I'm working to validate the speeds through our Firepower 2110 & 2120 devices (running 7.0.1 snort3). We recently bumped the speed on our internet connection to 1gig, but these two devices don't seem to be able to handle the throughput. As it stands, we have our devices configured in transparent mode using BVIs. The primary allow rule has IPS configured on it. IPS is set to balanced security vs connection.
If i take two machines and put them side by side, and file transfer or use iperf, I get full gigabit speed (roughly 800-900Mbits). As soon as I introduce one of the above models to the mix, the speed drops to roughly 350Mbits. I've found the following settings improve the speed:
Done in this order:
Remove IPS: 500Mbits acheived
Switch to inline/passive transparent mode: 700-750Mbits Acheived
Implemented prefilter allow all with fastpas: 850Mbits (or full speed) acheived
Ideally I'd like to have IPS still enabled and be able to get better than 10-15% the rated IPS capabilities. Is there something silly I'm missing with this that would improve the throughput?
I've tried switching them to routed mode, and backing them up to snort2, plus a long list of disabling and enabling different settings and the above are the only things I could see that affected the throughput in anyway.
