ASA Firepower throughput

[cisco8887]

Hi Guys,

I have noticed Palo Alto and other vendors specify a much higher throughput for their next generation solution compared to Cisco when they do the full URL filtering , anti virus and Spam protection

I think this is because they process the packet in parallel where as ASA processes it one by one module, is that right ?

As an example, ASA passed the traffic to URL filtering and then Spam and then ..

Where as Palo Alto passes it to URL and SPam and ... all at the same time hence achieving a significantly higher throughput.

based on this, is it correct to say Cisco cannot be the dealer in this area due to how they handle Firepower?

[cisco8887]

anyone :)

[Oliver Kaiser · Accepted solution]

I think the best way to look at this is by using NSS Labs reports. They publish a yearly report which includes a graph to see how much you pay per protected Mbit/sec. Since vendor published performance data is not always correct you may want to look at their findings.

I am not sure if you are talking about absolute throughput (e.g. PAN 7080 vs FP9300) but in case you do I would suggest looking at the relative numbers and check how much throughput you lose by using IPS for example.

About architecture: performance wise hardware will always beat software. FPGAs used for specific loads will always perform better than generic CPUs. The parallel processing is not something every vendor is doing. Try not to get lost in marketing buzz and just analyze the performance counters and see how they stack up when it comes to pricing - at the end of the day an architecture that results in 10% better performance but 100% higher price might not be what you are looking for. 

[aledipas · Accepted solution]

It is important to consider that the amount of traffic you can inspect with the SFR module will be inherently limited by how much traffic the ASA itself can pass. There are standalone (bare metal) appliances that can inspect substantially more traffic. The traffic ratings can be found on the spec pages for our Firepower appliances.

Thanks

[cisco8887]

thanks, do you have example of such physical appliances ?

[aledipas]

Our 7000, 8000, and 9000 series:

http://www.cisco.com/c/en/us/products/security/firepower-7000-series-appliances/index.html

http://www.cisco.com/c/en/us/products/security/firepower-8000-series-appliances/index.html

http://www.cisco.com/c/en/us/products/security/firepower-9000-series/index.html

Thanks!