After spending a lot of time looking at Sophos UTM, I may finally have some budget to actually deploy it. I would be very grateful for anyone’s input on the below. We are an SME, with 18 users on site. We would be looking a licensing the Network and Web protection modules only. I would be looking to use the IPS and dual engine HTTPS AV scanning, web filtering and application control. As well as QOS for VOIP. There won’t be that much VPN usage, possibly 1-2 users max. We currently have an FTTC connection with 80 megabits down 20 megabits up, however I’m trying to get an FTTPoD connection installed at some point (which would do 330 megabits down and 30 megabits up), ideally I would like a solution that could scale to match the FTTPoD if we do manage to get one installed. Potential deployment options: [LIST=1] Either an SG115, which would cover the FTTC connection ok but not the FTTPoD, or an SG135, which would cover the FTTPoD connection, but would be a lot more expensive. We have a Microserver Gen 8, with 10GB of RAM, Celeron G1610T and 2 Seagate NAS drives in RAID 1. This is currently running Hyper-V 2012 R2. I would be looking to run the UTM as a VM on this. Judging by Barry’s (very useful) benchmarks of the Gen8 it should be able to handle the FTTC fine, but might not be able to handle the 330 megabits per second of the FTTPoD. Get a Jetway JBC311 , and put in 4 GB of ram and resilient SSD (something like an 850 pro). [/LIST] Questions: [LIST=1] Is there much performance penalty from running the UTM as a Hyper-V VM and not directly on the machine (assuming the UTM VM is the only one on the host). I.e. can I expect to see Barry’s Gen8 figures if the UTM is in a VM instead of on the metal? How does the Jetway compare to the Sophos appliances? It has a quad core baytrail N2930 as well as Intel NICs. Having read the HW Appliance tech specs thread , I guess it should out perform the SG125? Can Sophos UTM decrypt traffic that uses the SPDY protocol? We currently use Google Apps for email with Chrome, and I know chrome uses SPDY to communicate with the Gmail servers. [/LIST] I’m leaning towards the Gen8 option as we already have the hardware and if we did get the FTTPoD connection I could always upgrade the hardware. But would be interested to hear what you guys thought would be suitable hardware for this use case. Thanks for any help.

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos UTM sizing for 18 users

After spending a lot of time looking at Sophos UTM, I may finally have some budget to actually deploy it. I would be very grateful for anyone’s input on the below.

We are an SME, with 18 users on site. We would be looking a licensing the Network and Web protection modules only. I would be looking to use the IPS and dual engine HTTPS AV scanning, web filtering and application control. As well as QOS for VOIP. There won’t be that much VPN usage, possibly 1-2 users max.

We currently have an FTTC connection with 80 megabits down 20 megabits up, however I’m trying to get an FTTPoD connection installed at some point (which would do 330 megabits down and 30 megabits up), ideally I would like a solution that could scale to match the FTTPoD if we do manage to get one installed.

Potential deployment options:
[LIST=1]

Either an SG115, which would cover the FTTC connection ok but not the FTTPoD, or an SG135, which would cover the FTTPoD connection, but would be a lot more expensive.
We have a Microserver Gen 8, with 10GB of RAM, Celeron G1610T and 2 Seagate NAS drives in RAID 1. This is currently running Hyper-V 2012 R2. I would be looking to run the UTM as a VM on this. Judging by Barry’s (very useful) benchmarks of the Gen8 it should be able to handle the FTTC fine, but might not be able to handle the 330 megabits per second of the FTTPoD.
Get a Jetway JBC311, and put in 4 GB of ram and resilient SSD (something like an 850 pro).

[/LIST]

Questions:
[LIST=1]

Is there much performance penalty from running the UTM as a Hyper-V VM and not directly on the machine (assuming the UTM VM is the only one on the host). I.e. can I expect to see Barry’s Gen8 figures if the UTM is in a VM instead of on the metal?
How does the Jetway compare to the Sophos appliances? It has a quad core baytrail N2930 as well as Intel NICs. Having read the HW Appliance tech specs thread, I guess it should out perform the SG125?
Can Sophos UTM decrypt traffic that uses the SPDY protocol? We currently use Google Apps for email with Chrome, and I know chrome uses SPDY to communicate with the Gmail servers.

[/LIST]

I’m leaning towards the Gen8 option as we already have the hardware and if we did get the FTTPoD connection I could always upgrade the hardware. But would be interested to hear what you guys thought would be suitable hardware for this use case.

Thanks for any help.

This thread was automatically locked due to age.

Parents

0 BarryG over 10 years ago

Hi,

1. At least you will loose a lot of the server's RAM when using virtualization. I would say run the HP bare-metal, but you won't be able to use RAID with UTM and the built-in HP controller.
Even still, I would probably go with the bare metal on the HP.
The CPU in the HP can be replaced with a quad-core Xeon E3-1265 v2, but it's clock speed will still be low.

