PBR hardware support

[branfarm1]

Hi there,

I believe most Cisco routers support PBR at least in the CPU path, but is it safe to assume that most newer hardware also supports PBR in hardware?  Does anyone know of a compatibility sheet that lists hardware PBR support?

Thanks,

Brandon

[Jon Marshall]

Brandon

It depends firstly on whether the router is hardware based or software based. Newer models will not necessarily be hardware based although they may have dedicated hardware modules for VPN encryption etc.

Were there any specifc models you were thinking of ?

Jon

[branfarm1]

Hi Jon,

Thanks for the quick response.

I need an internet edge device that can support up to 400Mbps with PBR, and I've been looking at either a 3925/3945 or a 7201.

[Jon Marshall]

Brandon

As far as i know neither of these routers are hardware based so PBR would be done in software. This isn't necessarily a bad thing as when PBR is done in software the full set of options are supported whereas as Amit mentioned when it is implemented in hardware you only get a subset of the options.

Note also that simply using PBR does not mean your router will get overloaded.

Were there any specific concerns you had ?

Edit - hardware based routers that i know of - 7600, ASRs and i presume the GSR routers.

Jon

[branfarm1]

My main concern is overloading the CPU at high bandwidth and having the router crash or drop traffic. 

And I feel like this is a dumb question... but how do you know if a router is hardware or software based?

[Jon Marshall]

Not a dumb question at all. I assume a router is software based unless i found out otherwise

I know the 7600 is hardware based, the ASRs also and like i said previously presumably the GSRs. I don't have any experience with the ASRs or the GSRs so can't say how their functionality is restricted by it being hardware based, if it is at all.

I don't have any performance figures to hand in terms of PBR and traffic amount. Perhaps Amit could help out but i wouldn't have thought it would overload your router.

Jon

[Amit Aneja]

Brandon,

As Jon mentioned that not all the new routers would support PBR in hardware, infact there are some features in PBR which aren't supported in most advanced hardwares. So, it would really depend on the hardware/software & PBR feature that you are trying to use.

Regards,

Amit

[branfarm1]

Hi Amit,

I am looking for what I assume is vanilla PBR -- just set next hop based on source address.  The purpose of the hardware would be to sit in front of an FWSM and route between two ISPs, where we currently only have one ISP directly connected to FWSM.

[Amit Aneja]

Brandon,

I don't think that you would have an isuse with throughput, all ISR-G2 series routers provide throughput in Gbps, so, they can easily handle 400Mbps.

For PBR, they should be ok with this much traffic. This traffic would be punted to CPU meaning that it won't be handled in CEF (hardware). However, I guess, this should be ok if you aren't policy routing a lot of traffic.

7200 will support PBR in hardware, but I skeptical about the the performance on this box. If i remember correctly, 7200 with NPE-G2 gives close to 170 or 180 Mbps. I am quite sure that this value is not more than 200 Mbps.

I wouldn't go for 7200 for this much traffic. I would certainly choose ISR G2 series.

I would encourage you to check with Cisco presales team as well.

Regards,

Amit Aneja

[Jon Marshall]

Amit

I have a question now

I thought the difference between hardware devices and software devices was that the hardware device has dedicated ASICs for forwarding traffic. So when you say of the ISRs -

This traffic would be punted to CPU meaning that it won't be handled in CEF (hardware).

what do you mean by this. I though CEF was just the forwarding table. Are you saying that the ISR's are hardware based.

Also for the 7200 -

7200 will support PBR in hardware

does this mean the 7200 is hardware based because my understanding was it was a software based architecture.

Jon

[Amit Aneja]

Jon,

Let me correct that...7200 will also NOT support PBR in hardware...that was a typo..

7200 doesn't have the enough hardware to support forwarding in hardware like 7600, 6500 etc.

Again, it's a s/w based architecture.

what I meant for ISR G2 series is that they aren't hardware switching platforms as well. So, traffic won;t be handled in hardware. Rather than that, traffic would be process switched.

Regrads,

Amit

[branfarm1]

Amit,

I also have another question --

When you say the 7201 is limited to 170-180Mbps, the datasheet indicates it can support 2mpps+.  I'm assuming that's with 64byte packets, which equates to about 1Gbps, or did you mean that with PBR it can only support 170-180Mbps?

Similarly, the 3945 datasheet says "enables deployment in high-speed WAN environments with concurrent services enabled up to 350 Mbps."

Brandon

[branfarm1]

I guess the question is, if I only need raw speed, is a router the right choice or should I look at something like a 3750?

[Jon Marshall]

The answer is it depends. For example the 3750 has the following things you may want to consider -

1) it does support PBR but not the full set of options. More importantly if deny statements are included in the PBR acl then those packets are software switched which can have a significant performance hit. Using deny statements in the PBR acls is actually quite common and useful. You can usually rewrite the acl to only have permit statements but it can become quite complicated

2) 3750 switches do not support NAT. Only the 6500 Catalyst switch does. Whereas all routers to my knowledge support NAT.

3) QOS is very different on the 3750 than it is on a router. Because QOS is implemented in hardware you do not get the full functionality of router MQC QOS. Shaping is not really supported on these switches although i believe the 3750 Metro-E switch has better QOS support.

These are some of the most obvious things that spring to mind. If you do consider buying a switch then make sure you have thought about all the functionality you need and then make sure it is supported on the switch.

Jon

[Amit Aneja]

Brandon,

My answer is based upon the testing documents on the platform, It is Max Aggregated Throughput, I agree that this is in ideal situations, but this could very take care of 400Mbps.

I cannot share the complete testing results

Regards,

Amit Aneja