> For the complete documentation index, see [llms.txt](https://docs.thousandeyes.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.thousandeyes.com/product-documentation/traffic-insights/traffic-insights-system-requirements/forwarder-requirements.md).

# Forwarder Requirements

The following requirements and performance criteria apply to the Enterprise Agents you enable for forwarding.

## Supported Enterprise Agents

Forwarder enablement on the ThousandEyes Enterprise Agent is supported only for:

* ThousandEyes virtual appliances (TEVAs) running on Oracle VirtualBox or VMware. Microsoft Hyper-V is not supported.
* Application hosting (CAF) on the following Cisco devices:
  * Cat9k switches
  * Cat8k routers
  * ASR1k, ISR4k, and ISR1k routers

See [Enterprise Agent Installation](https://docs.thousandeyes.com/product-documentation/global-vantage-points/enterprise-agents/installing) for more information about the above device types.

The resource minimums and capacity rates for each agent type is listed in the tables below. **Note** that a *packet per second (PPS)* is estimated to equal around 10 *flow records per second (FPS)*.

### TEVA

| RAM  | Cores | FPS (supports up to) | Approx PPS | Max Traffic Monitors |
| ---- | ----- | -------------------- | ---------- | -------------------- |
| 8 GB | 4     | 400,000              | 40,000     | 1,000                |
| 4 GB | 2     | 200,000              | 20,000     | 1,000                |

### CAF

| Device types | CPU Units | RAM      | vCPU | Traffic Mirroring | FPS (supports up to) | Approx PPS | Max Traffic Monitors |
| ------------ | --------- | -------- | ---- | ----------------- | -------------------- | ---------- | -------------------- |
| Cat9k        | 1,850     | 1,024 MB | 1    | Yes               | 100,000              | 10,000     | 1,000                |
| Cat8k        | 1,000     | 1,024 MB | 1    | No                | 100,000              | 10,000     | 1,000                |
| Cat8k        | 1,500     | 1,024 MB | 1    | Yes               | 100,000              | 10,000     | 1,000                |
| ASR1k        | 5,000     | 1,024 MB | 1    | No                | 100,000              | 10,000     | 1,000                |
| ASR1k        | 5,000     | 1,024 MB | 1    | Yes               | 90,000               | 9,000      | 1,000                |
| ISR4k        | 5,000     | 512 MB   | 1    | No                | 50,000               | 5,000      | 100                  |
| ISR4k        | 6,000     | 512 MB   | 1    | Yes               | 30,000               | 3,000      | 100                  |
| ISR4k        | 6,000     | 1,024 MB | 1    | No                | 100,000              | 10,000     | 1000                 |
| ISR4k        | 9,000     | 1,024 MB | 1    | Yes               | 100,000              | 10,000     | 1000                 |
| ISR1k        | 1,000     | 512 MB   | 1    | No                | 50,000               | 5,000      | 100                  |
| ISR1k        | 1,000     | 512 MB   | 1    | Yes               | 30,000               | 3,000      | 100                  |

To achieve the CAF performance levels in the above table, you need to configure the device with at least the CPU and RAM resources specified. Use the following custom app-hosting profile:

```
app-hosting appid DESIRED_APP_ID
 << other configuration >>
 app-resource profile custom
  cpu <CPU Units>
  memory <RAM>
  persist-disk 100
  vcpu 1
```

#### Punt Policer Requirements

On Cat8k, ASR1k, ISR4k, and ISR1k routers, incoming IPFIX packets destined for the CAF forwarder are subject to IOS XE punt policing. Default limits might need adjustment to accommodate the aggregate IPFIX packet rate from all exporters.

If the defaults for the rate limit in PPS and the burst limit in packets do not meet requirements, set them to at least 110% of the expected aggregate IPFIX PPS, rounded up and within platform limits. To check the active limits and monitor **Dropped Packets**, run:

```
show platform software punt-policer
```

Increasing drop counters indicate packet loss before traffic reaches the forwarder. These drops might not appear in the forwarder's **Dropped Events** metric. For more information about dropped events, see [Capacity Rates](#capacity-rates).

| Platform | Punt cause                 | Validated maximum rate | Validated maximum burst | Global configuration command                         |
| -------- | -------------------------- | ---------------------- | ----------------------- | ---------------------------------------------------- |
| Cat8k    | 11 — For-us data           | 32,300 PPS             | 100,000,000 packets     | `platform punt-policer 11 32300 100000000`           |
| ASR1k    | 64 — Service Engine packet | 100,000 PPS            | 100,000 packets         | `platform punt-policer service-engine 100000 100000` |
| ISR4k    | 11 — For-us data           | 64,600 PPS             | 64,600 packets          | `platform punt-policer for-us-data 64600 64600`      |
| ISR1k    | 11 — For-us data           | 4,306 PPS              | 4,306 packets           | `platform punt-policer for-us-data 4306 4306`        |

The commands above show validated maximum settings. Size the rate and burst for your expected traffic; you do not need to use the maximum settings for every deployment.

