XGS series: SSL/TLS inspection throughput improvement

Question

In XGS series, SSL/TLS inspection throughput has increased significantly compared to XG series. 
 I guess the inspection is processed not by NPU (Xstream processor) but by CPU and I'm interested in how it was possible to achieve such a significant performance improvement. 
 75 Mbps in XG 86 -> 375 Mbps in XGS 87 (5X improvement) 230 Mbps in XG 210 -> 1,100 Mbps in XGS 2100 (4.8X improvement) 
 According to the brochures below, the test methodology might be different between XG and XGS. 
 Performance Test Methodology XG series https://www.sophos.com/en-us/medialibrary/pdfs/factsheets/sophos-xg-series-appliances-brna.pdf Xstream SSL decryption: Measured with IPS and Threat Protection enabled using HTTP traffic with 192KB response size. 
 XGS series https://www.sophos.com/en-us/medialibrary/pdfs/factsheets/sophos-firewall-br.pdf TLS inspection: Performance measured with IPS with HTTPS sessions and different cipher suites 
 Your appropriate advice will be appreciated.

Prism · Answer

The testing methodology is completely different from the XG series to the XGS. 
 On the XGS Series, they are only measuring the TLS Inspection throughput with IPS activated. 
 Meanwhile, on the XG Series It has been measured with almost everything enabled, including IPS, Application Control and AV. 
 It's &ldquo;known&rdquo; enabling the AV can halve the throughput of the appliance over HTTP Traffic. 
 If you want to have a &ldquo;good&rdquo; comparison, compare the &ldquo;Threat Protection&rdquo; Throughput between those appliances. (Which nearly doubled the throughput on the high-end appliances.)

LuCar Toni · Answer

It is a increase of the NPU and the new architecture more optimized to the given hardware.

XGS series: SSL/TLS inspection throughput improvement

Top Replies