As part of a new project, we have a requirement to terminate about 3000 IPsec connections on a Cisco ASA 5540 firewall. According to the specs, the maximum IPsec Peers this platform supports is 5000 so there shouldn't be a problem.
The question is what happens if if ALL 3000 remote sites try to establish the IPsec connection at once ? For example if the upstream switch(es) die. It might not be all at once but depending on timers, it could be within a very small window , maybe 10 seconds or so. Will the ASA cope with all the incoming connections, resource wise ? What's the worst that can happen ?
I understand that thresholds for threat detection might have to be adjusted. The ASA won't do much besides terminating the IPsec connections. There will be no NAT, no inspection. It will participate in OSPF on the LAN side, all remote site networks will be summarized though.