Max rate between vlans for Meraki MX85

[EricZ]

Dear All,

We are using MX85 as firewall and down link is an Catalyst C4500 , our vlan routing is setup in MX85 .Now we find the traffic in the same vlan is up to 1Gbps as normal ,but the trafffic rate between Vlans is limited at 400Mbps . this rate is tested by copying file . So what is the maxrate between vlans for Meraki MX85 as expected ?

MX85

Current version: MX 18.211.2

[PhilipDAth]

IPS is used for traffic between VLANs.  Let's confirm if this is the issue.  Try turning it off temporarily.

If this resolves it, try using a ruleset that includes less rules.

https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Threat_Protection#Intrus...

[EricZ]

Thanks ，it is the reason .When i disabled it ,the bandwidth goes up to 600 m. If i enable it ,whatever ruleset i choose ,the bandwidth goes down to round 300m. It is strange why this funnction will affect vlan traffic.

[PhilipDAth]

I think you might be able to get more. I would try 18.211.6 or 19.1.8.1.

[JonoM]

Hi @Eric,

One important thing to note is that IDS/IPS naturally increases the overall CPU load on the MX85. This is expected to lower overall throughput to 500Mbps max as per our sizing guide.

Updating the firmware of your appliance is definitely the way to go at this stage, as the newest releases are designed to optimize the MX CPU utilization. 

[GIdenJoe]

The MX85 has a max rate of 1 Gbps without advanced security features.  This is the TOTAL amount of traffic it can pass per second.  This includes traffic going to and coming from the ISP's, VPN tunnels and your interVLAN routing.  Add IPS in the mix and this will drop to 500 Mbps maximum.

You could of course start playing with the IPS  trusted traffic exclusions but I haven't tested the behavior in internal traffic going to internal.

If you have alot of east west traffic you need to consider in your design if you can have a firewall that can handle the load within budget or if you will have to move your heaving routing to the switches instead.  This negates DPI and makes policies a bit harder but that needs to be designed properly.