Home UTM - Recommend specs for 1000Mbps fibre

Filtering/IPS is CPU intensive, so you will want something a lot more than what you have if you want to see more than 10% of your speed.  ;)  

I have the same issue with my setup currently, as I have a 50/10 and have never seen that with a UTM in the way, because I have a duo core CPU, so the most I ever see at one of my computers is about 7 MB download.  The filtering needs for CPU with this product is crazy, and frankly what prompts me to find alternatives at times.

Interesting - it's a Core 2 Duo but able to sustain 100Mbps up and down without any issues.

It's now a 300/300Mbps connection but the Home UTM even with IPS disabled doesn't appear to increase either.

It won't just be IPS, but Web Filtering as well and some rules can also slow things down.  I didn't see any improvement with XG either, but I also didn't stay on that very long at all and went back to UTM.

I have not tried anything else out there like PFsense, but at one point did have a nice Cisco PIX and I never saw slowdowns like I do with UTM filtering.

Oh thanks - what other modules/rules are you referring to? Most are pretty standard out of the box config.

The Core 2 Duo is still able to handle 100/100 Mbps up and down so that's actually alright - I'm at the stage of determining if the CPU is constrained, running the cli speedtest only triggers both CPU to around 20-25% utilised.

One thing to keep in mind is supposedly the IPS is only able to utilize a single core of the CPU. The newer version of Snort (which is the IPS) can use multiple cores but Sophos choose to use the old version for some reason. Ideally you'd want a CPU with the fastest speed possible, even if it has less cores. You should be looking into a PC with an Intel i5 or Intel i3 cpu instead of the much older core 2 Duo if you can.

Just something to keep in mind. There are tons of refurbished desktop PCs that have this CPU. All you'd need to do then is purchase a dual port Gigabit Intel NIC to go with it. 

I should be more specific - snort rules.  Like Alan said below, snort by default is single core, and the more connections you have the less efficient this can run and slow down (one core per session).  You can enable multiple cores with a single line command in SSH/Putty into the UTM to open up the core usage.  

Here is a link to a post that has good information about this: Cores or Clock speed important in a CPU for IPS (snort) with a 1GBPS Internet Bandwith? - General Discussion - UTM Firewall - Sophos Community