Showing posts with label cisco asa. Show all posts
Showing posts with label cisco asa. Show all posts

Thursday, November 1, 2012

More IPv6 features on Cat6500 and ASA

Cisco published the unified Sup720/Sup2T 15.1SY release which brings features like OSPFv3 IPsec authentication, OSPFv3 VRF-lite, EIGRP IPv6 VRF-lite, RA guard and RADIUS/TACACS+/TFTP over IPv6 to Sup720 and IPv6 PBR in hardware to Sup2T.

For the ASA release 9.0 was made available, which (finally) includes features like DHCPv6 Relay, OSPFv3, Unified ACLs, IPv6 ranges, IPv6 for VPN, NAT64 and IPv6 NAT.

For more see the linked release notes. Also be careful what chassis types are supported by 15.1SY on the Catalyst 6500 if you have a support contract. I can confirm that it does boot on VS-S720-10G in a WS-C6509-NEB-A chassis even though it is not listed, but it is possible that Cisco refuses support for this combination.

Sunday, November 20, 2011

Slots on Cisco ASA 5550

According to the Cisco product description of the ASA 5550 the appliance has a maximal throughput of "up to 1.2 Gbps". It's pretty common for Cisco to measure throughput in interesting ways. Mostly they'll add up RX and TX and mention the combined bandwidth. In this case this means that you're likely to be capped at somewhere around 600 Mbps of bi-directional traffic.

One thing you really have to watch out for, to get more out of that particular appliance, is balancing the traffic across its two slots. You can issue show traffic on the CLI which gives you the current balance at the end of its output. If you're just using one of the two slots and your CPU usage is at 100% you'll experience packet loss despite the fact that there's still some free capacity. It seems that the CPU is blocked too much waiting for the queues to get free at this point, when trying to send back traffic to where it came from. Using both slots the CPU usage went back to 50% which seems much more reasonable.