topic Re: FP sizing for 2000 active connections in Network Security

FP sizing for 2000 active connections

lcaruso — Fri, 16 Dec 2022 18:13:16 GMT

I have a question about FP sizing.

For a site that has approximately 2000 active connections through an ASA5506x (not running any firepower just classic ASA, output of "show conn") would a FP1010 be powerful enough to run all three FTD licenses?

Re: FP sizing for 2000 active connections

Rob Ingram — Fri, 16 Dec 2022 18:38:27 GMT

@lcaruso yes the 1010 hardware should be sufficent, datasheet included for reference (and comparison with the other models).

https://www.cisco.com/c/en/us/products/collateral/security/firepower-1000-series/datasheet-c78-742469.html

You may want to check other limitations of each hardware model depending on your future requirements, network bandwidth etc.

Re: FP sizing for 2000 active connections

lcaruso — Sat, 17 Dec 2022 00:03:17 GMT

Have you access to and tried this site?

https://ngfwpe.cisco.com/

Re: FP sizing for 2000 active connections

Rob Ingram — Sat, 17 Dec 2022 09:02:02 GMT

@lcaruso sorry I don't have access, only partners or cisco employees can use this tool. I believe @Marvin Rhoads works for a partner would have access to run this tool.

Re: FP sizing for 2000 active connections

Marvin Rhoads — Sun, 18 Dec 2022 11:54:41 GMT

Concurrent connections are not a parameter used in the NGFWPE tool. For that you can refere to the data sheet that @Rob Ingram linked earlier.

The tool takes into account throughput, average packet size and enabled features (Base, URL Filtering, Malware analysis and SSL decryption (where used)).

Re: FP sizing for 2000 active connections

lcaruso — Sun, 18 Dec 2022 18:20:27 GMT

Yes, that is exactly what I noticed after seeing a demo video of this tool noting throughput as the critical parameter and why I wanted to access it.

Re: FP sizing for 2000 active connections

Marvin Rhoads — Mon, 19 Dec 2022 03:35:37 GMT

With IPS, URL Filtering and Malware all enabled, the Firepower 1010 can handle about 160 Mbps (Snort 2) to 220 Mbps (Snort 3). Under those conditions you should be at or below the recommended 80% CPU utilization according to the tool.

Re: FP sizing for 2000 active connections

lcaruso — Mon, 19 Dec 2022 15:02:40 GMT

Thank you kindly for running that scenario.

Re: FP sizing for 2000 active connections

lcaruso — Mon, 19 Dec 2022 19:00:07 GMT

Would it be too much to ask to provide the correct FTD model for a 600Mbps ISP connection for all three licenses? I always try to ensure the edge device is not throttling down.

Re: FP sizing for 2000 active connections

Marvin Rhoads — Tue, 20 Dec 2022 13:39:09 GMT

@lcaruso the Firepower 1120 (or anything higher) can handle that speed with all three features. For the 1120, the expected CPU is 57% with Snort 3 and FTD 7.2

Re: FP sizing for 2000 active connections

lcaruso — Tue, 20 Dec 2022 16:00:35 GMT

Marvin, thanks kindly once again for this help. I finally got in touch with our account team and they requested access to the tool while I was on the phone with them, so it would seem to be no small favor for you to not only take the time but also arrange this. I really appreciate you helping us get a favorable client outcome. Best Regards, sir!