FLASR1-FWNAT-RED

Description

The Cisco FLASR1-FWNAT-RED license delivers Firewall/NAT Stateful Inter-Chassis Redundancy for the Cisco ASR 1000 Series Aggregation Services Routers, enabling seamless high-availability operations across chassis. This license is essential for deployments requiring robust security at the WAN edge, supporting zone-based policy firewalls embedded in the Cisco QuantumFlow processor.

Overview

Cisco ASR 1000 Series routers, powered by the innovative Cisco QuantumFlow processor, offer exceptional performance from 2.5 Gbps to 100 Gbps. The series separates control and data planes for software redundancy in models like ASR 1001, ASR 1002 Fixed, ASR 1002, ASR 1002-X, and ASR 1004, and hardware redundancy in ASR 1006 and ASR 1013. Modular Cisco IOS XE software facilitates In-Service Software Upgrades (ISSU).

The FLASR1-FWNAT-RED license specifically enables stateful inter-chassis redundancy for Firewall and NAT services, ensuring session continuity during failover. It integrates with embedded services including Zone-Based Policy Firewall (ZBFW), which acts as an implicit barrier between zones, requiring explicit policies for traffic between zone pairs using Modular QoS CLI (MQC).

Key Capabilities

• Embedded high-speed firewall performance from 2.5 to 100 Gbps, dependent on Embedded Service Processor (ESP).
• Stateful inspection at Layers 4, 7, and application levels with NetFlow v9 exporting up to 40,000 sessions per second.
• Supports thousands of IPsec VPN tunnels, up to 8,000 tunnels with 25 Gbps encryption via ASR1000-ESP100.
• QoS with modular hierarchical policies, up to 232,000 queues, priority propagation for minimum, maximum, or excess bandwidth.
• Network Application Recognition (NBAR), Flexible Packet Matching (FPM), and other services without additional hardware.

Enterprise Applications

• Superior application availability at WAN edge with VLAN/channel QoS policies limiting low-priority traffic.
• Multi-service scalable secure endpoints aggregating IPsec VPNs, reducing CapEx/OpEx by consolidating to fewer routers.
• Hosted CPE for branch routing over Ethernet SLAs, WAN optimization, firewall/NAT up to 100 Gbps, encryption 1.8-25 Gbps.

Zone-Based Firewall provides implicit deny between zones, with explicit MQC policies for HTTP, DNS, etc., across Internet-DMZ boundaries. Firewall sessions can be logged to network management apps via NetFlow.

Service Provider Applications

• Broadband L2TP LAC/LNS supporting up to 64,000 users/sessions with per-user firewall and SBC.
• Provider Edge L3VPN with multicast, up to 8,000 VRFs, 1M LDP labels, 4,000 ACLs, 4M IPv4/IPv6 routes.
• High-end Route Reflector for 40 Gbps with up to 29M IPv4 routes, 64,000 Layer 3 adjacencies.
• Cisco Unified Border Element (SP Edition) SBC for 32,000 simultaneous voice calls, 40 Gbps multimedia with security/QoS/IPv4v6.

Software Architecture

Cisco IOS XE supports dual IOS instances per Route Processor for software redundancy. Feature packs include IP Base, Advanced IP Services, Advanced Enterprise Services (with/without encryption). Licenses like FLASR1-FWNAT-RED are Right-To-Use (RTU), available via paper (SLASR1-xxx=) or electronic delivery (L-SLASR1-xxx=).

ASR 1001 introduces Integrated Daughter Cards (IDC): ASR1001 (base), ASR1001-2XOC3POS (2 OC-3 PoS), ASR1001-4XT3 (4 T3), ASR1001-4X1GE (4 GE), ASR1001-8XCHT1E1 (8 T1/E1), ASR1001-HDD (integrated HDD). Non-field-upgradable.

Performance and Scalability

QuantumFlow processor boosts service performance 10x over prior midrange routers. Supports security (firewall, encryption), QoS, NBAR, FPM, broadband aggregation, Unified Border Element. Chassis from 1RU (ASR1001) to 22.8″ (ASR1013), with front-to-back airflow, redundant power options.

Embedded hardware encryption up to 25 Gbps. Maximum scalability: 29M IPv4 routes, 400M IPv4/IPv6 routes in PE, 64k sessions for broadband.