can consumer grade router push gigabit traffic in a router on a stick config

Reply to topic
15 posts
As of right now I'm doing a complete rebuild of our home lan I will be putting in a esxi cluster and also going with a dedicated storage server for iscsi. The network will be broken out into vlans the only problem is I have layer 2 switches so I need a router/firewall that can push traffic . So I must ask what router out there be it consumer grade that can route gigabit traffic? I know that I can install Pfsense, Monowall,Vyatta however I want a device that I can stick in my network closet I really do not want to use a computer. has performance reviews for that kind of thing. Last I looked, the answer is 'not really'.

You want a layer 3 switch anyway, but a real gigabit capable layer 3 switch is still pretty pricy for home.

Even then you don't really need to route at gigabit speeds. You need you have gigabit (or better, like LACP with gigabit) between hosts on the layer 2 network. Put all your iSCSI interfaces in one layer 2 network and they can go at wire speed if your switch is decent.

For things like management interfaces, put them all in one layer 2 network as well and make sure they have internet access for updates or whatever.

Then put all your 'LAN' interfaces in a layer 2 network with all your physical hosts or LAN client machines and make it so they can all get to the internet too.

Or you can get the layer 3 switch.
I see your point I kind of knew in the back of my head that a consumer router would not be able to do this. Anyway I have an extra core 2 duo Optiplex 755 with 8 gig of ram sitting in a corner I will install One of the firewalls I mentioned on it maybe I will try Vyatte if not I will just stick with Pfsense. BTW you are correct L3 switches for the home are expensive right now I have two manged layer two switches a 16 port Dell 2816 and an 8 port HP 1800 - 8g. Also I actually had planned to use LACP and to devide everything out into vlans thanks for all the info. BTW have you used Vyatte
The answer is no, for any tcp connection.
Why not put your router on the ESX box itself? :devious:

I just pushed 700mbits with IPerf through my OpenBSD router running on ESXi 5

I have my cable modem and my VM outside interfaces (+ASA outside interfaces) on one VLAN and then inside hosts and DMZ hosts on a couple other VLANs.
What type of ASA do you I would like to know the user limit and if you have SSL VPN?
I have a 50 user ASA with a base license which gives you access to 2 SSL VPN connections. The same is true for the 10 and unlimited user as well. If you want DMZs you need the Security Plus bundle. More SSL VPN connection licenses can be bought as well.
I'm curious in knowing what the cost for an ASA with the security plus bundle?
Google shopping prices are pretty accurate for the bundle since you wouldn't be buying from any kind of VAR relationship.
ASA5505 doesnt have a snowballs chance in hell of passing more than 150 megs though...

thats about the only option under $1k

The fortinet options will get close to Gig under $1k for Firewall only
You would need to get a cisco ASA 5510 to begin coming close to Gigabit speeds with is ~$2k used. I have used PFSense with some success virtually and physically.

That's more than I would ever spend I'm most likely going with Pfsense. BTW can you elaborate on this "I have used PFSense with some success virtually and physically". BTW I've never installed a virtual firewall I normally just dedicate a box to it also it's always fun listening to the security guys argue against and for virtual firewalls.
That's true (the new X models are closer to gig speeds and basically replace the old models at the same price point, almost) but again, you generally shouldn't firewall off stuff that needs to talk to each other a lot (not in a home network or even a small business usually).

Using a VLAN to segment your iSCSI traffic is great, same for other purpose-specific network segments. However, the iSCSI network has no need to talk to the internet or to the LAN (where your client machines are) for 99.99% of the time if not 100%. So you don't need to worry about layer 3 performance or whatever for that. Your SAN should have a management interface that you would put in the same network as you other management stuff or even your LAN if you are in a small enough environment. That interface needs internet access, and LAN access, but again, not at super high speeds. At most you might download some firmware there now and then.

Your high speed needs are between the SAN iSCSI ports and the host machines that will mount the iSCSI LUNs. As long as those are on a common layer 2 network, there is no firewall or layer 3 choke point between them so gateway performance doesn't matter.

Speed between the host machines LAN interfaces (and the VMs 'internet/LAN') and your client machines on the LAN is also going to be layer 2 and generally should not have need for firewall or gateway restrictions since you would want them to present resources the same as any other LAN client machine, right?

So really the only need you would have for a router on a stick or DMZ or whatever would be if you had either some corporate security policy or a sufficiently complex network to warrant a separate network and access controls for the management interfaces for all the equipment and host servers. Even then you don't need it blazing fast 99.99% of the time for management use. But it doesn't sound like that is the case here. Basically you just need a VLAN for iSCSI with no gateway and a VLAN for everything else, which is where your existing router/firewall would be (as long as you are otherwise happy with the existing firewall option).
hotandnerdy wrote:


if you can get a 5510 to approach 1gig speeds ill bow down and call you my fscking hero.
LOL. With the Security Plus license I think 2 of the 4 ports will link at gigabit (they are all hardware gigabit ports I think but limited in software config to negotiate 10/100) but actual throughput still tops out around 300 megabit. Better than a 5505 but not gigabit for sure.

The new 5515-x model will do more like 600 megabit of EMIX test traffic throughput (synthetic mixed profile traffic, not optimal or even 'real' traffic) from some docs I have seen. Rated throughput is 1 gbps. So you might see anywhere from 500-900 megabit I would bet. You can probably get one for $2700-3000 I would guess.
15 posts