topic Re: Throughput in Network Security

Throughput

elite2010 — Fri, 21 Feb 2020 17:14:25 GMT

Hi,

How the ips ,ngfw and threat protection throughput related to Firewall throughput

And what is the difference between the ips ,ngfw and threat protection throughput

Thanks

Re: Throughput

balaji.bandi — Tue, 25 Jun 2019 07:21:40 GMT

Depends on Design and network.

here is the information cisco point of view. :

https://www.cisco.com/c/dam/m/sl_si/events/2017/cisco-connect/pdf/ConnectSLO_Cisco-Next-Generation-Firewall-and-IPS.pdf

Re: Throughput

elite2010 — Tue, 25 Jun 2019 07:35:55 GMT

Hi,

Depends on Design and network.

Can you give an example .?

In normal case how these throughput influence each other

Thanks

Re: Throughput

elite2010 — Wed, 26 Jun 2019 05:34:33 GMT

Hi,

Firewall Throughput (ASA) is 3 gbps and FW + AVC throughput is1750 Mbps .

Does it mean it reduces th throughput if we enable FW+AVC

Thanks

Re: Throughput

Marvin Rhoads — Wed, 26 Jun 2019 06:06:21 GMT

Yes, enabling more features generally requires the appliance to do more work (consume CPU etc.) thus it slows down.

Imagine you can run a distance at whatever speed. Now imagine running the same distance carrying a heavy load. your speed will be slower.

Only on some of the newest appliances (i.e. Firepower 4100 and 9300 series) does speed remain close to uniform despite turning on additional features. That is because they have purpose built hardware (custom ASICs, network interface cards etc.) that is designed to offload those features which might otherwise be done with additional software processing and a general purpose CPU.

Re: Throughput

elite2010 — Wed, 26 Jun 2019 06:37:40 GMT

Hi,

If I am buying a ASA5545 With FTD image , which datasheet I shoud refer ?

https://www.cisco.com/c/en/us/products/collateral/security/asa-5500-series-next-generation-firewalls/datasheet-c78-733916.html

Why cisco says just IPS in some datasheets and some place says . NGIPS

what is the differnece between IPS and NGIPS

Thanks

Re: Throughput

balaji.bandi — Wed, 26 Jun 2019 07:45:39 GMT

Yes you add more advance features, the performance go down - since it required to process all the rules and intercept the traffic.

To be honestly - bewcuase organically grown this documents, Cisco have many cosmotic errors in the documentation

5545-X with FTD you can use ( if you buying new Device) suggest to go with firepower appliance directly rather ASA

like 2100/4XXX /9XXX depends on requirement.

Again all the models not going to support FTD check version and model before buying ASA.

IPS is traditional Cisco one

NGIPS - is the next generation IPS with Firrepower

Re: Throughput

elite2010 — Mon, 01 Jul 2019 07:37:32 GMT

Hi,

you said "5545-X with FTD you can use ( if you buying new Device) suggest to go with firepower appliance directly rather ASA"

You recommending asa 5545-x FTD or firepower appliances?

If firepower appliance which one you suggest ?

Thanks

Re: Throughput

balaji.bandi — Mon, 01 Jul 2019 15:08:39 GMT

Firepower Diretion 2100 / 4100 (for medium) - to replace 5545X