Line-rate performance may be a given in Layer-2/3 switches, but what about the NAC devices that sit alongside them? To find out, we loaded up the ConSentry and Nevis devices with the kind of Windows application traffic they’re likely to see in the enterprise.

Both the ConSentry and Nevis boxes ran at or near line rate when configured as Layer-2 switches, but that’s not how anyone uses them. Performance was less speedy when these devices firewalled traffic and inspected packet payloads. Tradeoffs between performance and security are nothing new, but in the case the differences ranged from slight to huge.

Click to see: NAC forwarding rates

We tested NAC performance using the Common Internet File System (CIFS), the protocol used by Microsoft Windows. We captured live traffic as a client mapped a network drive on a server, uploaded and downloaded a 1-MB text file and then disconnected the network drive. This traffic pattern ensured that multiple types of CIFS transactions were involved and also (because of the 1-MB transfer in each direction) that the pipe would be full in both directions. These devices are designed to sit in the core of the network and are not traditional Internet-facing firewalls. This means that a Windows-heavy traffic mix for stress testing is more meaningful than heavy HTTP traffic.

To scale up traffic across eight pairs of ports on each NAC device, we used the Spirent Avalanche and Reflector test instruments to replay the captured traffic from 1,500 concurrent users.

In a baseline measurement with no device on the test bed, the aggregate forwarding rate between Avalanche and Reflector test instruments was about 8.67 Gbit/s, or roughly 4.3 Gbit/s in each direction. That’s a little shy of the 10-Gbit/s capacity of these devices, but as it turned out both devices tested ran slower than this level in anything but a layer-2 configuration.

We assessed NAC device performance in three modes: as a simple layer-2 switch, allowing all traffic to be forwarded, as a firewall with common enterprise rules enabled and as a firewall with layer-7 content inspection enabled.

In the layer-2 tests, the ConSentry device forwarded traffic at essentially the same rate as our baseline test, with Nevis about 100 Mbit/s slower. These are minor differences; as switches, these devices run at or close to line rate. However, you don’t buy these boxes to use as switches, so while these numbers are admirable, they aren’t very useful.