Cisco ASA throughput.

[milan.glusac]

Hi,

Can someone tell me maxumum throughput on ASA 5516x  if AMP and IPS are on.

We can't get more than 50 Mbit/s on download and 35 Mbit/s on upload.

If i remove AMP and IPS from rule d/u is normal.

[johnlloyd_13]

hi,

see table 2 on this link:

http://www.cisco.com/c/en/us/products/collateral/security/asa-5500-series-next-generation-firewalls/datasheet-c78-733916.html

there's a note which says: Activating more features will change performance  

[osiega001]

a 5516-x should be capable of doing 450 Mbps max with avc and ips according to the specs.

In the real world this seems just about 120Mbps for me and Milan is even reporting less..

I think this difference is just too much...

[milan.glusac]

Yes it shoud be at least 120-150 Mbps. 

Here is the rule with AMP only and still it's slow.

[osiega001]

Try to add a filter for application: like HTTP or FTP and see if it helps

[milan.glusac]

Alredy tried that . Didn't help either.

[osiega001]

Did you try to reload the firewall?

It solves many other issues here...

[Marvin Rhoads]

AMP is the most resource-intensive NGIPS feature.

The numbers you are seeing are about what is expected with AVC + IPS + AMP + URL features all active.

[milan.glusac]

Hi,

We also tested ASA 5515 and we got 3x better results with same configuration.

5515 is rated below 5516 so i am confused.

TAC told as that since 5516 have 3 cores throughput is splitted , but i can't find any documentation about that.