Monday, March 15, 2010

You are here: Home / Cisco / Cisco Application Control Engine (ACE) — Introduction and Comparison With F5

Cisco Application Control Engine (ACE) — Introduction and Comparison With F5

January 25, 2008 by Greg Ferro · 13 Comments 

ACE Introduction

The ACE comes in two formats, either a stan­dalone 1RU appli­ance, or as a Cat6500 mod­ule. The appli­ance seems to have a faster devel­op­ment cycle and gets the new fea­tures early, but the mod­ule has more per­form­ance in every aspect.

And what amaz­ing per­form­ance it is, this thing can per­form load bal­an­cing at up 16 Gigabits per second, which is about four times more than the F5 8800 (note some con­di­tions apply in the cur­rent ver­sions of code, due to ASIC inputs at 8 Gigabits per second but expec­ted to be resolved in future code releases), and at a price about two thirds of an F5 8800. (Note: I accept raw speed is not he only meas­ure of per­form­ance see more later)

But not many people are going to need a load bal­an­cer at that sort of per­form­ance, and the ACE mod­ule is a key part of the Cisco SONA strategy. To this end the ACE mod­ule can have up to 250 vir­tual instances, more than 340000 sus­tained TCP con­nec­tion, 15000 SSL TPS. SO this thing has high per­form­ance across the board.

Power Reduction

A rough rule, one ACE mod­ule is ‘per­form­ance equi­val­ent’ to at least four F5 6400 units. An F5 6400⁄8800 chassis uses a max­imum of 460W, so lets say its con­sumes about 300W in real life. One ACE mod­ule uses about 220W. The power sav­ing in enormous.Of course, one ACE mod­ule uses a lot less space.

Functional Comparison

In my opin­ion, the F5 has super­ior func­tional cap­ab­il­ity in com­par­ison to the Cisco ACE. The iRules func­tion is power­ful, flex­ible and easy to use. The graph­ical IDE is a smart piece of work and is really attract­ive to the GUI-​​centric folks amongst us (big shout-​​out to the Windows server people!)

As a net­work­ing per­son, it takes a while to adapt to using a a lan­guage like TCL (which F5 iRules uses), but since Cisco IOS has a TCL mode I am becom­ing com­fort­able using tra­di­tional tech­niques for programming.The F5 also has some good fea­tures relat­ing to cer­tain applic­a­tions such as MS Sharepoint, SAP, Oracle and so on. If you know about these fea­tures you will know why you want an F5 for these.But for web host­ing plat­forms which use TCP, DNS, FTP, HTTP SMTP and so on in the server farms, you will be hard pressed to appre­ci­ate the F5 benefits.

Virtualisation

The ACE vir­tu­al­isa­tion is very sim­ilar to the Cisco FWSM. There is full sep­ar­a­tion between con­texts, includ­ing AAA, login, SNMP and all net­work man­age­ment func­tions. The F5 uses a par­ti­tion concept, which involves admin­is­trat­ive restric­tions, but only a single man­age­ment instance. This makes secur­ity and shar­ing of Network Management and Monitoring dif­fi­cult. F5 indic­ates that they will have some form of vir­tu­al­isa­tion in the next year or so.

Management

Cisco ACE can be man­aged using Cisco Application Networking Manager. It provides a tool for GUI con­fig­ur­a­tion of mul­tiple ACE mod­ules. I haven’t seen ANM yet, but a paper review indic­ates that it has good AAA and full sep­ar­a­tion of the views.

Interestingly, Cisco ANM comes free with your ACE for two hard­ware and five con­texts, but you need to buy licenses in an odd (and expens­ive) way. Thus, you need to buy con­text licenses per device, and thus you have to spend a lot of cash and have unused licenses all over the place. For lar­ger install­a­tions make sure you plan this into your upgrade costs.

Futures

When you look at the mod­ules you can see that there is space for two daugh­ter cards. The sug­ges­tion is that new fea­tures are in the pipeline for Web Acceleration. I sus­pect that we will see fea­tures from the Application Velocity and WAAS plat­form in the future. Look for dynamic browser cache man­age­ment, HTML trans­form­a­tion /​ and pro­tocol man­age­ment in the hard­ware over the next year or so.

Conclusion

I believe that for large data centres, you will most likely use F5 LTM where you need it for a spe­cific fea­ture or task, but you would choose to have a ACE mod­ule for most load bal­an­cing tasks.

You can can cre­ate lots of them, use MPLS to make them avail­able any­where in your network.

I also recom­mend that you buy the WS-​​C6509E-​​ACE20-​​K9 ACE20 8G 6509E Bundle. This is a Catalyst 6509 chassis, with Sup720 and dual 6000W power sup­plies, and an ACE mod­ule as a single item. The sav­ing is about 20% over buy­ing the items indi­vidu­ally, which makes it good value.

Edit: Also check out my rant at F5 about no AAA author­iz­a­tion.

