50Mbps WAN, cisco 892

[tsipoulanis]

Hello everyone,
i have a 50Mbps WAN (internet connection) and i am planning to built a site to site vpn.

is it possible to use the 892 router?

does it support that bandwindth?

when i will have the vpn, does it support also throught the vpn that speed?


Thank you,
Thomas

PS
based on the last picture i see that 890 Series support 15Mbps. is that correct or falsch?
http://www.anticisco.ru/pubs/ISR_G2_Perfomance.pdf

[Leo Laohoo]

does it support that bandwindth?

890 will be able to support 50 Mbps.  This value is computed as one-way traffic (either download or upload but not both) and without any encryption.  

[tsipoulanis]

nice and thanks,
is it possible to send me a link with that values about the ISR models?

best regards,
Thomas

[Leo Laohoo · Accepted solution]

Document attached (below).

[Joseph W. Doherty]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages wha2tsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

I just wanted to mention, the document Leo's provides the 890's minimum packet forwarding rate at 100 Kpps, this is the same value as in the OP's referenced link (see table 1).

Do take careful note of how Leo's reference document "translates" the 100 Kpps to a Mbps rate.

The OP's referenced document also describes the performance of the ISRs in that document "better" than Leo's reference document (this mainly I suspect because Leo's document is an earlier Cisco document).

To the OP's original question, yes Cisco recommends the 890 for up to 15 Mbps (duplex).  Cisco recommendations are conservative, often you can support more bandwidth than the Cisco recommendation.  Much depends on your actual configuration and your actual traffic.

As OP mentions VPN, and table 3 show the maximum best case performance for encrypted traffic is 125 Mbps, I would suspect an 890 would be undersized for a 50 Mbps WAN link.

[Leo Laohoo]

I would suspect an 890 would be undersized for a 50 Mbps WAN link.

I agree, hence, my response was "one-way traffic" and "unencrypted".  My computation would show the 890 would support up to 12.5 Mbps to 15 Mbps of traffic (two-way traffic plus encryption enabled).  

[tsipoulanis]

Hi everyone,

is it possible to configure the router so the router will use the XX% of the internet bandwindth for internet traffic and the rest for the VPN??

why am I asking that? because during the time i download a file or watch a video from internet the CPU goes to 99%.
thats why i would like to help it.

[Joseph W. Doherty]

is it possible to configure the router so the router will use the XX% of the internet bandwindth for internet traffic and the rest for the VPN??

Yes, easy and should work well for traffic TO the Internet.  For traffic FROM, the Internet, somewhat easy too, but generally doesn't work too well.

because during the time i download a file or watch a video from internet the CPU goes to 99%.

Well, for data FROM the Internet, slowing uses CPU too, although perhaps not as much as required to forward the traffic.  I.e. unsure how much CPU you would save.

Further, for something like video, policing its ingress rate, might kill the video, although some video streams will auto move to a video stream that requires less bandwidth.

If you're pegging you CPU on your router, often you need a "faster" router.

[tsipoulanis]

thanks for the quick respond,
at first i want to make it clear, it was only a test when i said about the video.
my goal is clear just to use part of the Internet bandwindth direct to Internet and XX% through the VPN Tunnel Interface.

based on additional research i think the solution below fit to me,
https://supportforums.cisco.com/discussion/10956426/limiting-bandwidth-cisco-router-possible-1800-series
can you please clarify and send me also an other configuration example how to implement that solution?

thank you

[Joseph W. Doherty]

You can attach ingress and egress service polices to your Internet interface.  With those polices, you have class maps, that match traffic of interest, and police the class at a rate you want.  For an egress policy, you can also shape rather than police.

You should also be able to attach an ingress and/or egress service policy to your VPN tunnel interface.  This might make it easier to "match" the tunnel traffic rather than matching it on the physical interface.

One reason I noted limiting traffic FROM the Internet might not be as effective as desired, is because you're downstream of the link you want to manage.  Some traffic might ignore (i.e. not slow) when it detects traffic loss.  Other traffic will slow, but it can still congest the link before the detection of loss packets causes the source to slow its transmission rate.

[Leo Laohoo]

Thanks for taking the time to rate our posts.  :)