UTM 9 - ASG320 Maximum throughput with IPS / SNORT limitation

Question

Hi Everyone 
 Trust that all are well 
 I know that the SNORT engine which is used by IPS in the UTM is limiting your download speed. 
 What is the maximum Download and Upload speed / throughput I will achieve on a 200MB Fibre link ? 
 Thank you in advance 
 Kind Regards 
 Francois

sachingurung · Answer

Hi Francois, 
 That depends on the hardware capability, it is a tricky one to answer. The Sophos UTM uses the Snort Inline engine for IPS functionality, and by design, the Snort engine uses only a single CPU even on systems with multiple CPUs installed. The IPS scanning engine can launch multiple processes on multiple CPU cores however only one process is used per IP source and destination pair. As the speed of the connection increases the demand on the system resources also increases to process the increased packet flow. When using a fast network connection there will come a point where the available network bandwidth is greater than the speed in which the IPS process can scan the traffic resulting in the CPU core running the process to reach 100%. There are no exact figures for this impact because it depends on the model of UTM and what else the system is doing at the time.Thanks 
 To get around the Snort limitation the Sophos UTM creates multiple IPS instances which work in parallel with each instance using a different CPU. To ensure that other UTM processes have enough processing power, 1 CPU is set aside and by default not used by the IPS engine. On smaller UTM models with only 2 CPUs the result is that only a single Snort instance is used, which may result in lower than the desired throughput when using IPS scanning. 
 Thanks