10

As part of a new project, we have a requirement to terminate about 3000 IPsec connections on a Cisco ASA 5540 firewall. According to the specs, the maximum IPsec Peers this platform supports is 5000 so there shouldn't be a problem.

The question is what happens if if ALL 3000 remote sites try to establish the IPsec connection at once ? For example if the upstream switch(es) die. It might not be all at once but depending on timers, it could be within a very small window , maybe 10 seconds or so. Will the ASA cope with all the incoming connections, resource wise ? What's the worst that can happen ?

I understand that thresholds for threat detection might have to be adjusted. The ASA won't do much besides terminating the IPsec connections. There will be no NAT, no inspection. It will participate in OSPF on the LAN side, all remote site networks will be summarized though.

Improve this question
0

2 Answers 2

Reset to default
7

In our HQ's DC, we have a dual 100 Mbps Internet Gateway Router (that's our bottle neck for the WAN). We've had 500-700 sites connect back after an outage at once with no issue - easily sustaining 2800 locations full time. The spec's say it can support 5000 total, just make sure you order the right Memory + CPU specs as well, more memory than anything else.

Your bottle neck will be your WAN connection from my experience.

Improve this answer
3
  • Were the sites terminated on your router or on a Cisco ASA ? A router might react different than an ASA, the software is different. And regardless of that, do you know how much bandwidth those 500-700 sites used when they connected all at once ?
    – Stefan Radovanovici
    Commented May 20, 2013 at 18:11
  • 2
    Stefan- WAN Edge --- Checkpoint Firewall --- ASA 5540 SHA-AES-256, per Solar Winds NPM, the 2 minutes averages 10.9 Mbps Ingress and 11.2 Mbps Egress.
    – AjNetEng
    Commented May 20, 2013 at 18:23
  • That is excellent info, thanks. I can extrapolate the bandwidth spike for 3000 sites. Have you by any chance monitored the ASA CPU spike for those 2 minutes ?
    – Stefan Radovanovici
    Commented May 20, 2013 at 19:08
1

It turns out that the ASA can support all incoming connections without issue. It takes a while, as it can't process all of them at the same time, but eventually all remotes connect.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.