2. the SG115 has a dual-core Baytrail Atom CPU, and 4GB RAM.
Jetway: probably a bit faster than the 115, but peak single-stream throughput would be similar as the Snort IPS cannot split a stream across multiple CPU cores.

I'm not too keen on anything that can't go beyond 4GB RAM, including the SG115.

3. SPDY: I'm not sure. I've seen some complaints about problems with it, but that was a few months ago.

If it were me, I'd use the HP for now, bare-metal. If it's not fast enough, find something with a fast i5 or i7 CPU, more than 4GB RAM, and Intel or Broadcom NICs.

Upgrading the HP to a Xeon probably isn't worth it for the UTM alone, but might be worth it for a VM server (but note max 16GB RAM and the CPU isn't very fast for the IPS).
I upgraded mine, and then realized 16GB isn't enough RAM for my needs; I should have spent the money on a different system

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 Vanburen over 10 years ago in reply to BarryG

Hi,

1. At least you will loose a lot of the server's RAM when using virtualization. I would say run the HP bare-metal, but you won't be able to use RAID with UTM and the built-in HP controller.
Even still, I would probably go with the bare metal on the HP.
The CPU in the HP can be replaced with a quad-core Xeon E3-1265 v2, but it's clock speed will still be low.

2. the SG115 has a dual-core Baytrail Atom CPU, and 4GB RAM.
Jetway: probably a bit faster than the 115, but peak single-stream throughput would be similar as the Snort IPS cannot split a stream across multiple CPU cores.

I'm not too keen on anything that can't go beyond 4GB RAM, including the SG115.

3. SPDY: I'm not sure. I've seen some complaints about problems with it, but that was a few months ago.

If it were me, I'd use the HP for now, bare-metal. If it's not fast enough, find something with a fast i5 or i7 CPU, more than 4GB RAM, and Intel or Broadcom NICs.

Upgrading the HP to a Xeon probably isn't worth it for the UTM alone, but might be worth it for a VM server (but note max 16GB RAM and the CPU isn't very fast for the IPS).
I upgraded mine, and then realized 16GB isn't enough RAM for my needs; I should have spent the money on a different system

Barry

1. Unfortunately it has to stay as a Hyper-v server as its currently being used to host a PBX VM and as a backup target for the the main Hyper-V host, I can move the PBX VM to the main host but it still needs to act as the backup target, also it allows me to shutdown the system with the UPS and use the onboard raid as you said.

2. yes its a shame about the 4GB limit, saying that the CPU supports 8GB, and I have seen it mentioned elsewhere that the Jetway can take 8GB. It might be a case of it *might* work, but won't be officially supported. Would be a great little box if it could.

Thanks for the advice, I think I will try running it as a VM and see how it goes. And build an i5 system if it becomes necessary. Would it be hard to transfer licensing between the VM and a new install?
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Vanburen over 10 years ago in reply to BarryG

Hi,

1. At least you will loose a lot of the server's RAM when using virtualization. I would say run the HP bare-metal, but you won't be able to use RAID with UTM and the built-in HP controller.
Even still, I would probably go with the bare metal on the HP.
The CPU in the HP can be replaced with a quad-core Xeon E3-1265 v2, but it's clock speed will still be low.

2. the SG115 has a dual-core Baytrail Atom CPU, and 4GB RAM.
Jetway: probably a bit faster than the 115, but peak single-stream throughput would be similar as the Snort IPS cannot split a stream across multiple CPU cores.

I'm not too keen on anything that can't go beyond 4GB RAM, including the SG115.

3. SPDY: I'm not sure. I've seen some complaints about problems with it, but that was a few months ago.

If it were me, I'd use the HP for now, bare-metal. If it's not fast enough, find something with a fast i5 or i7 CPU, more than 4GB RAM, and Intel or Broadcom NICs.

Upgrading the HP to a Xeon probably isn't worth it for the UTM alone, but might be worth it for a VM server (but note max 16GB RAM and the CPU isn't very fast for the IPS).
I upgraded mine, and then realized 16GB isn't enough RAM for my needs; I should have spent the money on a different system

Barry

1. Unfortunately it has to stay as a Hyper-v server as its currently being used to host a PBX VM and as a backup target for the the main Hyper-V host, I can move the PBX VM to the main host but it still needs to act as the backup target, also it allows me to shutdown the system with the UPS and use the onboard raid as you said.

2. yes its a shame about the 4GB limit, saying that the CPU supports 8GB, and I have seen it mentioned elsewhere that the Jetway can take 8GB. It might be a case of it *might* work, but won't be officially supported. Would be a great little box if it could.

Thanks for the advice, I think I will try running it as a VM and see how it goes. And build an i5 system if it becomes necessary. Would it be hard to transfer licensing between the VM and a new install?
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data

Sophos UTM sizing for 18 users

Submitted a Tech Support Case lately from the Support Portal?