Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 6 replies
  • Answers 2 answers
  • Subscribers 29 subscribers
  • Views 1080 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XGS series: SSL/TLS inspection throughput improvement

Taku


In XGS series, SSL/TLS inspection throughput has increased significantly compared to XG series.

I guess the inspection is processed not by NPU (Xstream processor) but by CPU and I'm interested in how it was possible to achieve such a significant performance improvement.

75 Mbps in XG 86 -> 375 Mbps in XGS 87 (5X improvement)
230 Mbps in XG 210 -> 1,100 Mbps in XGS 2100 (4.8X improvement)

According to the brochures below, the test methodology might be different between XG and XGS.

Performance Test Methodology
XG series
https://www.sophos.com/en-us/medialibrary/pdfs/factsheets/sophos-xg-series-appliances-brna.pdf
Xstream SSL decryption: Measured with IPS and Threat Protection enabled using HTTP traffic with 192KB response size.

XGS series
https://www.sophos.com/en-us/medialibrary/pdfs/factsheets/sophos-firewall-br.pdf
TLS inspection: Performance measured with IPS with HTTPS sessions and different cipher suites

Your appropriate advice will be appreciated.



This thread was automatically locked due to age.
Parents
  • 0

    The testing methodology is completely different from the XG series to the XGS.

    On the XGS Series, they are only measuring the TLS Inspection throughput with IPS activated.

    Meanwhile, on the XG Series It has been measured with almost everything enabled, including IPS, Application Control and AV.

    It's “known” enabling the AV can halve the throughput of the appliance over HTTP Traffic.

    If you want to have a “good” comparison, compare the “Threat Protection” Throughput between those appliances. (Which nearly doubled the throughput on the high-end appliances.)

  • 0 in reply to Prism

    Interesting how aes-ni has been offloaded from the cpu to avoid providing that feature in the software version. Also provides reduced performance to businesses that use a vm version.

    ian

Reply Children
No Data