It's all about ASICs, right?

Every so often, Vyatta gets queries from potential users asking about Vyatta technology. One of those came in to our info-line this morning, and it's a frequently-asked-question, so I answered it with a lengthy reply and I'm going to post the question and answer here as well.

Fundamentally, the question is about the special mojo that Cisco must put into its products, right?

I’ve worked with almost all OS’s you can find and most devices as well.

I’ve read the articles on the OpenSource vs. Cisco, and to be honest I’ve known for a while now that most linux/unix os’s with some tweaking can do the same as most Cisco routers/switches.

But I also know that a lot of development not only goes into the os(source) of the devices, but also the device hardware which is specifically developed for routing/switching.

I would like to know will normal proprietary over the counter hardware match up to the Cisco device hardware?

Brandon

Here's my lengthy answer. I might have given Brandon more than he was looking for, but I figured it would pay dividends if I also blogged it.

Brandon,

The answer to your question is complex, but let me take a shot at breaking it down. Apologies for the long response, but there simply isn't a quick answer to your question.

The simple answer is that it depends highly on which market segment you're looking at.

First, let's separate switches and other appliances (routers, firewalls, etc.). All switches are ASIC-based and are definitely tuned to process packets as quickly as possible. On the other hand, they don't really do much processing other than basic forwarding and possibly some queuing for QoS. The ASICs are tuned for the forwarding task but they can't do much else, and there is typically only a small, embedded processor handling the management interface. It's incapable of doing a lot of heavy-lifting. The operating system in a switch has little to nothing to do with its performance because it's just running the management interface. In spite of that, many switches run on a standard operating system. For instance, Extreme Networks switches run Linux. So, to sum this up, you aren't going to terminate a VPN on your switch, but if you want 48-ports of cost-effective, wire-speed Gigabit Ethernet forwarding performance, switches are just the thing.

Now, let's take a look at appliances. Many of the appliances that are out on the market are based on standard operating systems (Linux or FreeBSD) under the hood, and many are implemented using standard PC hardware. For instance, Fortinet UTM boxes, Juniper J-Series routers, and Riverbed WAN optimization boxes are all based on PCs. Fortinet runs Linux under the hood. Juniper's JunOS is based on FreeBSD. Riverbed uses Linux.

Cisco's IOS is based on a custom, embedded OS because Linux didn't exist back when it was first created and the Unix systems of the day were too resource hungry for the cost structure that they wanted to achieve. While Cisco's low-end hardware is not based on PC platforms, it is not based on much specialized hardware. The ISR series uses a chip from SiByte that contains 4x MIPS architecture cores. So even the ISR is really a software-based device. Further, these cores are underpowered today and are not as fast as off-the-shelf processors. If Cisco were to start over, with a clean slate, I think they would probably make completely different architectural choices. In fact, they are moving this direction, slowly. The recently announced Cisco ASR, while it uses custom silicon, runs IOS on Linux. When Juniper had the chance to start from a clean slate, they chose FreeBSD as the foundation for JunOS and used x86 chips as the CPU for all the Juniper route processor modules.

Now, what you say is definitely true in the high-end of the networking market. Cisco's CRS-1 and Juniper's M and T series routers all use ASICs to perform high-speed forwarding. In this sense, they are more like switches. As with switches, they are very fast, but the processing they perform is not very rich. That's okay for where they sit in the network. The core of the Internet needs to be fast; it doesn't need to be terminating VPNs, doing load balancing, or executing IDS code.

Other parts of the network are different (say the branch office, the edge of service provider networks, or in data centers in front of individual applications), which is why you find many of the appliances that sit there running on Linux/BSD on x86 processors.

So, to summarize, switches are definitely ASIC-based and the operating system has nothing to do with their performance. Some switches (Extreme), even run Linux. In the high-end of the routing space (Cisco GSR and CRS-1; Juniper M and T series), the insides are more like a switch than a router. Like a switch, the forwarding is all handled by ASICs. Still, JunOS is based on FreeBSD. Finally, in the mid-range of the appliance market (routers, firewalls, VPNs, load balancers, etc.), many devices are implemented using standard operating systems running on x86. This is the market place that Vyatta is addressing with our products.

Finally, I'd point out that even if it was true that Cisco's ISR family was implemented using special ASICs and secret networking mojo, the results speak for themselves. The fact is, Vyatta has outperformed the Cisco ISR and 7200 with standard Intel processors at a fraction of the cost. If those Cisco products were using ASICs, that evidentally didn't matter very much in the final analysis. All the custom silicon and engineering did was raise the costs to develop those products, costs that were then passed on to customers. You can find those test results in the Tolly reports here: http://www.vyatta.com/documentation/whitepapers.php

Cheers,

-- Dave

So there you have it. The fact is, whether something is ASIC-based or not should be irrelevant to a consumer. The only thing we should care about is the price/performance of a device in our network and whether it can do the job we need it to do. It could be powered by ASICs, general purpose processors running software, or hamsters running on a wheel, as long as it works.

Maybe the ASIC/networking-mojo myth is a mental crutch. If $8000 of server hardware and Vyatta software can outperform a $35,000 Cisco router, where's the secret mojo that you're supposedly paying for? And if it doesn't exist, why should you pay for it? If you're committed to buying overpriced systems, maybe you need to believe there is something magical about them to justify it to yourself.