topic Re: Secure firewall 3105 throughput in Network Security

Secure firewall 3105 throughput

peter.matuska1 — Thu, 11 Jan 2024 14:43:04 GMT

Hi,

this should be 10G FW but the iperf speedtest result gives me apprx. 650Mbps when testing from A to B. When testing from B to A, I get 900Mbps. The connected interfaces are 1G. When I tested from A to B and from B to A but traffic bypassing the FW, I got 930Mbps so it looks like the FW is an issue. When I configure prefilter I got slightly better results but not 930Mbps.

FW is running 9.3.1

thank you

Re: Secure firewall 3105 throughput

MHM Cisco World — Thu, 11 Jan 2024 14:49:30 GMT

Yes the FW throughput is around 900Mbps
if you config prefilter then all traffic pass without inspect, to solve issue I think you need to bypass the FW
MHM

Re: Secure firewall 3105 throughput

peter.matuska1 — Thu, 11 Jan 2024 15:06:03 GMT

Only 900? It is not even closed to advertised 10G

Re: Secure firewall 3105 throughput

tvotna — Thu, 11 Jan 2024 15:52:26 GMT

Do you generate single flow or multiple flows? 3105 has 12 CPU cores, so testing it with a single flow is simply not a valid test.

Re: Secure firewall 3105 throughput

MHM Cisco World — Thu, 11 Jan 2024 15:58:09 GMT

But you are use interface have 1g how you want to get around 10g !!!

Change it to sfp 10g and check again.

MHM

Re: Secure firewall 3105 throughput

Marvin Rhoads — Fri, 12 Jan 2024 02:28:00 GMT

Rated firewall throughput is not for a single flow but rather is an aggregate capacity. That especially applies in non-prefilter uses where the Snort performance (a given flow uses a given instance which is running on a single core), but also applies to prefilter where only LINA and not Snort is in play.

Re: Secure firewall 3105 throughput

MHM Cisco World — Fri, 12 Jan 2024 04:24:18 GMT

firepower performance estimator

If you can access to this' check the throughput when using 1g and 10g.

MHM

Re: Secure firewall 3105 throughput

peter.matuska1 — Fri, 12 Jan 2024 07:06:49 GMT

ok, so it is by design. I tested the same with different vendor, FW was installed in vmware and single flow was reaching 4Gbps and by adding the CPU it was rising. thank you

Re: Secure firewall 3105 throughput

peter.matuska1 — Fri, 12 Jan 2024 07:23:55 GMT

one more question. How about IPSec throughput? datasheet says 5,5Gbps. The question is whether I can reach this speed between 2 sites.