Maximizing Firewall Perfo .Etherchannel connection to the switch backplane ‒An external device

  • View
    213

  • Download
    0

Embed Size (px)

Text of Maximizing Firewall Perfo .Etherchannel connection to the switch backplane ‒An...

  • 2012 Cisco and/or its affiliates. All rights reserved.BRKSEC-3021 Cisco Public

    Maximizing Firewall PerformanceBRKSEC-3021

  • 2012 Cisco and/or its affiliates. All rights reserved.BRKSEC-3021 Cisco Public

    Your Speaker

    Andrew Ossipov

    aeo@cisco.com

    Technical Leader7+ years in Cisco TAC

    15+ years in Networking

    3

    mailto:aeo@cisco.com

  • 2012 Cisco and/or its affiliates. All rights reserved.BRKSEC-3021 Cisco Public

    Agenda

    Performance at a Glance

    Firewall Architecture

    Data Link Layer

    Connection Processing

    Transport Protocols

    Application Inspection

    Closing Remarks

    4

  • Performance at a Glance

  • 2012 Cisco and/or its affiliates. All rights reserved.BRKSEC-3021 Cisco Public

    Defining Network Performance

    Throughput

    Bits/sec, packets/sec

    File transfers, backups, database transactions

    Scalability

    New conns/sec, concurrent conns

    Web, mobile users, VPN

    Reliability

    Latency, jitter, packet loss

    Real time applications, voice, video

    6

  • 2012 Cisco and/or its affiliates. All rights reserved.BRKSEC-3021 Cisco Public

    Pyramid of Firewall Resources

    Bytes/sec

    Packets/sec

    Max sessions

    Min latency

    Level of Inspection

    Fast, Good, or Cheap. Pick Two!

    Firewall Resources

    (fixed volume)

    Desired Metrics

    (variable)

    7

  • 2012 Cisco and/or its affiliates. All rights reserved.BRKSEC-3021 Cisco Public

    Testing Performance

    Maximum throughput and scalability with UDP

    Sufficient number of flows for proper load-balancing

    Packet size: maximum for bytes/sec, minimum for packets/sec

    Minimum of features

    Real World profile is most trustworthy

    Single (HTTP) or multi-protocol (weighted mix)

    Traffic patterns of an average network

    8

  • 2012 Cisco and/or its affiliates. All rights reserved.BRKSEC-3021 Cisco Public

    Cisco Firewalls

    ASA 5550 (1.2 Gbps,

    36K conn/s)

    ASA 5580-20 (5-10 Gbps, 90K conn/s)

    ASA 5580-40 (10-20 Gbps, 150K conn/s)

    ASA 5585 SSP20 (7-10 Gbps,

    140K conn/s)

    ASA 5585 SSP40(12-20 Gbps, 240K conn/s)

    ASA 5585 SSP60(20-40 Gbps, 350K conn/s)

    ASA 5585 SSP10(3-4 Gbps,

    65K conn/s)

    TeleworkerBranch

    Office

    Internet

    EdgeData CenterCampus

    FWSM(5.5 Gbps,

    100K conn/s)

    Firewall and VPN

    Service Modules

    MultiserviceASA 5540 (650 Mbps, 25K conn/s)ASA 5520

    (450 Mbps, 12K conn/s)

    ASA 5510 (300 Mbps, 9K conn/s)

    ASA 5505(150 Mbps, 4K conn/s)

    ASA SM(16-20 Gbps, 300K conn/s)

    ASA 5515-X(750 Mbps, 15K conn/s)

    ASA 5525-X(1 Gbps,

    20K conn/s)

    ASA 5545-X(1.5 Gbps, 30K conn/s)

    ASA 5512-X(500 Mbps, 10K conn/s)

    ASA 5555-X(2 Gbps,

    50K conn/sec)

