MX95 as a concentrator

[Karll]

Hello everybody, 

Thinking about a possible SD-WAN solution and wanted to double check if it makes sense. 

50 Small 4G/5G Spoke sites (aprox. 10 people per site)

Possible future expansion  - 20 small sites, 20 medium sized offices (40 clients), 1 HQ (300 clients). 

Traffic towards concentrator should not exceed 1.5Gbps. 

I've checked the sizing principles and MX95 has Recommended Maximum Site to Site VPN Tunnel Count: 250 and Multi-Tunnel VPN Throughput: 2.5 Gbps. 

I'd say MX95 HA cluster is a perfect fit with some room to grow still. The bigger MXs are bit of an overkill. 

What are your thoughts?

[alemabrahao]

Based on your description, it would work without any problems, but in your place I would go with the MX 105.

I also recommend working with a Cisco partner to help you identify all your needs.

[Karll]

Thanks for reply. 

Could you explain why'd you choose MX105?

Technically, we'd barely fit in with MX85 (100 max rec. tunnels, 1Gbps VPN throughput) even with the expansion... 

[alemabrahao]

Because of the future prospecting. The MX 105 offers greater user capacity (750) and greater throughput. It is better to err on the side of excess than to have to change everything in the future.

[alemabrahao]

Furthermore, you can consider at least 3 devices per user.

[Karll]

I think user capacity would be relevant only for the MX on the remote site, no? Not directly for the concentrator. 

[alemabrahao]

Yes, I agree, but if you were to follow the recommendation for a hub, the minimum recommended model would be the MX 250.

But if you think the MX95 meets your needs, I believe you can go ahead.

[RWelch]

If you mentioned it, I might have missed it....is the plan to run split tunnel or full tunnel?  If you are running full tunnel, I'd def suggest going with MX105 as your tunnel count will grow quickly as does the throughput in the equation.  And to @alemabrahao's point, you make the purchase up front but you might find yourself wishing you had gone one model higher later after implementation.  It's like asking yourself if you want the MX95 VPN working constantly at 80-95% CPU or having the MX105 at 50-65% CPU with all traffic flowing.

I manage a customer's setup with the Hub as one MX95 edge appliance with another MX95 VPN concentrator with 6 spokes and their only regret is not going with the MX105 as the VPN concentrator.  But that is what they budgeted for.  

An idea - purchase all spoke and hub items except the VPN and trial what model you feel to be sufficient VPN model to see if it'll meet your requirements / expectations and throughput.  

Meraki Free Trials 

[Karll]

Split tunnel for the 50 5G/4G sites since it would be hard to do a full tunnel.

The potentional expansion (new sites) would probably be split tunnel as well. At least that makes the most sense to me. 

[RWelch]

The MX95 has a 500 user/device count limit so if you have 50 sites with approx 10 users per, you might want to already look more towards the MX105 (both edge MX and VPN concentrator appliances).  The MX105 is geared for 750 users/devices.

The HA MX setup would be "both" as edge or both as VPNs.  If you intend to use one MX as the firewall and the other as the VPN concentrator - both will need licenses.

[RaphaelL]

If the MX "Hub" is configured as a Passthrough / VPN Concentrator I'm pretty sure that the number of clients/flows doesn't apply since the Hub is acting as a L2 bridge

[RWelch]

I get the user/device count recommendations.  Point to be made or the take away is his scenario is roughly 500 users/devices remote PLUS what he has at the HQs (300) and possibly more expansion.

I'm not thinking the MX95 will have the mustard to get the job done.  Just my 2 cents.  It's their decision, not mine 😁

[RaphaelL]

I'm 100% with you on this one.

My point was just that to properly size a hub you don't need to consider the number of clients but rather the number of tunnels , throughput and other factors mentionned by you ,ww and alemabrahao

[Karll]

I forgot to mention that the MX95 would be a dedicated concentrator with no clients connected to it directly. It would be at the DC not HQ. 

[RWelch]

Sounds like you’ve got it all figured out, best of luck 👏👏👏

[PhilipDAth]

The user/device count only applies to users who access the system through the LAN ports, not those who connect via AutoVPN.

When it comes in through the LAN port, it does client tracking.  That requires a lot of CPU and RAM.  Users coming in through AutoVPN are not tracked by the local MX (they are tracked by the MX that connect to).

[ww]

Do note that these vpn speeds of the sizing guide are not "2 way" so 1 Gbit up and 1 Gbit down traffic would count as 2Gbit.

[PhilipDAth]

I would use the MX95 as you have suggested.