Secure Network Analytics : Sizing

[Green2]

Hi Cisco Community,

I’m working on a qualification for a Cisco Secure Network Analytics (Stealthwatch) proposal

At this stage, no production traffic data is available, so deploying flow measurement tools is not possible. I’m looking for a sizing approach or Cisco/partner tool to estimate flow volume (flows/sec) for Stealthwatch during the qualification phase. (not the FPS tool) 

i have as data, the number of applications only, and im proposing with all that cisco switches 

Thank you

[balaji.bandi]

We use the FPS tool, and the estimated flows depend on how the devices are populated on the switches.

I had a large network deployment:

Access Switches: 200–250 FPS per switch.

Distribution/Core Switches: 1000–1,500+ FPS per switch, depending on user density and throughput.

If you like to know the real before buying, you can use Cisco Secure Network Analytics Virtual Edition (this gives you 90days full access to analyse)

[Green2]

Hello, thanks for your answer. I have one more question: I don’t have full visibility on how the switches will be used. My client requested the products listed below, and for SNA they asked for “a license for 20 functional applications in the data center, plus 2 licenses for 10 applications.”

I’m not sure whether I should size the SNA based only on the applications, or also include the underlying hardware and infrastructure in the sizing.

Requested products:

• C9300-48T-A

• C9200-48T-A

• C9200CX-8P-2X2G-E

• C9500-24Y4C-A

• C9606R

• C8200-1N-4T

• FPR1010-NGFW-K9

[balaji.bandi]

To get more accurate information, rather than hitting in the dark, contact a local Cisco partner who can assess the information and provide the correct level of product and license you need. 

[EmeraldBrowning]

I’m facing the same issue here. Getting the same uncertainty around sizing, and in my case we’re estimating for about 22 applications with roughly 35–50 switches in scope, but no actual flow stats at all. It honestly feels like working without an error code or baseline number to anchor the proposal. Not sure whether to size strictly on the ~30 licensed apps or factor in the full infra footprint too.