topic Re: Redis behind FTD performance issue in Network Security

Redis behind FTD performance issue

mahdiasgari — Mon, 01 Mar 2021 13:11:57 GMT

I have number of servers with Redis Pipeline (redis.io/topics/pipelining) enabled. A FTD is managing routing access between servers like this:

Redis client --->FTD--->Redis Servers

192.168.2.10/24-->192.168.70.33/24

192.168.2.10/24-->192.168.70.34/24

192.168.2.10/24-->192.168.70.35/24

The connectivity of server and client is okay but Something in FTD decrease the Redis Pipeline performance drastically. I tried tcp bypass and fastpath with no success.

Is anyone knows where's the issue

Thanks

Re: Redis behind FTD performance issue

ahassan2 — Tue, 02 Mar 2021 13:38:37 GMT

Hi Mahdi ,

Since you configured mentioned rule in prefilter Policy Fastpass then traffic should be bypassed without any additional inspection .

you can Login on FTD CLI and check :
> show cpu
> system support firewall-engine-debug
Then specify the filter and share it here

Also you need to make sure:
- Avoid discovering 0.0.0.0/0 network
- try to Trust Known Traffic
- Elephant flows (like backup) will contribute to latency

try to follow below link to test performance of your setup :

https://www.digitalocean.com/community/tutorials/how-to-perform-redis-benchmark-tests

Re: Redis behind FTD performance issue

mahdiasgari — Wed, 03 Mar 2021 08:38:07 GMT

Dear Hassan,

Thanks for your kind help. I attached the output of debug command as well as matched ACLs.

As I mentioned before I've used Fastpath to eliminate possible IPS obstacles and I don't have any discovery rule.

I manage to test Redis Pipeline with other vendor's firewall and the results were okay.

I think something in FTD for some reason queue the Pipeline's flow traffic, although I don't use any QoS rule either.

Thanks in advance.