CBAC and MSFC2

[darin.pesnell]

Has anyone used CBAC with the MSFC2? Can anyone tell me what kind of performance they've experienced with this?

I'm interested in providing stateful filtering to sites that are connected by 100MB/S. I'm guessing this will overload CBAC and external PIX's (or FWSMs) will be required.

Thanks for the help,

Darin

[drolemc]

I was wondering what CBAC is doing in your network when you seem to have PIX firewalls deployed. As far as CBAC goes, what you really should be asking is what else is the MSFC doing? CBAC by itself should not pose a problem for the MSFC.

[darin.pesnell]

I'm not going to use CBAC + FWSM's or PIX's. We have serveral sites that will be connected to an untrusted backbone at 100mb/s and I am trying to determine if CBAC on the MSFC will be able to support this. From my lab tests using harpoon (throughput testing software), it doesn't look like the MSFC2 will be able to support this. The lab MSFC2 is doing basically nothing other than CBAC between two interfaces and is at roughly 40% cpu utilization when only 20mb/s of TCP traffic (over many flows) is passing through.