Sizing MARS

[sumesh_un]

I have a network with

.700+ desktops& IP Phones

.20 odd servers

.14 3560 access switches

.a 6509 core switch

.2 units of ASA5520

.2 units of WLC-4402

.2 clustered UCM and

.2 2821 WAN Routers.

Looking for a localized MARS solution.Which would be the best fit model?

[Farrukh Haroon]

You can get a MARS sizing document from your Cisco Local Account Team

Let us know if that is not an option

Regards

Farrukh

[pmccubbin]

Hi Sumesh,

I would only add to Farrukh's suggestion about contacting a local Cisco representative for the sizing document by asking if you have any idea how many events are currently occurring on your network? Additionally, do you have Netflow turned on?

If you can gain a sense of how many logs are being generated and how many Netflows you currently are seeing then you can better use the MARS sizing document to purchase the right MARS solution.

Hope this helps.

Best,

Paul

[mohsin.khan]

By the way here is some information that may help alot.

i am copying something from Garry's book (violation or copy right ;) ..

Model EPS NfE

MARS-20R 50 1500

MARS-20 500 15,000

MARS-50 1000 30,000

MARS-100e 3000 75,000

MARS-100 5000 150,000

MARS-110r 4500 75,000

MARS-110 7500 150,000

MARS-200 10,000 300,000

MARS-210 15,000 300,000

and regarding the devices

Reporting Device Type Max EPS

Cisco ASA-5520 firewall 10,000

Cisco ASA-5540 firewall 20,000

Cisco PIX 515 firewall 1500

Cisco PIX 535 firewall 15,000

Cisco FWSM 25,000

Windows XP, 2000, 300

Snort IDS 1000

Cisco IPS 1300

Check Point FW-1 3500

Cisco IOS switch 200

Cisco IOS router 300

NetScreen VPN 1000

Cisco VPN-3000 con 500

To get know the exact # of EPS,

Begin with your Internet-facing firewalls. To get a rough idea of the EPS being generated,

select a log file from your firewalls that spans one or more days. Follow these steps to

determine the average EPS from these devices in a 24-hour period:

Step 1 Gather the logs for one or more 24-hour periods.

Step 2 Count the number of lines in the file or files.

Step 3 Divide the number of lines by the number of 24-hour periods the file

contains.

Step 4 Divide this number by 86,400.

The number you get will be the average number of EPS in that 24-hour (or longer) period.