topic Re: FTD 1000 vs 2100 TLS performance in Network Security

FTD 1000 vs 2100 TLS performance

tato386 — Tue, 28 Dec 2021 03:33:49 GMT

I was browsing Cisco's web site looking specifically for SSL/TLS decryption specs for 1000 and 2100 FTD devices when I ran into something I did not expect. According to the site (see attached files) the 2100 family has better specs pretty much across the board *except* for TLS? Is this an error or misprint?

Another thing I noticed is that specs for FW+AVC, FW+AVC+IPS and for TLS are separated. What about if I would like to use all four features, meaning FW+AVC+IPS+TLS? How is that measured/rated?

Thanks,

Diego

Re: FTD 1000 vs 2100 TLS performance

Marvin Rhoads — Tue, 28 Dec 2021 13:12:42 GMT

Due to the CPU used, the Firepower 1000 series are able to use Intel Quick Assist Technology (QAT) and get better TLS performance as a result.

https://www.intel.com/content/www/us/en/architecture-and-technology/intel-quick-assist-technology-overview.html

The TLS numbers generally aren't stressed unless the firewall is serving a large number of remote access VPN clients so it's usually not the gating performance factor when considering which device is recommended. Overall throughput as bounded by the "FW+ x" numbers is usually more important.

Re: FTD 1000 vs 2100 TLS performance

tato386 — Tue, 28 Dec 2021 13:59:24 GMT

Thanks for the link Marvin. In my case I won't be doing much VPN. My main concern is maximum IPS protection of web servers behind the firewall. Given that almost all web traffic is encrypted nowadays, which numbers should I be concentrating on?

Re: FTD 1000 vs 2100 TLS performance

Marvin Rhoads — Tue, 28 Dec 2021 14:33:47 GMT

If you are planning to do SSL/TLS decryption of your web servers' traffic then it's a whole other calculation as that is much more CPU-intensive than basic TLS termination.

You might want to check with your Cisco SE or reseller to have them run the numbers through Cisco's internal / partner performance tool for that use case.

Re: FTD 1000 vs 2100 TLS performance

tato386 — Tue, 28 Dec 2021 15:54:23 GMT

Sounds like a plan. Thx