800/1900 router encryption

[Bob Greer]

Hi there,

Thanks for reading. 

I'm wondering what the upper limits as far as bandwidth for tunnel traffic on 800 series routers.  Will they support a 50Mbps circuit connection?

Thanks again,

Bob

[shaps · Accepted solution]

The 800 series would struggle to hit that bandwidth without any of the encryption features turned on.
Hard to get any numbers but I did find this

https://www.cisco.com/c/en/us/products/routers/800-series-routers/models-comparison.html

[balaji.bandi]

if you looking 50MB wan throughput look at the models 4221 (base 35 and with license you can go higher level)

https://www.cisco.com/c/en/us/products/routers/4000-series-integrated-services-routers-isr/models-comparison.html

[Joseph W. Doherty]

Much depends on the actual 800 or 1900 series model, the "nature/attributes" of your 50 Mbps traffic, and your device config.

One of Cisco's whitepapers documents the maximum IPSec performance of an 860, 880 and 890 as 40, 102 and 125 Mbps; and for a 1921 and 1941 as 149 and 170 Mbps (all forgoing using 1400 byte size packets).

Cisco also recommends the 860, 880, 890, 1921 and 1941 for WAN circuits of 4, 8, 15, 15 and 25 Mbps.

[Bob Greer]

Hi Joseph,



Thanks for your feedback. Does that mean the those performances rely on using a smaller MTU than 1400? We typically set our tunnel traffic to 1360. In this case we might be able to take advantage of 50Mbps? Also, do you know where to access these white papers? That will be vital in the business decisions.



Thanks again. And thanks for your help on previous posts too!

[Joseph W. Doherty]

See attached.

[Bob Greer]

Hi Joseph,

Thanks again for the white papers.

Can you estimate the overhead hit of SHA 256 and what that will reduce tunnel performances on 50Mb circuits to?

Thanks again,

Bob

[Joseph W. Doherty]

Doesn't the Cisco white paper have crypto performance for some of the 800 and the 1900 series? SHA (AES) 256 should be in the whitepaper's ballpark.

[Bob Greer]

Hi Joseph,

The throughput testing didn't include hashing.  The Table 2 results had this qualifier:

IPSec throughput is measured using a single tunnel with 1400-byte packets, with no Secure Hash Algorithm (SHA) or Message Digest Algorithm 5 (MD5) authentication.

Thanks again!

Bob

[Joseph W. Doherty]

I suspect it wouldn't add much to the CPU load.