Modeling the performance of a NAT/firewall network service for the IXP2400

Abstract

The evolution towards IP-aware access networks creates the possibility (and, indeed, the desirability) of additional network services, like firewalling or NAT, integrated into the network devices. These new services, however, force the network components to be both flexible (to cope with changing protocols and applications) and powerful. Network processors as a platform on which to implement the network services seem to fit the bill.System performance should be assured by incorporating performance analysis into the design of the system, by means of performance modeling at the architectural design stage. This paper describes the use of Software Performance Engineering during the design of a firewall/NAT router on the Intel IXP2400 network processor. Several design options were first modeled and analysed, and based on those simulations, a final design was chosen and implemented.