Corporate Headquarters

Integrated versus Overlay Design
An integrated network design is one in which the WAN, VPN, and IOS firewall functions are run on the 
same device, for example, on a remote site Cisco 7200 series router. Integrated network designs are 
common in remote offices because of their simplicity and manageability. 
An overlay design is one in which any single function, or all functions, are separated, as in headend 
designs. Firewall functionality is usually separate, the WAN and VPN functions are often integrated 
(meaning that the functions run on the same device), and VPN functionality is frequently separate from 
the WAN and firewall functions. 

---

2-5
Cisco IOS VPN Configuration Guide
OL-8336-01
Chapter 2 Network Design Considerations
Network Traffic Considerations
The primary advantage of an overlay design in the headend configuration is that the separation of tasks 
optimizes network performance. Each device may be dedicated to one or two tasks, rather than all three, 
in a heavy traffic environment. For example, ACLs (Access Control Lists) require a fair amount of CPU 
utilization. Therefore, performing ACL tasks on a device other than the Cisco 7200 series router allows 
the Cisco 7200 series router more power to support network traffic.
Network Traffic Considerations
Cisco IOS is feature-rich software. However, if improperly used, these features can degrade the flow of 
VPN traffic. This section provides a discussion of when and how to use several Cisco IOS options to 
maximize VPN performance, and includes the following topics:
•
Dynamic versus Static Crypto Maps
•
Digital Certificates versus Pre-shared Keys
•
Generic Routing Encapsulation Inside IPSec
•
Network Address Translation