does a router in front of another router need to be as good as or better?

Question

If I have a server that is sitting behind two routers, does the first and foremost router have to be "better" than the one behind it that is connected to the server?

For example, if there was a server, doing whatever, averaging thousands of concurrent connections, and that server is connected to a beefy router (Router A), able to withstand anything, able to handle all those connections no problem. And that router is connected to another router (Router B), which lets say isn't quite as good. It's good, but if we directly connected it to the server it would probably crumble. That router is directly connected to a gateway to the ISP.

So: Server->Router A->Router B->Gateway to ISP

1. Is that setup okay/would it work?
2. Or does Router B need to best Router A or since Router A is the one directly connected to the server it is the only one that needs to be great in terms of hardware?
3. And in general, do routers that sit closer to the gateway need to be the best, or the ones that sit closest to the servers?
4. I have this same question for switches. If a switch upline must be better than one downline (closer to server)?

And if Router B does need to be better than Router A, then in enterprises, if they have Cisco Catalyst 6500 switches attached to each row of servers, then what could they possibly put in front of those to handle multiple Catalyst switches? It appears (an educated guess), that the routers and switches upline don't have to be able to handle the sum of the workloads of everything attached to it. But that's just a guess.

I don't have expert knowledge on routers so I can't say how the workload is handled, hence the question. Thanks to anyone who can shed some light on how this situation is handled!

Update: I think my example may have been too broad. To further specify it, my question is not about bandwidth requirements but the concurrency. I don't know what is involved on the router's part to handle concurrent connections, or which routers would be involved.

The server will hold, lets say 10,000 connections open to one public server outside the gateway. So the server will connect to ONE ip address, on 10,000 different ports, which means it needs to pass through Router A and Router B to get through the gateway.

That being said, will Router B have to be greater than or equal to the power of Router A?

Answer 1

A router needs to be sized for the load it is expected to handle. In our campus network, the big 6500's in the middle of the networks are orders of magnitude more powerful than the router that links us to our ISPs. This is because most of our generated traffic is internal oriented. That border device is shoveling around 500Mb/s, but the backplane on our core routers are handling well above that, and multiple VLANs as well.

Concurrency isn't a terribly big issues so long as the router is just routing packets. Even small routers can handle terribly high concurrency rates. Internal tables are kept for routing, which networks are available on what interfaces, and the ARP table, which hardware devices are visible to each interface. The big 6500's at our core have ARP-tables around 10K in size, where the ISP border router is probably closer to 30 entries.

Once a router starts having to maintain connection-state for either firewall or NAT duties, that greatly increases the CPU and memory requirements for a router. Small home-routers doing FW/NAT can only go so far before the NAT table gets exhausted. Behind our border router is a Cisco ASA firewall, and that DOES have to handle all of our incoming and outgoing connections in memory. I don't know what the average connection-count is, but we're able to consistently do around 450Mb/s with simple web-browsing traffic so it has to be very high.

If we had a second firewall surrounding our server subnets specifically, that firewall wouldn't have to be as beefy as the one at our gateway. The Gateway firewall has to monitor all traffic to the server subnets as well as traffic leaving from all of the internal LANs with end-user generated outgoing connections.

Answer 2

If the traffic will pass through both routers, your traffic will only be able to go as fast as your slower router. Chances are your internet connection will be slower than your router can handle.

Other than that, we can't we answer your question. Which router will do more work? Will the internal one be routing between vlans or subnets in your network? Will the external one be using a routing protocol to share routing tables with your ISP?

For your second question, it depends on how much traffic, how many servers, etc...

Answer 3

1. Yes the setup looks OK - you could also easily replace the word router with firewall.
2. You put the best for the job for where you expect the work to be. Most setups will be better bandwidth inside, and less for the gateway. If the internal network has gigabit, and the DMZ is gigabit, and the gateway is say 100mb; you will put a better router for A and a smaller one for B.
3. this appears to be the same as question 2.
4. Again similar to question 2. You put the best where the largest amount of traffic will be.

If you are going to spend taht much money on large switches, you should spend the moeny on a proper consultant to help you get the most out of your equipment. They can do so much more then good placement of the switches. depending on the options you purchased, the IOS can have major consequences on performance and security.