Firepower throughput issue

[Khurram Tariq]

Dear All

we are using 5516X firewalls in HA and all the network passed through the firewalls.we have 400 MB link leased line. we have redirect policy for all the traffic to firepower and managing it from Firepower Management center as fail close.now we are having throughput issue for the traffic passes through the firepower. As we are getting around 200 MB speed on the user vlan which is passes through firepower.we have tested removing redirection for the user VLANs and we are getting speed around 370 MB which should be with firepower also. initially we have used Intrusion policy for all over rules i Management center byt we have removed intrusion inspection also and using only AMP and URL filtering but still speed is same.

please let me know what could be the issue or its idea fr the traffic passes through firepower. we have firepower version 6.1.x and management center also the same.

[Oliver Kaiser]

ASA 5516-X sizing throughput (AVC or IPS enabled) is 300Mbps. AMP can result in a performance penalty of around 30-50% depending on configuration. When we calculate the throughput using the maximum AVC/IPS performance which is rated at 450Mbps and apply AMP penatly of 50%, 200Mbps sounds like a reasonable result.

You might want to try disabling AMP and testing again. URL Filtering shouldnt have a significant performance hit.

Let me know if that helps.

[Khurram Tariq]

Thanks for your suggestions i just double checked 5516X throughput with IPS and AVC is 450 Mbps, we yesterday we had disable IPS from all rules and checked but still speed was around 200, but i will try to disable AMP also as you suggested.

its cutting throughput like 50 % of total bandwidth i don't  think so IPS and AMP can take 50 % of throughput

[Oliver Kaiser]

450 Mbps is referenced in the datasheet but depending on the feature set you use and the traffic patterns in your network this numbers wont hold up.

The 300Mbps I mentioned are from a 2016 Cisco Live session:

The performance impact of AMP is real. The numbers are from a sizing guide for firepower.

[Khurram Tariq]

hey kaisero can you send me the link of the comparison sheet ??