Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How reliable are the maximum Cisco throughput numbers from their specs?
I am considering to use ASA5505 and I expect a constant load which is around 60-70 % of the specified maximum and peaks around 80-90%.
What is the general perception of the quality of the Cisco firewalls vs the specs? The main firewall task will be to block ports and NAT - no http kind of traffic.

share|improve this question
Are you by any chance referring to the ASA 5505, which is a firewall, and not a router? – gekkz Dec 3 '09 at 13:27
Yes - exactly this model. – weismat Dec 3 '09 at 14:03
What are you doing to have that much traffic? If this is between two offices of the same company it sounds like a possible good place for WAN optimization. – sparks Dec 3 '09 at 16:45
up vote 3 down vote accepted

The general perception is that Cisco doesn't lie about their specs. Having said that, they probably aren't real world specs. On the firewall, there is so much to configure that ANY inspection you do on a packet is going to rob you of throughput. Add the AIP-SSC card for IPS inspection and you're going to bury your firewall.

With your rough figures, I would bump up to the 5510 or 5520 which have gig interfaces.

share|improve this answer
+1 on bumping to the next model, if you are planning for 60-70% capacity to start with .. you're doing it wrong. that is normally the time you start to look to upgrade your current solution. – Zypher Dec 3 '09 at 16:17

A single connection (let's say just RAW UDP transfer) will probably push 100% of the throughput.

I'm more unsure what happens if you have enormous amount of different TCP connections where inspection happens (like http and such). Each inspection takes CPU processing, so a CPU limit could be a issue for you if it's such a busy site.

I'd do what GregD says, bump up the hardware level a little (or consider a 2U server with pfSense or similar).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.