The Cost of Security on Cisco Routers
February 22, 1999
|
Related Links
|
SOHO Firewall Routers: ISDN Branch Office Security,
Reviews, January 15, 1998
Catalyst 8510: Cisco Turns Tides,
Sneak Previews, May 15, 1998
Cisco's 2600 Router Says It All With Voice Over IP,
Sneak Previews, June 15, 1998
Cisco Resource Manager Essentials: A Must for Network Management,
Sneak Previews, December 1, 1998
Cisco 1720 Ensures Secure Links,
Sneak Previews, February 8, 1999
|
Other Workshops
this issue
|
Switching On Frame Relay SVCs
By David Willis
|
|
Company Directory
|
|
Browse our directory to get data, starting with a particular company.
|
|
Reader Service
|
|
Allows you to request additional product information from our advertisers.
|
|
Print The Full Article
|
Click Here
|
|
E-mail this URL
|
Click Here
|
|
Buy the Book
|
|
|
By Peter Morrissey
With all the possible security threats lurking on the Internet and within your own network, it seems as though you can't do enough to protect your data and your systems. For starters, you certainly should be scanning for vulnerabilities, hardening your hosts and installing firewalls when necessary. An obvious way to complement these tactics is to provide some additional filtering with ACLs (see "Demystifying Cisco Access Control Lists" at www.networkcomputing.com/907/907ws1.html) and accounting. It's important to keep in mind, however, that when you start adding ACLs, you increase the processing burden on the router. And if your router is overworked, the additional ACLs may be just enough to put it out of commission.
At Syracuse University, we've been using Cisco's IOS (Internetwork Operating Systems) for more than five years and have found that there are concessions that must be made when enabling ACLs on Cisco's enterprise routers, such as the 7500, 7200 and 8510 models. In this article, we'll present some recent findings from some 7200 testing we've performed.
Don't Get Lost in the Process There is nothing mysterious about the way routers forward packets. Packets received on an interface are processed by the main CPU. Each packet is copied into memory and the routing table is consulted to determine the direction to forward the packet. Once the correct route and corresponding interface are chosen, packets are copied out of memory, onto the appropriate network.
Of course, other tasks are involved, such as keeping the routing tables updated, but the forwarding process is performed for every single packet that traverses through the router. In Cisco parlance, the forwarding process is referred to as Process Switching. Cisco is constantly inventing new schemes to improve packet-forwarding performance, and all these schemes have different performance implications, which vary based on whether ACLs are used.
Although the different switching methods employed can be a little confusing, one thing is clear: You would not want to push any traffic through a Cisco router that involves Process Switching. A Cisco 7500 using Process Switching is capable of forwarding only about 10,000 packets per second. Fortunately, Process Switching is rarely employed. Instead, a number of other switching techniques--including Fast Switching, Optimum Switching, Distributed Switching and Cisco Express Forwarding (CEF)--are more commonly used.
|
REPORTS
ANALYTICS
Follow 
