VPN: Better emplacement 3660 or PIX 515?

[pavelalex]

Hi!

Our company planning to delploy a corporate network over public internet with Cisco 1720 and 805 with 3DES IOS options in remote offices and Cisco 3660 and PIX 515 in center. Each brance (20 total) will be connected with 64/128Kb channel and 1Mb for central office.

Please, advice the better position for VPN emplacement in center: Cisco 3660 or PIX 515? Solution with 3DES for PIX seems to be lower in price.

Is required VPN accelerator card for 3660 or PIX 515 for 1Mb 3DES flow?

[j-block]

The great thing about the PIX 515 is that it would also give you great firewalling performance, but it might not be the best model for 20 branch offices. Even the 3600 with the VPN accelerator might be a little light for your needs. I’d suggest getting your Cisco design engineer to help you determine what’s the best for your needs.

[pavelalex]

Thanx for attention.

I don't have any information about VPN throughput in PIX 515 and 3660 without VPN acelerator. I found somewhere in Cisco site, what PIX 506 can serve 4Mb 3DES and up to 10 tunnels. PIX 515 must be more productive. 3DES license for PIX 515 cost 1K$

3DES for 3660 need around 9K$ (IOS + DRAM upgrade + flash upgrade + VPN card).

> I’d suggest getting your Cisco design engineer to help you determine what’s the best for your needs

I try already all nearest possibilities, this was the final option:-(

[krisg]

Hello,

I designed and manage my companies WAN. We have 40+ international offices all run with Frame and VPN to each site. One questions I have is would you be using the PIX515 as a firewall also? If so I definetly don't recommend consolidating VPN and Firewall on the PIX, I have seen many bugs with this setup. We use a 7120 w/ISA in our 3 Hub Centers for a somewhat meshed network.

The 3660 w/ISA will definitely be able to handle the 20 tunnels with 1Mb of total traffic. This configuration will cost a little more, but if reliability is of top concern, this will provide it. My company and myself have been extremely happy with the setup of our WAN, and we are able to save extreme amounts of money by sending traffic that is not latency concerned over the VPN.