ASA 5585-X (ASA5585-SSP-40) maximum SSL VPN throughput

[TommyNilsson0342]

I am not sure where you see the throughput for SSL VPN.

I found that it does not have the same throughput as 3DES/AES IPsec VPN

Here we can se that it got 3Gbps for 3DES/AES IPsec VPN

https://www.cisco.com/c/en/us/products/collateral/security/asa-5500-series-next-generation-firewalls/datasheet-c78-730903.html

[balaji.bandi]

As per my understand it is combined VPN throughput for both.

[Cristian Matei · Accepted solution]

Hi,

   Where have you found that for SSL traffic, performance is different? All ASA platforms have the same performance (in theory and Data Sheet) for both IPsec and SSL, as in the end the data traffic gets encrypted via 3DES or AES for both VPN types. So the encryption performance is just for encryption using those algorithms, regardless of how you end up using it, via SSL or IPsec.

Regards,

Cristian Matei.

[TommyNilsson0342]

So the throughput should then be 3 Gbps?

[Cristian Matei]

Correct.

[jleonhardt]

IPsec and TLS/SSL specs can be somewhat different:

Eg: FPR2110 with FTD image: 365Mbps TLS vs 800Mbps IPsec, per datasheet: https://www.cisco.com/c/en/us/products/collateral/security/firepower-2100-series/datasheet-c78-742473.html

Eg: ASA5516: 285Mbps TLS vs 250Mbps IPsec, per datasheet: https://www.cisco.com/c/en/us/products/collateral/security/asa-firepower-services/datasheet-c78-742475.html

But Cisco seems to leave off the TLS test conditions (Eg: no packet-size info above datasheets), and often doesn't even publish the TLS spec (eg: see the ASA-image info in the above FPR2110 datasheet) (Eg2: see the 5585 datasheet https://www.cisco.com/c/en/us/products/collateral/security/asa-5500-series-next-generation-firewalls/datasheet-c78-730903.html).