Top Recommended Platforms
Cisco Catalyst 8300
An x86 control plane running the routing protocols alongside a QuantumFlow data plane doing the forwarding, physically separated. The separation is the security property worth caring about: saturating the forwarding path does not, by itself, starve BGP of the CPU it needs to hold adjacencies, which is the failure that turns a link-level flood into a routing outage. It only holds while traffic stays in the fast path. Anything punted to the control plane — TTL expiry, options, ARP, protocol packets — climbs back onto the CPU you were protecting, which is why control-plane policing exists and why an unpoliced router can be knocked over by traffic that never comes close to filling the link.
Netgate TNSR
DPDK and VPP in user space, skipping the kernel network stack entirely, reaching IPsec rates that used to require proprietary silicon on commodity x86. The trade is not subtle. DPDK binds NICs away from the operating system, so the usual tooling — tcpdump, kernel counters, anything that expects a normal interface — no longer sees the traffic, and you troubleshoot through VPP's own tooling instead. You are also now responsible for the support model that a Cisco TAC contract would otherwise cover. For teams with the networking depth, that is a good trade at a fraction of the cost. For teams without it, the first 3 a.m. incident is where the saving gets repaid.
Under the Hood Architecture
QFP 3.0 ASIC (Cisco)
Hundreds of packet-processing engines with crypto offloaded to dedicated QuickAssist hardware, so encryption does not consume general-purpose CPU. Worth knowing where the offload stops: hardware crypto accelerates the cipher suites it implements, and a policy demanding something outside that set falls back to software silently. The symptom is a tunnel that negotiates fine and delivers a fraction of the expected throughput, with no error anywhere — check what the accelerator actually supports before you standardise a proposal.
User-Space DPDK (Netgate)
The NIC writes straight into user-space memory and VPP processes packets in vectors of up to 256, which amortises instruction-cache and lookup costs across the batch instead of paying them per packet. That is where the performance comes from, and it also means latency behaves differently from a kernel path — batching adds a small fixed delay that is irrelevant for bulk transfer and occasionally matters for latency-sensitive traffic. Measure it rather than assuming.
Real-World Attack Surface
Cisco IOS-XE SNMP DoS/RCE (CVE-2025-20352)
A stack overflow in the IOS-XE SNMP subsystem, disclosed in September 2025 and observed being exploited in the wild. It needs valid SNMP credentials — a read-only community string is enough to crash the device, and administrative credentials get you code execution as root. The reason it belongs on a hardening page rather than a patch list is what it says about SNMP generally: v1 and v2c community strings are transmitted in clear text, are shared across the estate, and were configured years ago by someone who has left. Treat a read-only string as a device-reboot capability, because that is what this CVE proves it is.
Table Growth on Open-Source Edges
A software router holds its routing and state tables in ordinary system memory, so a full BGP feed or a route-flapping peer translates directly into RAM consumption — and the ceiling is the box, enforced by the OOM killer rather than by a graceful degradation. Appliances with purpose-built TCAM fail differently and more visibly. If you take a full table on commodity hardware, set inbound prefix limits, alarm on memory, and know what your device does when it runs out, because finding out during a flap is not the moment.
Mandatory Hardening Baseline
- BGP TTL Security: GTSM sends BGP packets with a TTL of 255 and rejects anything arriving with less, which makes off-path spoofing impractical because an attacker several hops away cannot forge a packet that arrives with the hop count intact. It is close to free and it is not a substitute for MD5 or TCP-AO on the session.
- SNMPv3 Enforcement: disable v1 and v2c estate-wide and run v3 with authPriv. Expect this to break monitoring — older NMS platforms and a surprising amount of home-grown tooling only speak v2c, and the migration stalls there. Do it anyway; a plaintext community string is a password on the wire that also grants a reboot.
- Control Plane Protection: rate-limit traffic destined for the router itself in hardware, so a flood aimed at the management or protocol stack cannot starve the CPU that holds your routing adjacencies. Set the limits from measured baselines rather than defaults — too tight and you drop your own BGP keepalives during a convergence event, which is precisely the moment you needed them.
Architecture Comparison
| Component | Cisco Catalyst 8300 | Netgate TNSR |
|---|---|---|
| Packet Processing | QFP 3.0 ASIC (224 PPEs) | VPP / DPDK (User-space) |
| Encryption Offload | Intel QAT Crypto Engine | Native Intel QAT PCIe |
| Throughput Scale | High IPsec scale in hardware | 100Gbps+ on commodity x86 |
| Management Style | IOS-XE / SD-WAN Controller | CLI/API driven, steep curve |
