UTM 9 - IPS tweaking?

I also see this in my IPS log, not sure what what the warning means?

With IPS enabled, you will get a bit lower speed.  That's the nature of filtering, and with Sophos not updating Snort to a multi-threading capable version, it won't get any better unless IPS is disabled unfortunately.  XG may be different in handling this, and I'm sure it is, but... I don't use that product.

Andrew English said:

WARNING: normalizations disabled because DAQ can't replace packets.

That's a Snort warning, but it can be ignored for the most part, I believe.

With IPS enabled, you will get a bit lower speed.  That's the nature of filtering, and with Sophos not updating Snort to a multi-threading capable version, it won't get any better unless IPS is disabled unfortunately.  XG may be different in handling this, and I'm sure it is, but... I don't use that product.

Andrew English said:

WARNING: normalizations disabled because DAQ can't replace packets.

That's a Snort warning, but it can be ignored for the most part, I believe.

Yeap I saw another post mentioning lowering the 12 months to 6 months to improve the bandwidth but there is a cost to doing that. Funny enough my IPS on my home lab UDM-Pro doesn't affect my 1Gbit bandwidth at all. Makes me wonder if its even enabled. LOL

Hi Andrew and welcome to the UTM Community!

As Alan and Amodin have said, Snort is single-threaded, so you will want to do speed tests on at least 2 devices simultaneously.

Cheers - Bob