I knew about the switching ASICs, but I don't see how it would be that costly. Everything could be electronically identical. Most of the specialty routing, VPN termination, NAT, etc. is already handled in the switche's CPU, which is usually connected to the ASIC via some internal ethernet...