or blades such as the IDS, Virtual Private Network (VPN), Secure Sockets Layer (SSL), and Firewall modules are available for the Chassis based Catalyst switches.

Figure shows the various routers available for small office/home office (SOHO) to service provider networks.

| Media Activity PhotoZoom: Cisco 1721 Router In this PhotoZoom, students will view a Cisco 1721 router.

| Media Activity PhotoZoom: Cisco 1751 Router In this PhotoZoom, students will view a Cisco 1751 router.