topic The IPS feature hurts the in Network Security

5506-X Performance in the Real World

james.tucker — Tue, 12 Mar 2019 07:32:11 GMT

Hi All,

I'm looking to roll out a few 5506-X's to our branch offices that have between 2 and 25 users on them. At the same time I'm looking to get them to join our OSPF backbone but I am a little concerned about their ability to cope with the enabling of all the potential new features, URL filtering, AMP etc etc as well as maintaining a routing table of approximately 200 routes.

Each location would have 4 interfaces in use, outside, mpls, dmz and inside, with all inter-vlan routing for the clients/servers/wifi/voip being offloaded to L3 switches. The the internet connection would be up to 50Mbps, the MPLS 10Mps and the DMZ would have SIP traffic from the internet and the inside running over it.

On the current 5505's some connections stats:

782 in use, 3032 most used

655 in use, 1441 most used

1402 in use, 2534 most used

Checking the data sheet the number of connections is fine but expect that the throughput for the 5506-X is probably going to be significantly impacted with all the features turned on (not decided if we will use them all yet...) and it would be interesting to get the the communities real world experience of this little box in action.

Any perspectives much appreciated!

James

The IPS feature hurts the

Philip D'Ath — Wed, 23 Mar 2016 19:34:30 GMT

The IPS feature hurts the performance, but the other are not so bad. If you leave IPS off I think we were easily getting 100Mb/s. Can't remember what it sank to with IPS on.

With all services enabled I

Karsten Iwen — Thu, 24 Mar 2016 22:27:52 GMT

With all services enabled I get a throughput of a little under 40 MBit/s. This is on a 5506-X with FP v6.0.0.1 in transparent mode I'm running at home. Without AMP and/or IPS, I can completely utilize my 50 MBit/s internet connection. There is no SSL-inspection configured yet, I'll test that later but I assume that it'll drop even more with that.

current 5505 work internet

Tagir Temirgaliyev — Fri, 25 Mar 2016 19:57:46 GMT

current 5505 work internet connection 50Mbps and the MPLS 10Mps ?

Yes, a 5505 can handle that,

Karsten Iwen — Fri, 25 Mar 2016 20:53:32 GMT

Yes, a 5505 can handle that, but the security services of a 5505 are in no way comparable to what is discussed in this thread.

Thanks for the feedback,

james.tucker — Mon, 28 Mar 2016 07:44:46 GMT

Thanks for the feedback, definitely depends on what the use case is whether or not it will be suitable. SSL decryption would be nice, this post suggests 60 - 80% performance hit with it enabled - not sure if they also have IPS etc enabled.

I suspect that I might end up with the 5508-X for the small branches (which on paper looks like a better performer than the 5512-X??) and do the cost/performance/features juggling trick

Do you know if the SSL decryption is done on the main CPU on all SMB models or is there a point at which there is dedicated processor unit for this in, say, the 5516-X and upwards?