Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 10 replies
  • Subscribers 9 subscribers
  • Views 3398 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Is software UTM performance limited?

brimur

Hi all, I am running Sophos UTM Home (currently 9.702-1) for years and have been very happy with it. I have always had it running as a VM in ESXi on a NUC and with IPS running I was limited to about 340Mbps. This was fine since my internet downstream was 100Mbps, then 250Mbps and then 360Mbps.

I have a big brother to the NUC which is a 20-core (3.5GHz) Xeon ESXi server so when my internet connection went up to 600Mbps I moved the Sophos VM to that big ESXi server. The config is the same on both so I didnt have to change anything but I noticed I was still limited to about 375Mbps (vs 340Mbps on the NUC) on the big server. Turning off IPS I was seeing the full 600Mbps.

CPU usage was only hitting 25% when running a speedtest but just to be sure I shutdown the VM and gave it 16GB of RAM (up fom 4GB) and 16 cores (8cores x 2 sockets up from 4 cores x 1 socket), started up the VM and reran the speedtest (various providers) and again hit a limit of around 375Mbps. I turned off IPS and it jumped up to the full 600Mbps.

So I am wondering what is the reason for this? Even if the Home version was limited to 4 cores/cpus, the 4 cores @ 3.5GHZ that should still be more than enough horsepower to do IPS at 600Mbps.

Thanks



This thread was automatically locked due to age.
Parents
  • 0

    You need to put exceptions in place for speedtests. Once you do that, they go full speed, it's IPS doing it's thing.

     

    You have some more in depth tuning available here: https://community.sophos.com/kb/en-us/132399

     

    Be warned, you might have very interesting results so be cautious. Ive tried some of these on a 330 SG and it gave various mixed results.

  • 0 in reply to Sophos User287

    That's just like cheating; putting exceptions in place just for the speedtest sites so they show good throughput. What you want to have is good throughput overall not just on the speedtest site....

    For that to happen with the single core snort process you need the fastest single-core processor (in terms of MHz) that you can find. But usually if more people are simultaneously using the internet connection, each user can (and will) use a snort core and thus the total throughput could be higher than just the speedtest of 1 user shows.

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

Reply
  • 0 in reply to Sophos User287

    That's just like cheating; putting exceptions in place just for the speedtest sites so they show good throughput. What you want to have is good throughput overall not just on the speedtest site....

    For that to happen with the single core snort process you need the fastest single-core processor (in terms of MHz) that you can find. But usually if more people are simultaneously using the internet connection, each user can (and will) use a snort core and thus the total throughput could be higher than just the speedtest of 1 user shows.

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

Children
No Data
Unfiltered HTML