This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG and UTM performance question

pokal sing over 2 years ago

We're having 1Gbit internet installed and by Sophos' own tech sheets the XG 210 would be an appropriate device.

Do the spec sheet numbers line up with performance in reality?

Is the XG 210 likely https://19216811.cam/ to handle 1Gbit line speed with all services turned on?

Is there a rule of thumb for performance sizing on these devices depending on what services are turned on?

Thanks in advance .

This thread was automatically locked due to age.

0 Amodin over 2 years ago

I am not abundantly familiar with XG quite yet, but I do know that in UTM, Snort is used and is still a single-threaded process - which is the web filter used in UTM. It's also widely known to bring internet speeds to a crawl. As an example, I have a 50mb download, at best I get with IPS on, it's at 7.5mb.

I *believe* XG is using something different, but performance wise and configuration, I don't know if it limits the speeds with the tech it uses.

OPNSense 64-bit | Intel Xeon 4-core v3 1225 3.20Ghz
16GB Memory | 500GB SSD HDD | ATT Fiber 1GB
(Former Sophos UTM Veteran, Former XG Rookie)
Cancel
Vote Up 0 Vote Down

Cancel
0 alan weir over 2 years ago in reply to Amodin

There is already a thread on this topic...https://community.sophos.com/sophos-xg-firewall/f/discussions/125452/snort-3-on-sophos-xg/458458#458458
Cancel
Vote Up 0 Vote Down

Cancel
0 Wayne Folta over 2 years ago

Is this an XG-210 that you own and are wondering if it's up to the task, or are you thinking of somehow buying one? Just in case you weren't aware, the XGS series has replaced the XG series and is considerably faster.
Cancel
Vote Up 0 Vote Down

Cancel
0 Wayne Folta over 2 years ago in reply to Amodin

I'm pretty sure Sophos works around Snort 2.X's single-threadedness by running multiple copies of Snort in the XG. At least I see multiple Snort processes when I'm in the Advanced Shell.
Cancel
Vote Up 0 Vote Down

Cancel
0 JosefBergmann over 2 years ago in reply to Amodin

Hi Amodin,

quick note, on the UTM they run multiple copies of snort (like in the XG). You can tweak the copies of snort -> Sophos UTM: Low throughput with Intrusion Prevention (IPS)

bye Josef

BERGMANN engineering & consulting GmbH, Wien/Austria
Cancel
Vote Up 0 Vote Down

Cancel