This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Is software UTM performance limited?

Hi all, I am running Sophos UTM Home (currently 9.702-1) for years and have been very happy with it. I have always had it running as a VM in ESXi on a NUC and with IPS running I was limited to about 340Mbps. This was fine since my internet downstream was 100Mbps, then 250Mbps and then 360Mbps.

I have a big brother to the NUC which is a 20-core (3.5GHz) Xeon ESXi server so when my internet connection went up to 600Mbps I moved the Sophos VM to that big ESXi server. The config is the same on both so I didnt have to change anything but I noticed I was still limited to about 375Mbps (vs 340Mbps on the NUC) on the big server. Turning off IPS I was seeing the full 600Mbps.

CPU usage was only hitting 25% when running a speedtest but just to be sure I shutdown the VM and gave it 16GB of RAM (up fom 4GB) and 16 cores (8cores x 2 sockets up from 4 cores x 1 socket), started up the VM and reran the speedtest (various providers) and again hit a limit of around 375Mbps. I turned off IPS and it jumped up to the full 600Mbps.

So I am wondering what is the reason for this? Even if the Home version was limited to 4 cores/cpus, the 4 cores @ 3.5GHZ that should still be more than enough horsepower to do IPS at 600Mbps.

Thanks

This thread was automatically locked due to age.

Parents

0 Sophos User287 over 3 years ago

You need to put exceptions in place for speedtests. Once you do that, they go full speed, it's IPS doing it's thing.

You have some more in depth tuning available here: https://community.sophos.com/kb/en-us/132399

Be warned, you might have very interesting results so be cautious. Ive tried some of these on a 330 SG and it gave various mixed results.
Cancel
Vote Up 0 Vote Down

Cancel
0 Jay Jay over 3 years ago in reply to Sophos User287

That's exactly what I did for the few speedtest sites I visit often. The others are subject to the filtering and thus return slower speeds. I believe I have filters in place in both IPS and web filtering.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Jay Jay over 3 years ago in reply to Sophos User287

That's exactly what I did for the few speedtest sites I visit often. The others are subject to the filtering and thus return slower speeds. I believe I have filters in place in both IPS and web filtering.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 BAlfson over 3 years ago in reply to Jay Jay

Another trick is to check from the command line.

Copy and paste each block instead of just using single lines.

First, download the speed test:

cd /home
wget https://raw.githubusercontent.com/sivel/speedtest-cli/master/speedtest.py --no-check-certificate

Check the speed with IPS off, and then with it on.

cd /home
cc set ips status 0
sleep 15s
python speedtest.py
cc set ips status 1
sleep 30s
python speedtest.py

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel