Security Hardening Calculators
Chapter 9 — Core Switch Security Hardening Design Guide
The following interactive calculators assist network security engineers in planning, sizing, and validating core switch security hardening deployments. Each calculator provides real-time results as inputs are adjusted, enabling rapid what-if analysis without manual computation. The five calculators cover the most common quantitative planning tasks: TCAM capacity planning, CoPP rate limit sizing, ACL entry budget estimation, hardening risk score assessment, and BGP prefix filter sizing.
TCAM Capacity Planner
Estimate total TCAM consumption across all security and forwarding features. Helps prevent TCAM exhaustion that silently disables security controls.
CoPP Rate Limit Sizer
Calculate recommended CoPP (Control Plane Policing) rate limits for each traffic class based on your network size and routing protocol scale. Prevents CPU exhaustion while allowing legitimate control traffic.
| Traffic Class | Recommended Rate (pps) | Burst (pps) | Action on Exceed |
|---|
ACL Entry Budget Estimator
Estimate the total number of ACL entries (ACEs) required across all interface types, and check against platform TCAM limits. Helps prevent ACL budget exhaustion that leaves interfaces unprotected.
Hardening Risk Score Assessor
Assess the current security hardening coverage across the eight hardening domains. Each slider represents the implementation completeness of that domain (0% = not implemented, 100% = fully implemented). The overall risk score indicates residual risk exposure.
BGP Prefix Filter Sizer
Estimate the number of BGP prefix filter entries required and the TCAM impact for different BGP deployment scenarios. Helps plan TCAM allocation for BGP security controls including RPKI and prefix filtering.