Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 19 replies
  • Subscribers 31 subscribers
  • Views 5528 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Slow TLS Decryption throughput compared to Web Proxy with KVM on v18 GA.

Prism

I've been converting my XG bare metal setup to a VM one using KVM+QEMU as the hypervisor.

The problem here is, the Web Proxy Decryption is much faster than the new DPI Engine for TLS Decryption, but currently, only on KVM.

 

Some Information about the Setup.

  • I'm using the VirtiO Drivers, which currently doesn't support Fast Path, but still, It's much faster than vmxnet3.
  • The XG VM have full access to all CPU Flags (Also AES-NI), I'm currently using a host-passthrough for the VM.
  • The XG VM have 6C/12GB RAM.
  • Host have 8C/16T / 32GB RAM.
  • M.2 SSD, both VM has been using VirtiO for the Disks.

 

Tested this using curl + nginx, the encrypted connection used TLS_AES_128_GCM_SHA256, 128 bit keys, TLS 1.2.

4GB iso file being transferred over HTTPS.

 

Without TLS Decryption or WebProxy | IPS+AV+ATP =  ~287MB/s
With TLS Inspection | IPS+AV+ATP = ~33.5MB/s
With WebProxy + Decryption | IPS+AV+ATP = ~213MB/s

Using the new DPI engine for TLS Decryption I get hard stuck at ~35MB/s, doesn't matter the TLS traffic being decrypted.

 

I'm doing something wrong? I believe there's something wrong with this.

 

Also XG v18 GA is much faster in raw throughput than v17.5. With IPS Iperf3 has capable of 7.21 Gbits/sec with the XG VM, so CPU isn't the issue here.



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to Keyur

    I would recommend to disable the VFP (Virtual fast path).

    console> system firewall-acceleration show
    Firewall Acceleration is Enabled. Fastpath Load Failed.

    (Disable / Enable)

    Try disable and recheck, if the performance is increased or decreased. 

    __________________________________________________________________________________________________________________

  • 0 in reply to Keyur

    Thanks, but the focus of this article is for devices that are having connection issues with DPI.

    In my setup DPI is working perfectly with all my devices, the only problem here is throughput for It's decryption, and only on KVM.

    Bare metal performance with XG is really good on v18.

    If a post solves your question use the 'Verify Answer' button.

    XG 115w Rev.3 8GB RAM v19.5 MR1 @ Home.

  • 0 in reply to LuCar Toni

    Enabling or Disabling the VFP doesn't make a difference for decryption throughput on both DPI and Web Proxy.

    Also showed "Firewall Acceleration is Enabled. Fastpath Load Failed." (Before Disabling.)

    Fastpath It's not supported on Virtio. (Already been discussed on v18 EAP Forum, NC-54940)

     

    I'm starting to believe this is only an issue in my end.

     

    Thanks!

    If a post solves your question use the 'Verify Answer' button.

    XG 115w Rev.3 8GB RAM v19.5 MR1 @ Home.

  • 0 in reply to LuCar Toni

    I would be interested in the features behind "firewall-acceleration" and whether it should be used in virtual appliances (mainly KVM with virtio-net :-) ) as well or not. Are there any pros and cons regarding latencies and/or bandwidth?

    Is there any information available?

    Thanks and Best Regards

    Dom

  • +1 in reply to Dom Nik

    Firewall Acceleration is basically the VFP (Virtual Fast Path) architecture. 

    Here is the DOC: https://docs.sophos.com/nsg/sophos-firewall/18.0/releasenotes/en-us/nsg/sfos/releasenotes/rn_FastPath.html

     

    As written there: 

    For virtual deployments, Virtual FastPath supports the VMware ESXi hypervisor. For other hypervisors, such as KVM, turn off FastPath using the CLI command for firewall acceleration.

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    Thanks for the reply. :-)

    I missed searching the help docs somehow.

    Best Regards

    Dom

Cookie Information Banner