[c-nsp] CPE for IPSEC

[Michael Malitsky]

Arie,

Thanks for the response.  200Mb is the aggregate bandwidth available on the WAN port at each site.  Even if I knew what the typical traffic rates were today, the application group would change something tomorrow, so I have to design for the worst case - 390kpps using 64-byte packets.
I phrased the original question the way I did because the specs for the ASA and VAM are written in bits-per-second rather than packets-per-second.  In either case, I am curious how close does real world come to the specs?

Thanks,
Michael Malitsky


-----Original Message-----
From: Arie Vayner (avayner) [mailto:avayner at cisco.com]
Sent: Tue 8/5/2008 3:51 AM
To: Michael Malitsky; cisco-nsp at puck.nether.net
Subject: RE: [c-nsp] CPE for IPSEC
 
Michael,

A few questions:

1. I see you mention 225Mbps, but what is the packet-per-second rate?
This is actually a more important factor, as router performance is
usually PPS-rate based
2. Is 225M the total hub rate, or is it per spoke?

In general, I would suggest getting the HW encryption option (VAM in the
7200 case) as it would provide a more deterministic latency as
encryption would be done in dedicated HW.

Arie

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Michael Malitsky
Sent: Tuesday, August 05, 2008 01:36 AM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] CPE for IPSEC

Greetings,

The auditors are trying to force me to encrypt our WAN traffic.  The WAN
in question is Cogent's ethernet service - built as a mesh of
point-to-point VLANs.  There are 3 sites, at every site I have a single
port over which I receive 2 VLANs in a dot1q trunk.  Aggregate bandwidth
on the port is 200Mbps.  Putting in encryption seems fairly
straightforward - 3 static IPSEC tunnels.  I am trying to figure out
what kind of hardware can handle IPSEC at this bandwidth.  So far I am
looking at:
-ASA5520.  Specs say 225Mb of IPSEC - can the box actually handle that,
or should I be looking at 5540?
-7201 (or 7206) with NPEG2.  Do I need to add a VAM, or will the NPE
handle the load?

Any real-world experiences will be most appreciated.  Also, if there are
better suggestions (including non-Cisco), please share.

Thanks,
Michael Malitsky


_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/