Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I have a server that is sitting behind two routers, does the first and foremost router have to be "better" than the one behind it that is connected to the server?

For example, if there was a server, doing whatever, averaging thousands of concurrent connections, and that server is connected to a beefy router (Router A), able to withstand anything, able to handle all those connections no problem. And that router is connected to another router (Router B), which lets say isn't quite as good. It's good, but if we directly connected it to the server it would probably crumble. That router is directly connected to a gateway to the ISP.

So: Server->Router A->Router B->Gateway to ISP

  1. Is that setup okay/would it work?
  2. Or does Router B need to best Router A or since Router A is the one directly connected to the server it is the only one that needs to be great in terms of hardware?
  3. And in general, do routers that sit closer to the gateway need to be the best, or the ones that sit closest to the servers?
  4. I have this same question for switches. If a switch upline must be better than one downline (closer to server)?

And if Router B does need to be better than Router A, then in enterprises, if they have Cisco Catalyst 6500 switches attached to each row of servers, then what could they possibly put in front of those to handle multiple Catalyst switches? It appears (an educated guess), that the routers and switches upline don't have to be able to handle the sum of the workloads of everything attached to it. But that's just a guess.

I don't have expert knowledge on routers so I can't say how the workload is handled, hence the question. Thanks to anyone who can shed some light on how this situation is handled!

Update: I think my example may have been too broad. To further specify it, my question is not about bandwidth requirements but the concurrency. I don't know what is involved on the router's part to handle concurrent connections, or which routers would be involved.

The server will hold, lets say 10,000 connections open to one public server outside the gateway. So the server will connect to ONE ip address, on 10,000 different ports, which means it needs to pass through Router A and Router B to get through the gateway.

That being said, will Router B have to be greater than or equal to the power of Router A?

share|improve this question
where you put the word "router", do you mean router or firewall? – cwheeler33 Jan 20 '11 at 2:29
@cwheeler33 I don't think I mean firewall, although the router will have a firewall in it. I updated my question with a more specific example. Maybe it will help you understand my question better. Thanks – casey Jan 20 '11 at 5:18
up vote 11 down vote accepted

A router needs to be sized for the load it is expected to handle. In our campus network, the big 6500's in the middle of the networks are orders of magnitude more powerful than the router that links us to our ISPs. This is because most of our generated traffic is internal oriented. That border device is shoveling around 500Mb/s, but the backplane on our core routers are handling well above that, and multiple VLANs as well.

Concurrency isn't a terribly big issues so long as the router is just routing packets. Even small routers can handle terribly high concurrency rates. Internal tables are kept for routing, which networks are available on what interfaces, and the ARP table, which hardware devices are visible to each interface. The big 6500's at our core have ARP-tables around 10K in size, where the ISP border router is probably closer to 30 entries.

Once a router starts having to maintain connection-state for either firewall or NAT duties, that greatly increases the CPU and memory requirements for a router. Small home-routers doing FW/NAT can only go so far before the NAT table gets exhausted. Behind our border router is a Cisco ASA firewall, and that DOES have to handle all of our incoming and outgoing connections in memory. I don't know what the average connection-count is, but we're able to consistently do around 450Mb/s with simple web-browsing traffic so it has to be very high.

If we had a second firewall surrounding our server subnets specifically, that firewall wouldn't have to be as beefy as the one at our gateway. The Gateway firewall has to monitor all traffic to the server subnets as well as traffic leaving from all of the internal LANs with end-user generated outgoing connections.

share|improve this answer
That's interesting. But in the case of concurrent connections, if they are open from the server to the ISP, then based on what you just said, both of the routers in my example would have to be good enough to handle that amount of concurrency, would that be correct? It seemed plausible to me (who knows nothing) that only the nearest router would need to be able to handle the concurrency since it is the one holding the NAT and ARP entries (could be wrong there, don't know much about that either). Thanks for your input. – casey Jan 20 '11 at 2:21
@Casey My perspective is skewed since we don't use NAT. Having a /16 means we don't need to worry about NAT table sizes. ARP entries only matter for the number of hardware addresses visible to a router, and for a border router that could be a few as 30, whereas our big core routers are up near 10K. – sysadmin1138 Jan 20 '11 at 2:32
Ah ok. If it makes any difference I updated my question with a more specific example. Thanks for your help – casey Jan 20 '11 at 5:20
Great, that sounds like an answer. So the limitation isn't really the router, it is the firewall. And if there are multiple firewalls, then in my example, the one closest to the gateway would have to be better than or equal to that one closer to the server (if there was one) if all the traffic was between it and a public server outside the gateway. Thanks! – casey Jan 20 '11 at 15:26

If the traffic will pass through both routers, your traffic will only be able to go as fast as your slower router. Chances are your internet connection will be slower than your router can handle.

Other than that, we can't we answer your question. Which router will do more work? Will the internal one be routing between vlans or subnets in your network? Will the external one be using a routing protocol to share routing tables with your ISP?

For your second question, it depends on how much traffic, how many servers, etc...

share|improve this answer
In my example, just one server. I wasn't really asking for bandwidth reason, I was curious purely about the concurrent connections. I have seen some home routers crumble around 1,000. Obviously, there's better one that handle many times that amount. – casey Jan 20 '11 at 2:15
@casey I just realized... are you talking about NAT capacity here? – sysadmin1138 Jan 20 '11 at 2:30
@sysadmin1138 I might be, I'm not sure. I know that I would be if all my connections were to different IP addresses, but all of the connections are to the same ip, which means many ports. I don't know if each port counts as an entry in the NAT table or just ip address. I updated my question with a clarified example, it may help you understand what I mean. – casey Jan 20 '11 at 5:22
  1. Yes the setup looks OK - you could also easily replace the word router with firewall.
  2. You put the best for the job for where you expect the work to be. Most setups will be better bandwidth inside, and less for the gateway. If the internal network has gigabit, and the DMZ is gigabit, and the gateway is say 100mb; you will put a better router for A and a smaller one for B.
  3. this appears to be the same as question 2.
  4. Again similar to question 2. You put the best where the largest amount of traffic will be.

If you are going to spend taht much money on large switches, you should spend the moeny on a proper consultant to help you get the most out of your equipment. They can do so much more then good placement of the switches. depending on the options you purchased, the IOS can have major consequences on performance and security.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.