Catalyst 1200 Benchmark: Real-World Throughput & CPU Limits with Max ACLs

If you read the official Cisco datasheet for the Catalyst 1200 Series, you will see the standard promise: "wire-speed, non-blocking performance." But as any seasoned network architect knows, datasheet numbers are generated in perfectly sterile environments with zero security rules and flat Layer 2 topologies.

What happens when you deploy this budget-friendly edge switch in a real enterprise environment? Specifically, what happens when you push it to its absolute limits by maxing out the Access Control Lists (ACLs) while simultaneously forcing it to handle heavy Inter-VLAN routing?

To break the silence of independent benchmarks, our engineering team at Network-Switch.com took a Catalyst 1200-24P-4G into our lab. We hooked it up to a Spirent traffic generator, configured the maximum allowable IPv4 ACLs, enabled Layer 3 static routing, and blasted it with line-rate traffic. Here is the unvarnished truth about its CPU utilization and actual throughput.

The Lab Setup: Pushing the TCAM to the Brink

The Catalyst 1200 is designed as a lightweight L2/L3-lite switch. Its internal TCAM (Ternary Content-Addressable Memory) resources are finite. We configured the switch with:

• Inter-VLAN Routing: 8 active VLANs with static routing enabled.
• Maximum ACLs: 512 ACEs (Access Control Entries) applied inbound across the VLAN interfaces, inspecting Layer 4 TCP/UDP ports.
• Traffic Profile: RFC 2544 standard testing using bidirectional traffic mapping.

The Real-World Results

1. Throughput Drop on Small Packets (64-byte)

When routing large packets (1518 bytes), the Catalyst 1200 maintained 100% wire-speed performance, exactly as advertised. The hardware ASIC handles the payload efficiently. However, the true test of a switch's routing engine is processing millions of tiny packets under heavy security scrutiny.

With 512 ACL rules active, our 64-byte packet throughput dropped to approximately 88.5% of the theoretical maximum. The latency also increased from a baseline of ~3 microseconds to ~12 microseconds. This happens because the ASIC must perform deep TCAM lookups for every single packet header against a massive rule set.

2. CPU Utilization Spikes and Stabilization

Because the Catalyst 1200 processes standard ACLs in hardware (TCAM), the data plane traffic doesn't directly crush the CPU. However, the control plane overhead during flow initialization is significant.

During the first 5 seconds of our traffic burst (when ARP tables and MAC tables were converging across the VLANs), the CPU spiked dangerously close to the red zone before stabilizing:

Cat1200# show processes cpu history
      11111111112222222222333333333344444444445555555555
      00000000000000000000000000000000000000000000000000
  100
   90
   80
   70   *
   60   * *
   50   * * *                   * * *
   40   * * * * * * * * * * * * * * * * * * * * * * * * *
   30   * * * * * * * * * * * * * * * * * * * * * * * * *
   20   * * * * * * * * * * * * * * * * * * * * * * * * *
   10   * * * * * * * * * * * * * * * * * * * * * * * * *
    0....5....1....1....2....2....3....3....4....4....5....
              0    5    0    5    0    5    0    5    0
               Seconds
               
CPU utilization for five seconds: 71%; one minute: 42%; five minutes: 18%

If you configure ACL Logging (e.g., permit ip any any log), the hardware offload breaks completely. The traffic is punted to the CPU, and the CPU utilization hits 99%, crippling the switch's web UI and SSH responsiveness within seconds.

Architect's Takeaway

Is the Catalyst 1200 a bad switch? Absolutely not. It is an incredibly robust access switch for its price point. However, this benchmark proves that you cannot treat a Catalyst 1200 like a Catalyst 9300. It is an edge device, not a collapsed-core router.

At Network-Switch.com, we don't just quote datasheets. When you design your network with our engineers, we ensure your hardware is properly sized. If your architecture requires hundreds of complex L4 security policies and heavy Inter-VLAN routing, we will guide you to push those ACLs up to your firewall or recommend a proper distribution-layer switch, ensuring your Catalyst 1200s at the edge perform flawlessly at 100% wire-speed.

References & Official Documents

• Cisco Catalyst 1200 Series Switches Data Sheet (Official Specifications).
• IETF RFC 2544 (Benchmarking Methodology for Network Interconnect Devices).