Throughput Considerations

The following guidelines are based on our extensive testing and deployment experience. These guidelines are very conservative for most environments.
Network Card Selection

Selection of network cards (NICs) is often the single most important performance factor in your setup. Inexpensive NICs can saturate your CPU with interrupt handling, causing missed packets and your CPU to be the bottleneck. A quality NIC can substantially increase system throughput.

By comparison Realtek chipsets perform quite poorly. We therefore strongly recommend purchasing Intel cards, or systems with built-in Intel NICs up to 1Gbps. Above 1Gbps, other factors, and other NIC vendors dominate performance.
CPU Selection

The numbers stated in the following sections can be increased slightly for quality NICs, and decreased (possibly substantially) with low quality NICs. All of the following numbers also assume no packages are installed.

10-20 Mbps
We recommend a modern (less than 4 year old) Intel or AMD CPU clocked at at least 500MHz.
21-100 Mbps
We recommend a modern 1.0 GHz Intel or AMD CPU
101-500 Mbps
Server class hardware with PCI-e network adapters, or newer desktop hardware with PCI-e network adapters. No less than a modern Intel or AMD CPU clocked at 2.0 GHz.
501+ Mbps
Server class hardware with PCI-e network adapters. Multiple cores at > 2.0GHz are required.
In environments where extremely high throughput through several interfaces is required, especially with gigabit interfaces, PCI bus speed must be taken into account. When using multiple interfaces in the same system, the bandwidth of the PCI bus can easily become a bottleneck.
Feature Considerations

Most features do not factor into hardware sizing, although a few will have a significant impact on hardware utilization:

VPN - Heavy use of any of the VPN services will increase CPU requirements. Encrypting and decrypting traffic is CPU intensive. The number of connections is much less of a concern than the throughput required. A 500 MHz Intel or AMD CPU can typically support 10-15 Mbps of IPsec, and relatively new server hardware (Xeon 800 FSB and newer) deployments are pushing over 100 Mbps. Future support of AES-NI acceleration of IPsec is planned, and should significantly reduce CPU requirements on platforms that support it.

Captive Portal - While the primary concern is typically throughput, environments with hundreds of simultaneous captive portal users (of which there are many) will require slightly more CPU power than recommended above.

Large State Tables - State table entries require about 1 KB of RAM each. The default state table size is calculated based on 10% of the available RAM in the firewall. For example, a firewall with 1 GB of RAM will default to 100,000 states which when full would use about 100 MB of RAM. For large environments requiring state tables with several hundred thousand connections, or millions of connections, ensure adequate RAM is available.

Packages - Some of the packages increase RAM requirements significantly. Snort and ntop are two that should not be installed on a system with less than 1GB RAM.

U mom prethodnom postu fali :) na kraju da bi se dobro protumačio :)

1. User manager active sessions - jel ovo koliko moze istovremeno ljudi da
bude zakaceno na njega ili? ne kapiram sta je ovo

2. za tunele, L3 kaze 200 - to je cool, ali cega 200? mogu da imam 200
usera konektovanih istovremeno na mtika kao koncentrator ili mogu da
imam napravljenih 200 usera a "active sessions" konektovanih u isto
vreme ili?

3. da li mora radius ili ima on da moze na njemu direkt da se kreiraju useri?

4. MikroTik RB2011iLS-IN ruter sa 11 LAN / WAN portova (5 Gigabit + 5 x 10/100Mb/s + 1 SFP), VPN ruter / firewall / bandwith manager / load balance, CPU 600MHz, 64MB RAM, PoE in 7-31V, PoE out, RouterOS L4

rekao bih da je ovo Level 4, znaci sw mi radi, i dal je 600MHz dovoljno da podnese 100/100 + 100/40 na primer sa 5-6 usera zakacenih na vpn .. ima li negde neka racunica sta koji rb moze da podnese od trafika?