vince anton wrote:
Hi All,
im looking at deploying an ASA cluster and scratching my head in terms of
throughputs.
the data sheet for the 5520 says 450Mbps clear text and 250Mbps encrypted
(vpn)
and for the 5500 its 1.2Gbps clear text and 450Mbps encrypted
whats the rule of thumb for ASA boxes to get real values from the data sheet
values ?
On two ASA 5520 firewalls we see errors on interfaces when traffic gets
near 70Mbps, probably cause by traffic burst. The boxes are used only
for port blocking. No VPN or deep packet inspection, not even for NAT,
so I don't know anything about VPN performance for 5520, or about deep
packet inspection performance either.
Somewhere on the net somebody stated that this is cause by a problematic
hardware design: all the four interfaces shares the same interrupt. I
guess this is why cisco suggested for ASA5550 to use one of the onboard
interfaces for input and one of the extension interfaces for output:
http://tinyurl.com/mxyj63
FW# sh int gi 0/1
Interface GigabitEthernet0/1 "", is up, line protocol is up
Hardware is i82546GB rev03, BW 1000 Mbps, DLY 10 usec
Auto-Duplex(Full-duplex), Auto-Speed(1000 Mbps)
Available but not configured via nameif
MAC address 001b.d5e8.d9d5, MTU not set
IP address unassigned
10920305967 packets input, 8396998405240 bytes, 0 no buffer
Received 15584 broadcasts, 0 runts, 0 giants
148151 input errors, 0 CRC, 0 frame, 148151 overrun, 0 ignored, 0 abort
0 L2 decode drops
11677898365 packets output, 11268008541750 bytes, 288217 underruns
0 output errors, 0 collisions, 0 interface resets
0 late collisions, 0 deferred
0 input reset drops, 0 output reset drops, 0 tx hangs
input queue (curr/max packets): hardware (0/33) software (0/0)
output queue (curr/max packets): hardware (0/255) software (0/0)
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
