Arie, Thanks for the response. 200Mb is the aggregate bandwidth available on the WAN port at each site. Even if I knew what the typical traffic rates were today, the application group would change something tomorrow, so I have to design for the worst case - 390kpps using 64-byte packets. I phrased the original question the way I did because the specs for the ASA and VAM are written in bits-per-second rather than packets-per-second. In either case, I am curious how close does real world come to the specs?
Thanks, Michael Malitsky -----Original Message----- From: Arie Vayner (avayner) [mailto:[EMAIL PROTECTED] Sent: Tue 8/5/2008 3:51 AM To: Michael Malitsky; [email protected] Subject: RE: [c-nsp] CPE for IPSEC Michael, A few questions: 1. I see you mention 225Mbps, but what is the packet-per-second rate? This is actually a more important factor, as router performance is usually PPS-rate based 2. Is 225M the total hub rate, or is it per spoke? In general, I would suggest getting the HW encryption option (VAM in the 7200 case) as it would provide a more deterministic latency as encryption would be done in dedicated HW. Arie -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Michael Malitsky Sent: Tuesday, August 05, 2008 01:36 AM To: [email protected] Subject: [c-nsp] CPE for IPSEC Greetings, The auditors are trying to force me to encrypt our WAN traffic. The WAN in question is Cogent's ethernet service - built as a mesh of point-to-point VLANs. There are 3 sites, at every site I have a single port over which I receive 2 VLANs in a dot1q trunk. Aggregate bandwidth on the port is 200Mbps. Putting in encryption seems fairly straightforward - 3 static IPSEC tunnels. I am trying to figure out what kind of hardware can handle IPSEC at this bandwidth. So far I am looking at: -ASA5520. Specs say 225Mb of IPSEC - can the box actually handle that, or should I be looking at 5540? -7201 (or 7206) with NPEG2. Do I need to add a VAM, or will the NPE handle the load? Any real-world experiences will be most appreciated. Also, if there are better suggestions (including non-Cisco), please share. Thanks, Michael Malitsky _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