    9

  • 2012 Cisco and/or its affiliates. All rights reserved.BRKSEC-3021 Cisco Public

    Reading Data Sheets

    ASA 5540 ASA5545-X ASA5585 SSP40

    Max Throughput 650Mbps 3Gbps 20Gbps

    Real-World

    Throughput- 1.5Gbps 12Gbps

    Max VPN

    Throughput325Mbps 400Mbps 3Gbps

    64 Byte

    Packets/sec- 900,000 6,000,000

    Max Conns 400,000 750,000 4,000,000

    Max Conns/sec 25,000 30,000 240,000

    IPSEC VPN

    Peers5000 2500 10,000

    Max Interfaces 1xFE + 8x1GE 14x1GE 12x1GE + 8x10GE

    Max > Real-world > VPN

    64 bytes x 8 bits/byte x 6M

    packets/sec = 3.07Gbps

    4,000,000 conns/240,000

    conns/sec = 17 seconds

    3Gbps/10,000 peers =

    300Kbps/peer

    92Gbps >> Max

    10

  • 2012 Cisco and/or its affiliates. All rights reserved.BRKSEC-3021 Cisco Public

    Firewall Capacities

    Interface bound

    Line rate, packet rate, throughput

    Load-balancing matters

    CPU bound

    Conn setup rate, throughput, features

    Back pressure on interfaces and network

    Memory bound

    Maximum conns, policy rules, throughput

    Utilization affects entire system

    Component bound

    Throughput

    External delays beyond firewall

    11

  • Firewall Architecture

  • 2012 Cisco and/or its affiliates. All rights reserved.BRKSEC-3021 Cisco Public

    ASA5505 Block Diagram

    CPU

    Expansion Slot

    IPS SSC

    Crypto

    EngineRAM

    External Switched Ports

    8xFE

    1Gbps

    1Gbps

    Internal Switch

    8x100Mbps

    13

  • 2012 Cisco and/or its affiliates. All rights reserved.BRKSEC-3021 Cisco Public

    ASA5510-5550 Block Diagram

    CPU

    Expansion Slot**

    4GE, AIP, or CSC

    Crypto

    Engine

    Bus 1 Bus 0

    On-board Interfaces

    4x1GE*

    1Gbps

    Management0/0

    FE

    *2xFE+2xGE on ASA5510 with Base license** Fixed 4GE-SSM on ASA5550 only

    RAM

    Internal

    NIC

    External NICs

    4x1Gbps

    14

  • 2012 Cisco and/or its affiliates. All rights reserved.BRKSEC-3021 Cisco Public

    ASA5510-5550 Hardware Highlights

    With a 4GE-SSM, 1Gbps link is shared between 4x1GE ports

    No throughput issue on ASA5510-5540

    On ASA5550, get 1.2Gbps between a 4GE-SSM port and an on-board interface

    On-board interfaces are better for handling high packet rates

    Content Security Card (CSC) may starve other traffic

    File transfers proxied over a dedicated 1GE connection

    1Gbps

    1Gbps

    ?

    15

  • 2012 Cisco and/or its affiliates. All rights reserved.BRKSEC-3021 Cisco Public

    ASA 5500-X Block Diagram

    CPU Complex

    Firewall/IPS

    External Interfaces

    6x1GE

    Crypto

    Engine

    Bus 1 Bus 0

    On-board Interfaces

    6x1GE* or 8x1GE**

    6x1Gbps

    Management0/0

    1GE

    *ASA5512-X and ASA5515-X

    ** ASA5525-X and higher

    RAM

    External NICsExpansion Card

    6x1Gbps* or

    8x1Gbps**

    IPS

    Accelerator**

    16

  • 2012 Cisco and/or its affiliates. All rights reserved.BRKSEC-3021 Cisco Public

    ASA 5500-X Hardware Highlights

    Direct Firewall/IPS integration for higher performance

    Future application expansion

    Switched PCI connectivity to all interfaces

    Management port is only for management

    Shared between Firewall and IPS

    Very low performance

    17

  • 2012 Cisco and/or its affiliates. All rights reserved.BRKSEC-3021 Cisco Public

    ASA5580 Block Diagram

    CPU Complex

    5580-20: 2 CPUs, 4 cores

    5580-40: 4 CPUs, 8 cores

    Crypto

    Engine

    Management

    2x1GE

    I/O Bridge 2 I/O Bridge1

    Slots 7-8 Slots 3-6

    RAM

    18

  • 2012 Cisco and/or its affiliates. All rights reserved.BRKSEC-3021 Cisco Public

    ASA5580 Hardware Highlights

    Multilane PCI Express (PCIe) slots

    Use slots 7, 5, and 8 (x8, 16Gbps) for 10GE cards first

    Use slots 3, 4, and 6 (x4, 8Gbps) for 1GE/10GE cards

    Ensure equal traffic distribution between the I/O bridges

    With only two active 10GE interfaces, use slots 7 and 5

    Keep flows on same I/O bridge with 3+ active 10GE ports

    Place interface pairs on the same card

    Slot 5

    TeG0

    TeG1

    Slot 7

    TeG0

    TeG1

    inside1 inside2

    outside1 outside2

    19

  • 2012 Cisco and/or its affiliates. All rights reserved.BRKSEC-3021 Cisco Public

    Simplified ASA5585 Block Diagram

    CPU Complex

    SSP-10: 1 CPU, 4 cores

    SSP-20: 1 CPU, 8 cores

    SSP-40: 2 CPUs, 16 cores

    SSP-60: 2 CPUs, 24 cores

    Crypto

    Complex

    MAC 1MAC 2

    SSP-40/60

    Switch Fabric

    On-board 10GE

    interfaces*

    Expansion Slot

    SSP

    4x10Gbps

    2x10Gbps

    Management

    2x1GE

    *SSP-20/40/60

    On-board 1GE

    interfaces

    2x10Gbps

    10Gbps 6x10Gbps

    RAM

    20

  • 2012 Cisco and/or its affiliates. All rights reserved.BRKSEC-3021 Cisco Public

    ASA5585 Hardware Highlights

    Scalable high performance architecture

    Flexible connectivity options with minimum restraints

    Hash-based packet load balancing from the fabric to MAC links

    One direction of a conn lands on same MAC link (10Gbps cap)

    Half of MAC links are dedicated to IPS-SSP if present

    1x10Gbps (SSP-10/20) or 2x10Gbps links (SSP-40/60)

    External interfaces share MAC 10GE links with on-board ports

    Only IPS-redirected traffic uses dedicated ports

    Use dedicated interface cards for port expansion

    21

  • 2012 Cisco and/or its affiliates. All rights reserved.BRKSEC-3021 Cisco Public

    Simplified FWSM Block Diagram

    Control Point

    Network

    Processor 3

    Network

    Processor 1

    Switch Backplane

    6x1GE Etherchannel

    3x1Gbps

    Network

    Processor 2

    Rule Memory

    3x1Gbps

    2x1Gbps

    1Gbps1Gbps

    4Gbps

    RAM

    22

  • 2012 Cisco and/or its affiliates. All rights reserved.BRKSEC-3021 Cisco Public

    FWSM Hardware Highlights

    Distributed Network Processor complex

    Fastpath (NP 1 and 2), Session Manager (NP 3), Control Point

    Etherchannel connection to the switch backplane

    An external device with 6x1GE ports for all intents and purposes

    No local packet replication engine for multicast, GRE,

    SPAN Reflector allows Sup to replicate egress packets

    Over 3 FWSMs in a chassis may cap throughput under full load

    23

  • 2012 Cisco and/or its affiliates. All rights reserved.BRKSEC-3021 Cisco Public

    ASA Services Module