Zone Based Firewall on ISR Router

venom43212 · ‎07-14-2009

I am contemplating deploying two ISR routers as zone based firewalls. They would have possibly up to four zones on them. I have both 2811s and 3845s and would prefer to use the 2811s as the 3845s have already been ear marked. Does anyone know what type of load this could put on a 2811? One interface and zone would be for an internet facing connection, one interface and zone for a user segment of about 150 people, the other two interfaces and zones would be to segregate specific server segments with no more then 15-20 hosts per segment. Thanks in advance.

Alex Yeung · ‎07-14-2009

Hi,

The IOS FW datasheet has performance numbers for different ISR platforms.

Also, in ISO FW Q&A:

Q. How much memory does Cisco IOS Firewall use?

A. Cisco IOS Firewall consumes roughly 700 bytes per connection for basic inspection. More detailed application inspection will consume more memory: for example, FTP, HTTP and VoIP AIC.

Hope this will give you some ideas.

Alex Yeung