Please rate this post:

  Why Rate Posts?
1 Star - It\\\'s Crud2 Stars - It\\\'s Tosh3 Stars - Something\\\'s missing4 Stars - Needs works5 Stars - Good Enough6 Stars - Good7 Stars - Excellent8 Stars - Brilliant9 Stars - Astonishing10 Stars - Awesomely Godlike? (2 votes, average: 7.50 out of 10)
Loading ... Loading ...

Filed under Cisco, Design · Tagged with , , , ,

Probably Related Posts on the Same Topic

Comments

13 Responses to “Cisco Application Control Engine (ACE) — Introduction and Comparison With F5”
  1. Mikey G says:
    15 February 2008 at 14:56

    Interesting obser­va­tions. Your power and cost reduc­tion ana­lysis really only hold water if you already have a 6500 avail­able for the ACE mod­ule. Otherwise, cost is a wash and the entire Cisco bundle will con­sume much more power than a stan­dalone f5 8800. If you add the man­age­ment licenses in for the ACE, you’re cost will far exceed an 8800.

    I’m glad you men­tioned the­or­et­ical through­put does not always equate to real applic­a­tion per­form­ance. From the stud­ies I’ve seen, the 8Gbps ACE falls short of an f5 8800 in every respect. Also, con­sider the ACE does not sup­port HTTP com­pres­sion, a very import­ant fea­ture for most large enter­prises and ISPs and ASPs.

    Reply
  2. Greg Ferro says:
    15 February 2008 at 16:06

    I agree with your view up to a point. In my case,the F5 8800 was more expens­ive than the com­plete C6500 with ACE and 48 switch ports. We had no spe­cial dis­counts from either party and I refer to real costs, not list price.

    For most data centres, a C6500 is always avail­able. Its hard to regard it as part of the power budget, but I need the MPLS and rout­ing integ­ra­tion for the vir­tu­al­iz­a­tion, so I regard the C6509 as a bene­fit, not a plat­form for just host­ing the ACE blade. Note that the ACE 4700 uses less power than the F5 8800 as well.

    The F5 BigIP greatest dif­fi­culty remains vir­tu­al­iz­a­tion. The abil­ity to have sep­ar­ate admin­is­trat­ive zones with fully sep­ar­ated rout­ing is very valuable.

    I dis­agree on per­form­ance. The F5 BigIP loses per­form­ance when doing com­plex manip­u­la­tions, and, because it is so easy to con­fig­ure ‘fancy’ load bal­an­cing, we do slow it down. I love the inter­face though.

    I am cur­rently con­fig­ur­ing Cisco Application Network Manager, I will prob­ably post an art­icle on com­par­ing this with the F5 web inter­face in a few weeks.

    Thanks for your post.

    Reply
  3. Mikey G says:
    15 February 2008 at 17:05

    The ACE4700 does use less power than an f5 8800, but the 4700 is more in line with an f5 3400, which is rated at a max power of 300W.

    Let’s agree to dis­agree on the 6500 and a power budget cal­cu­la­tion. Sure, most data cen­ters will have a 6500, but is there a slot avail­able, is it run­ning the proper code (still on CatOs or Hybrid?), does it have a Sup720 or bet­ter? Any upgrades to any of those com­pon­ents have both hard and soft costs asso­ci­ated with him. Large enter­prises and ISPs may not be able afford the out­age to any of said com­pon­ents to pre­pare a switch for the ACE.

    No GSLB (GTM) func­tion­al­ity in the ACE is a huge dis­ap­point­ment as well.

    Good luck with your install…

    Reply
  4. George Smiley says:
    3 May 2008 at 08:53

    My com­pany uses both F5 and ACE for LB. The ACE blade have so far shown to be quite unstable and in need of con­stant reboots. We have been forced to put our high-​​end cus­tom­ers on the F5 and I do not believe for a minute that ACE is cap­able of the advert­ised through­put. The only sav­ing grace for the ACE is TAC appears to do bet­ter job in field­ing sup­port calls. In another 2 or 3 years, ACE code may become stable and not inund­ated with of bugs and until then, mis­sion crit­ical stuff stays on the F5.

    Cheers

    Reply
  5. elpingu says:
    8 October 2008 at 04:01

    I have many ACES 14 installed…all my equip­ment car­ries sup720 and right code..
    so the aces fits right in…i can right away use any vlan without mov­ing a single wire…
    I can say by exper­i­ence that i have seen the ACE handle live 3.5 mil­lion sus­tanined con­nec­tions
    i have seen it handle 990k nat trans­la­tion sus­tained
    i have seen it push 3.5 gigd sus­tained…
    pure war story…not made up

    Now the ini­tial code was buggy…and the rep­lic­a­tion broke easy…
    though upgrades rep­lic­a­tion is seam­less and fails over nicely.

