Cisco ISR 4000 Performance Levels, router shaper

Question

I am trying to understand Cisco ISR 4000 Performance Levels.

In the document ISR 4000, one can read the following paragraph:

It's actually quite simple. The router shaper applies only to traffic on the data plane forwarding CPU, and it applies only to egress traffic leaving the data plane. It doesn’t apply to traffic only traversing the Multi-Gigabit Fabric (MGF).

Can someone explain this in even more simple terms?

For example, given a concrete situation like the following:

• we have an ISR which default performance level is 50 Mbps (like the ISR4321),
• some traffic comes from the Internet at a 100 Mbps download speed,
• some traffic goes out onto the Internet at approximately the same speed (99.07 Mbps),
• some traffic goes through an IPsec ISAKMP VPN between the ISR and another router.

How is the router shaper limitation to 50 Mbps going to impact these traffics?

Which traffic belongs to which category:

• traffic on the data plane forwarding CPU,
• egress traffic leaving the data plane,
• traffic only traversing the Multi-Gigabit Fabric (MGF)?

Thank you for helping me understand.

Best regards.

Answer 1

The 4000 Series routers are all using the Quantumflow Processor from the ASR1000 Series router.

This is a Multi-core CPU with very significant routing capability. This is the only way Cisco can deliver iWAN and NBAR/AVC to branch offices. AVC has the ability to check the classification of traffic based on Layer-4 and higher characteristics, so the traffic can be identified and prioritized for what it is.

You no longer have to just throw all HTTP and HTTPS into DSCP AF21. You can rip Facebook out of AF21 and put it in CS1 where it belongs, even though its encrypted - thanks to AVC. (AVC: https://www.cisco.com/c/en/us/products/routers/avc-control.html)

Obviously, tearing that deeply into packets requires serious CPU power, which is where that Multi-core CPU comes in.

It has so much horsepower they have to rate-limit it in software, which is why after so many years of preferring not to talk about maximum throughput, they are suddenly publishing throughput recommendations for these routers in the public specification sheets.

Can someone explain this in even more simple terms?

Any routable traffic will be capped. The router will even shut down processors to limit the throughput. Also explained in this video: https://www.youtube.com/watch?v=M2yLg1FZRXU (Fast forward to 11:55 for info on shaper limitations)

For example, given a concrete situation like the following:

• we have an ISR which default performance level is 50 Mbps (like the ISR4321),

• some traffic comes from the Internet at a 100 Mbps download speed,

• some traffic goes out onto the Internet at approximately the same speed (99.07 Mbps),

• some traffic goes through an IPsec ISAKMP VPN between the ISR and another router.

How is the router shaper limitation to 50 Mbps going to impact these traffics?

1. Your ingress traffic from the internet of 100 Mbps will not be shaped. But if the traffic will be routed/NATed/etc. the egress will be shaped to 50 Mbps.
2. Your output traffic to the internet of 99.07 Mbps will be shaped to 50 Mbps.
3. Your IPsec VPN will be capped at 50 Mbps egress.

Which traffic belongs to which category:

• traffic on the data plane forwarding CPU,
• egress traffic leaving the data plane,
• traffic only traversing the Multi-Gigabit Fabric (MGF)?

1. Will be shaped to 50 Mbps.
2. Will be shaped to 50 Mbps.
3. Will not be shaped.

Answer 2

I believe you are misinterpreting this statement:

The router shaper applies only to traffic on the data plane forwarding CPU, and it applies only to egress traffic leaving the data plane. It doesn’t apply to traffic only traversing the Multi-Gigabit Fabric (MGF).

to infer that there are three "categories" of packets:

Which traffic belongs to which category:

• traffic on the data plane forwarding CPU
• egress traffic leaving the data plane
• traffic only traversing the Multi-Gigabit Fabric (MGF)?

What the documentation is actually saying is that (a) the shaper only affects packets going out of the router (not packets in the input direction), AND (b) the shaper only kicks in if the packet is being forwarded by a data-plane forwarding CPU (as opposed to being locally forwarded on the MGF).

Look at Figure 2 and Figure 3 in that document. Figure 3 depicts a scenario where the packet is locally forwarded on the MGF and therefore not subjected to the shaper.

Only the data-plane forwarding CPU has the shaper logic (hardware or software, I am not sure), and therefore for the shaper to kick in, the packet has to hit the DP CPU.