{% hint style="info" %}
You can "enable" as forwarders any CAF device within the supported CAF device families listed (see [Configuring Forwarders](https://docs.thousandeyes.com/product-documentation/traffic-insights/traffic-insights-configuration-guide/configuring-forwarders)). However, we have not verified every possible device in the supported CAF device families.

The "enable" toggle is grayed out for unsupported devices such as TEVAs using Hyper-V or custom virtual appliances, ThousandEyes physical appliances or Raspberry Pis, Linux packages, Cisco Meraki MX appliances, Cisco Industrial routers and Ethernet switches, or Cisco NFVIS (Network Functions Virtualization Infrastructure Software).
{% endhint %}

### Capacity Rates

Forwarder capacity and other metrics are estimated for each supported Enterprise Agent type in the above tables. Estimations are based on the most powerful machine configuration and on records containing all [recommended fields](https://docs.thousandeyes.com/product-documentation/traffic-insights/traffic-insights-system-requirements/flow-record-requirements#recommended-fields).

**Note**: Once you have set up Traffic Insights, you can check whether your forwarder is breaching capacity via the **Dropped Events** column at **Traffic Insights > Settings > Forwarders**. See [Managing Forwarders](https://docs.thousandeyes.com/product-documentation/traffic-insights/traffic-insights-management/managing-forwarders)) for more information.

### Deployment Approaches

The capacity rates above for TEVA and CAF agents naturally suggest two kinds of forwarder deployment approaches.

1. Because the TEVA appliances can handle much larger flow rates, we recommend installing the forwarder on one or more centralized Enterprise Agents at central or regional data centers. In this scenario, you only configure one forwarder for your entire network or one forwarder per regional network.
2. For those using CAF, we recommend a more distributed approach, such as a forwarder on each local network. CAF users are likely to have Enterprise Agents already installed on these local networks, making enabling them as forwarders relatively straightforward.

Additionally, we recommend using the designated Enterprise Agent(s) only for Traffic Insights, rather than as an agent that also runs tests. We acknowledge, however, in the CAF scenario, that you may be repurposing Enterprise Agents that still run tests. In this case, we recommend reducing the number of tests run on those agents to less than 10 to optimize their flow rates.

## Installing Supported Agents

To check if you already have a supported Enterprise Agent, see [Finding an Existing Supported Agent](https://docs.thousandeyes.com/product-documentation/traffic-insights/traffic-insights-configuration-guide/configuring-forwarders#finding-an-existing-supported-agent). If you don’t already have a compatible Enterprise Agent, you can install one for Traffic Insights; see [Enterprise Agent Installation](https://docs.thousandeyes.com/product-documentation/global-vantage-points/enterprise-agents/installing) for the relevant articles about virtual appliance or Cisco device installation.

## Agent Restrictions

Some restrictions apply to the use of Enterprise Agents as forwarders:

* **No clustering**: You cannot enable Traffic Insights for an Enterprise Agent cluster. Any Enterprise Agent that has already been enabled for Traffic Insights cannot be added to a cluster. See [Working with Enterprise Agent Clusters](https://docs.thousandeyes.com/product-documentation/global-vantage-points/enterprise-agents/managing/working-with-enterprise-agent-clusters) for more information.
* **No shared Account Groups**: You cannot enable Traffic Insights for an Enterprise Agent that is shared with another Account Group. Any Enterprise Agent that has already been enabled for Traffic Insights cannot be shared with another Account Group.
* **Max Flows**: Each ThousandEyes account group is capped at 500,000 FPS (around 50,000 PPS).
* **CAF Agent Tests**: We recommend running a max of 10 Network & App Synthetic tests when an agent is used simultaneously for synthetic tests and as a forwarder (see [Deployment Approaches](#deployment-approaches) for more information).