Home / server / Questions / 90537
Accepted
weismat
Asked: 2009-12-04 00:42:51 +0800 CST

Cisco AS5505 - How reliable is the max-throughput

  • 772

How reliable are the maximum Cisco throughput numbers from their specs?
I am considering to use ASA5505 and I expect a constant load which is around 60-70 % of the specified maximum and peaks around 80-90%.
What is the general perception of the quality of the Cisco firewalls vs the specs? The main firewall task will be to block ports and NAT - no http kind of traffic.

performance

2 Answers

  1. Best Answer

    The general perception is that Cisco doesn't lie about their specs. Having said that, they probably aren't real world specs. On the firewall, there is so much to configure that ANY inspection you do on a packet is going to rob you of throughput. Add the AIP-SSC card for IPS inspection and you're going to bury your firewall.

    With your rough figures, I would bump up to the 5510 or 5520 which have gig interfaces.

    • 3

  2. A single connection (let's say just RAW UDP transfer) will probably push 100% of the throughput.

    I'm more unsure what happens if you have enormous amount of different TCP connections where inspection happens (like http and such). Each inspection takes CPU processing, so a CPU limit could be a issue for you if it's such a busy site.

    I'd do what GregD says, bump up the hardware level a little (or consider a 2U server with pfSense or similar).

    • 0