FTD 1000 vs 2100 TLS performance

[tato386]

I was browsing Cisco's web site looking specifically for SSL/TLS decryption specs for 1000 and 2100 FTD devices when I ran into something I did not expect.  According to the site (see attached files) the 2100 family has better specs pretty much across the board *except* for TLS?  Is this an error or misprint?

Another thing I noticed is that specs for FW+AVC, FW+AVC+IPS and for TLS are separated.  What about if I would like to use all four features, meaning FW+AVC+IPS+TLS?  How is that measured/rated?

Thanks,

Diego  

[Marvin Rhoads · Accepted solution]

Due to the CPU used, the Firepower 1000 series are able to use Intel Quick Assist Technology (QAT) and get better TLS performance as a result.

https://www.intel.com/content/www/us/en/architecture-and-technology/intel-quick-assist-technology-overview.html

The TLS numbers generally aren't stressed unless the firewall is serving a large number of remote access VPN clients so it's usually not the gating performance factor when considering which device is recommended. Overall throughput as bounded by the "FW+ x" numbers is usually more important.

[tato386]

Thanks for the link Marvin.  In my case I won't be doing much VPN.  My main concern is maximum IPS protection of web servers behind the firewall.  Given that almost all web traffic is encrypted nowadays, which numbers should I be concentrating on?

[Marvin Rhoads]

If you are planning to do SSL/TLS decryption of your web servers' traffic then it's a whole other calculation as that is much more CPU-intensive than basic TLS termination.

You might want to check with your Cisco SE or reseller to have them run the numbers through Cisco's internal / partner performance tool for that use case.

[tato386]

Sounds like a plan.  Thx