SFOS 18.0.3 MR-3 - DPI performance

What hardware do you use? 

And how do you measure the throughput?

Prism can maybe comment on this.

SG 210 Rev 3 and i do plain speedtest on the net here: https://xn--bredbnd-ixa.dk/hastighedstest

I know it's not iPerf, but I wondered shy the numbers are so big in difference.

SG 210 Rev 3 and i do plain speedtest on the net here: https://xn--bredbnd-ixa.dk/hastighedstest

I know it's not iPerf, but I wondered shy the numbers are so big in difference.

What about two session at the same time? 

One in chrome, one in Edge for example? 

Wow good point, i am confused (and  embaressed)!

testing with Firefox gives 377Mbit - Edge only 170?!

Would suggest to start a summary. Try incognito mode. Try multiple session at the same time through XG. Write down the results. 

Stream based DPI always benefits of multiple streams. 

Edge In-private 176Mbit

Firefox Private 413Mbit (Ful speed of ISP)

Chrome In-Cognito 176Mbit

So Edge af Chrome same engine, maybe that fools me?

But why are only Firefox faster?

I have not uploaded Appliance cert info firefox.

Does firefox uses the DPI engine and Chrome / Edge not? Both uses the client internet settings. Therefore if you have a standard proxy configured, it will use the direct proxy (port 3128). Check this. 

Unknown said:

I have not uploaded Appliance cert info firefox.

Firefox doesn't use your system CA store, It has It's own; Since you didn't upload the certificate into Firefox and didn't got any warnings while browsing, It means It is using the Web Proxy without HTTPS Decrypt - hence if It has using DPI and you have the TLS Inspection rules in place, Firefox would give a warning saying that the firewall certificate is not trust-able.

Unknown said:

Edge In-private 176Mbit

Firefox Private 413Mbit (Ful speed of ISP)

It's hard to measure firewall throughput through HTTP speed-tests. But It shouldn't be that slow for the SG 210 Rev. 3.

Also, can you take a picture of the CPU usage with "top -d 1" command on the shell while doing a speed test ?

Prism said:

Firefox doesn't use your system CA store, It has It's own; Since you didn't upload the certificate into Firefox and didn't got any warnings while browsing, It means It is using the Web Proxy without HTTPS Decrypt - hence if It has using DPI and you have the TLS Inspection rules in place, Firefox would give a warning saying that the firewall certificate is not trust-able.

I know about the CA, that's why I wondered how it still could access the web?

I have this only rule, if that is disabled, FF cannot access the web either:

TLS inspection rule:

Here is the TOP -D1 screenshot:

Also it's shows as being decrypted?

FF show this when visiting website and the cert is NOT imported into firefox:

The cert is only imported to the machine cert store thorugh GPO.

support.sophos.com/.../KB-000035645