Central site. WAN edge replace 2851 to .....?

MaximBudyonny · ‎07-02-2007

Hi.

Company plans to increase number of remote branches from 10 to 50. So, 2851 wouldn't be enough to perform simultaneous encryption, QoS and routing.

Now I use such scheme

Provider's net--L2 SWITCH--Eth Trunk--My2851--ASA---LAN

Each remote branch enters central site as a separate 802.1q VLAN on the Ethernet trunk.

So, on 2851 I have a lot of Gi 0/0.VLAN ID interfaces.

2851 is crypto tunnels endpoint and OSPF router.

Each interface has crypto map and policy map. Off course policy map depends on a bandwidth.

I'm planning to replace 2851 with more powerful device.

New device have to:

1. Accept VLANs.

2. Support crypto map on each VLAN.

3. Support QoS (CBWFQ+Shaping) on each VLAN.

4. Have enough performance.

I think that 7600 router or 6500 switch will be a good choice.

May be somebody have had similar experience?

paolo bevilacqua · ‎07-02-2007

Wait a moment before replacing the 2851. It as a vpn module on board that would support 66 mpbs of encryption with 3DES or AES. Or 130 with an additional AIM:

http://cisco.com/en/US/products/ps6635/prod_brochure09186a00801f0a72.html

Note the AIM for IPSec on the 2851 would be:

AIM-VPN/EPII-PLUS

After that you can consider a 3845 again with AIM, or a 7201 with the newer encryption adapters.

Hope this helps, please rate post if it does!

MaximBudyonny · ‎07-02-2007

Thank you for reply.

I had seen this table. I have some doubt about the realistic of stated crypto throughput.

New router also must perform QoS.

Some QoS rules matches not only DSCP, but layer 4 ports!

I need to check it the test environment.

As to 7200. I think that this routers were created not for my connection scheme but for ATM and so on.

I've seen Cisco document (sorry now I can't find it again) that there are some limitations in applying crypto and Qos on GigEthernet subinterfaces (gi x/y.vlan id) on 7200.

Off course, I can create GRE tunnel for each VLAN and apply crypto map and QoS on it but I think it will add unwanted overhead.

So, what will be the best device to replace 2851? :-)

paolo bevilacqua · ‎07-02-2007

Hi Maxim,

the 7200 was not created for ATM. In fact, it supports the widest variety of interfaces and services in the industry. The newest processor, NPE-G2 is the fastest software-based router existing on the market.

If there is something that can do software-based QoS at gigabit speeds, it's the 7200 with NPE-g1 or G2.

After that, there are hardware-based layer-3 switching boxes like the 6500 and 7600 (that are exactly the same product under different name and marketing). The cost is much, much higher and so the complexity. Then sometime, unexpected limitation pops up because the hardware doesn't support all the features you are used to have in software-based IOS.

In all honesty, if price is not a concern, I would a use 7201-G2 with either the crypto PA SA-VAM2+, or the newest crypto module adapter that is the maximum performance in the industry for a reasonable price, C7200-VSA (900 Mbps encrypted throughput).

The 38x5 are something in the middle, again you may consider them for a more reduced budget, yet very capable design.

Hope this helps, pleas rate post if it does!