Take the 2-minute tour ×
Network Engineering Stack Exchange is a question and answer site for network engineers. It's 100% free, no registration required.

As part of a new project, we have a requirement to terminate about 3000 IPsec connections on a Cisco ASA 5540 firewall. According to the specs, the maximum IPsec Peers this platform supports is 5000 so there shouldn't be a problem.

The question is what happens if if ALL 3000 remote sites try to establish the IPsec connection at once ? For example if the upstream switch(es) die. It might not be all at once but depending on timers, it could be within a very small window , maybe 10 seconds or so. Will the ASA cope with all the incoming connections, resource wise ? What's the worst that can happen ?

I understand that thresholds for threat detection might have to be adjusted. The ASA won't do much besides terminating the IPsec connections. There will be no NAT, no inspection. It will participate in OSPF on the LAN side, all remote site networks will be summarized though.

share|improve this question
add comment

1 Answer 1

In our HQ's DC, we have a dual 100 Mbps Internet Gateway Router (that's our bottle neck for the WAN). We've had 500-700 sites connect back after an outage at once with no issue - easily sustaining 2800 locations full time. The spec's say it can support 5000 total, just make sure you order the right Memory + CPU specs as well, more memory than anything else.

Your bottle neck will be your WAN connection from my experience.

share|improve this answer
    
Were the sites terminated on your router or on a Cisco ASA ? A router might react different than an ASA, the software is different. And regardless of that, do you know how much bandwidth those 500-700 sites used when they connected all at once ? –  Stefan Radovanovici May 20 '13 at 18:11
2  
Stefan- WAN Edge --- Checkpoint Firewall --- ASA 5540 SHA-AES-256, per Solar Winds NPM, the 2 minutes averages 10.9 Mbps Ingress and 11.2 Mbps Egress. –  AjNetEng May 20 '13 at 18:23
    
That is excellent info, thanks. I can extrapolate the bandwidth spike for 3000 sites. Have you by any chance monitored the ASA CPU spike for those 2 minutes ? –  Stefan Radovanovici May 20 '13 at 19:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.