[ale] OT: Firewall purchase

[Bob Toxen]

On Thu, Jul 08, 2004 at 01:02:43PM -0400, Jonathan Rickman wrote:

> > A Pix would never support 50 VPN sessions and probably would 
> > collapse around 5-10.  

> Well that's certainly nice to know. It must have been my imagination working
> in overdrive when I reached out and touched a PIX 515 that was chugging
> right along with over 300 sessions. It probably should have burned my
> fingers to the bone. Heck, it probably melted right after I left. That 506E
> (<$1000.00) that had been handling 18 sessions for over 100 days must have
> been my imagination as well. And you're almost right with your 5-10 number
> in that the 501 is limited to 10, but it pretty much does all 10 without any
> problems. I've seen it on numerous occasions. Heck, I know of a location a
> few miles up the road where a guy has 8 of the little boogers all meshed
> with VPN tunnels, running OSPF just like the original poster wanted to.

> Bob I have a lot of respect for you and your knowledge, but that statement
> was beyond over the top.
Well, if most of those 300 sessions were mostly idle.  Sure, it could
handle it 'cause there's nothing to handle.  If they're all active over
a 100 Mbps network saturating the network, I rather doubt that a <$1000
unit can do the VPN.  There simply isn't the CPU horsepower for it as
it would take on the order of 15 GHz of Pentium-class processing according
to my MEASUREMENTS.

While my measurements was on Linux equipment, it was my client that
reported that a Pix (515, I think) that choked on 5-10 sessions pushing
data over a 3 Mbps pipe and needed a Cisco accelerator to get decent
performance.  If you did better then great.

> --
> Jonathan
Bob