    I am a cli type of per­son and need so see and use text…dont like GUI too much.

    now for the bad part…
    they do advert­ise that they can handle 4000 vips..I have 550 and my con­fig­ur­a­tion is very large and com­plic­ated ..access-​​list , nat ‚vips ‚l7.

    well with a very big con­fig­ur­a­tion the ACE can­not apply the con­fig­ur­a­tion prop­erly and some con­fig does not apply…it does not hap­pen all the time but it hap­pens and spist out an error mes­sage .you dont loose the con­fig but it does not apply.…they are work­ing on this bug.…..but is very bad…

    again this is in very large configuration .….

    yes the ACE is a work­horse and i can vouch for it..seen it
    but at code 2.1.2 they have some con­fig­ur­a­tion size ceil­ing which sucks…

    Reply
    • Greg Ferro says:
      13 October 2008 at 20:20

      elp­ingu

      I appre­ci­ate your feed­back. I have found the later code works much bet­ter than the earlier releases, and quite a few new fea­tures. Probably on par­ity with the F5 now (at least for the non-​​microsoft fea­tures anyway).

      Reply
  6. thedin says:
    13 October 2008 at 06:37

    I’ve been try­ing to fig­ure out how to use ACE to do load­bal­ance a set of trans­par­ent caches. But still couldn’t fig­ure out the proper way to dir­ect the return traffic (from the inter­net to the cli­ents) to the exact cache that pro­cessed the out­go­ing traffic. Several Cisco guys poin­ted that I use the mac-​​sticky fea­ture, but none provided as how that would solve the prob­lem. Any ideas here ?

    Reply
    • Greg Ferro says:
      13 October 2008 at 20:19

      mac-​​sticky is the same as the Distributed Director fea­ture from years ago. Basically the LB remem­bers the mac-​​address of the device that the packet was ori­gin­ated from. Then, regard­less of ANY other details (like ip rout­ing), it will always send the replay packet from the flow, back to that source.

      Effectively this is layer 2 load bal­an­cing, per­fect for load bal­an­cing layer 2 devices.

      Reply
  7. Bob says:
    1 April 2009 at 23:07

    Our exper­i­ence with the ACE mod­ules has been abysmal. Performing the simplest func­tion (i.e., upload­ing an SSL cert) is dif­fi­cult rel­at­ive to F5 boxes. We have been work­ing with Cisco TAC for 3 days now to get that little thing accom­plished. Their UI is hor­rible and I can say for cer­tain that there is no hope that our oper­a­tions team will be able to do the simple things they need to do on their own (ie., move serv­ers in and out of pools).

    All the power, through­put and price is use­less if I need a CCIE and Cisco TAC to upload a simple cer­ti­fic­ate. The com­plex­ity of Cisco gear con­tin­ues to be another reason why they will lose mar­ket­share. Command line is great, but seems more like mach­ismo at this point.

    Reply
    • Greg Ferro says:
      2 April 2009 at 05:33

      I don’t find the CLI a prob­lem, and most net­work­ing people are don’t have a prob­lem. People who are server-​​focussed some­times have prob­lems if they are not well prac­ticed in using the CLI.

      Have you looked at using the Cisco Application Network Manager which is a graph­ical inter­face for admin­is­ter­ing and using the ACE mod­ules ? I found this a lot easier when enga­ging with people who were used to GUI inter­faces and didn’t have much exper­i­ence with CLI.

      Reply
  8. Keith Boblits says:
    7 August 2009 at 23:15

    We have just pur­chased sev­eral sets of ACE appli­ances (4710) since Cisco has strongly encour­aged us not to deploy their CSS product in new envir­on­ments. I must say there is quite a dif­fer­ence when con­tras­ted with the CSS and the ease of con­fig­ur­a­tion is not so intu­it­ive. I find the “policy maps” more dif­fi­cult to work with when cre­at­ing load bal­an­cing rules and the con­fig­ur­a­tion as a whole doesn’t appear as struc­tured as the CSS. I’m not a GUI per­son since I want to see the “under the hood” pieces of the con­fig­ur­a­tion. I do real­ize the ACE is more fea­ture rich than the CSS, how­ever. I’m not sure if patience will win out but there has been talk of look­ing into F5 in the future.

    Reply
    • Greg Ferro says:
      8 August 2009 at 11:56

      Hi Keith

      The Cisco ACE4710 has a GUI con­sole much like the ASDM on ASA, or SDM on IOS. You could use that to do a lot fo the configuration.

      If you are strug­gling to under­stand the policy/​class-​​map way of con­fig­ur­ing, then you might want to do a search for “C3PL” oth­er­wise Cisco Common Classification Policy Language to get an intro­duc­tion and to help you under­stand the way this works.

      Since I use C3PL is used on all Cisco products (ASA, IOS, and oth­ers) I am quite used to used to it, but it did take a while.

      With regards to F5, until they sup­port vir­tu­al­isa­tion (cur­rently pro­jec­ted for NEVER) there is no way I will go back. They are not that great. Funky fea­tures, but the same prob­lems as the ACE.

      Reply

Trackbacks

Check out what others are saying about this post...
  1. My Etherealmind · Rant: F5 LTM and GTM doesn’t do external AAA authorization says:
    23 March 2008 at 18:03

    […] and the cur­rent method in BigIP is not good enough. I have talked about com­par­ing the F5 and ACE here, minus 5 points to F5. for […]

    Reply


Speak Your Mind

Tell us what you're thinking...
and oh, if you want a pic to show with your comment, go get a gravatar!

A Random Selection of Other Fine Posts (or Not)