This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

UTM110-Performance --> upgrade to SG1xx/SG2XX?

Hi there,

I had deployed several UTM 110 boxes at customer sites troughout 2014.

One customer (16 mps down/1mbps up ADSL) is now experiencing delays while browsing websites. He told me that usually websites needed about 3 to 4 seconds to open up completely. Now sometimes they need up to 15 seconds according to him.
Firmware is 9.211-3 (I know... will be upgraded to 9.3xx this evening).

I could NOT reproduce this behaviour. At least when I turn off web protection, the troughput nearly reaches 16 mbps.

But I found some posts indicating that using the UTM (or any device) with a router instead of a simple modem may create delays as there are two devices that have to do NAT instead of one.
Did anyone here ever test if and how this 'double NAT situation' causes perfomance issues?

The customer may be willing to upgrade his hardware soon.
Assuming there now is this 16 mbps line BUT it's possible that some time in the future he will get a 50 mbps/10 mbps VSDL line... which device would you recommend?

No RED devices, no access points (yet, but max. 1-2, if ever), no VPN, no heavy use (five users but only one with >100 e-mails a day and some pretty big downloads).

Moduls currently activated:

- Firewall
- IPS (7289 of 23000 patterns)
- Web Filtering
- Network visibility
- Antivirus and Antispyware (http/https)

While the SG 115and SG 125 (and even SG 135 and SG 210) seem affordable, their subscriptions are not. [:D]

So I guess only the SG 115 or SG 125 are options here. Will they do a much faster job/will they be capable enough for a 50/10 line?

Last question: Some years ago it had been a golden rule to not let your firewall(s) do the dial-up. So I chose the double NAT scenario.
Are the UTMs/SGs doing a good and stable job when it comes to establishing dial-up connections?

Sorry for my english. [:$]

Best Regards,
bfg

This thread was automatically locked due to age.

Parents

0 BAlfson over 10 years ago

Double NAT causes problems with IPsec, but it shouldn't affect the speed of your connections.

I believe that an old bug came back sometime in 9.2, and that it's still with us in 9.309.  It seems to affect a few UTMs and not others.  I have no idea why.  Try setting Anti-Virus to dual-scan everywhere.

Bad advice: For someone with a UTM 110, an SG 105w would make  an awesome replacement and I think would handle at least 50Mbps.  The SG 115 would "future-proof" better, but if the 105 is adequate for two or three years, it's money saved.  The 105w that I configured had a wireless signal as strong as an AP 30.

I would not renew a 110/120, and would freely replace a 220 with a new 125/135, and a 320 with a 135/210/230

Cheers - Bob
PS Dein Englisch ist fast Fehlerfrei - besser als viele meiner Landsmänner !  In fact, the only "errors" I see that aren't typos indicate that your command of the German language is also very sophisticated.  For example, using "had been" in the last paragraph instead of "was" and "had deployed" in the first sentence instead of just "deployed."

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 bfg9000 over 10 years ago in reply to BAlfson

Hi Bob,

thank you for your fast reply!

Double NAT causes problems with IPsec, but it shouldn't affect the speed of your connections.

I will keep that in mind. None of my customers are using IPsec, instead they are using RDP over SSL.
I am only forwarding ports 25 and 443 to the server (internet --> router --> UTM110 --> server)

If there ever will be the need to connect customers via IPsec-VPN to the UTM I hope I will remember your words.

I believe that an old bug came back sometime in 9.2, and that it's still with us in 9.309.  It seems to affect a few UTMs and not others.  I have no idea why.  Try setting Anti-Virus to dual-scan everywhere.

Anti-Virus was not enabled for FTP --> I just changed that to 'enabled' and 'dual scan'.
SMTP and POP3: Both modules are not currently in use.
Is there any place else to look for av settings? [:$]

[Edit: ATP is not enabled]

For someone with a UTM 110, an SG 105w would make  an awesome replacement and I think would handle at least 50Mbps.  The SG 115 would "future-proof" better, but if the 105 is adequate for two or three years, it's money saved.  The 105w that I configured had a wireless signal as strong as an AP 30.

Wow, are these new machines this better/faster?!
So for this specific customer a 115/125 would be a very, very, strong/fast alternative but even the 105 would suffice?

I would not renew a 110/120, and would freely replace a 220 with a new 125/135, and a 320 with a 135/210/230

This, I did not understand. [;)]

So are you saying you would not replace an existing 110?

PS Dein Englisch ist fast Fehlerfrei - besser als viele meiner Landsmänner !  In fact, the only "errors" I see that aren't typos indicate that your command of the German language is also very sophisticated.  For example, using "had been" in the last paragraph instead of "was" and "had deployed" in the first sentence instead of just "deployed."

Danke schön... [:$]
My German is quite ok, my English hearing skills are way better than a year ago (thank you, Netflix [:D]).
But speaking and writing in proper English - still a long way to go...
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 bfg9000 over 10 years ago in reply to BAlfson

Hi Bob,

thank you for your fast reply!

Double NAT causes problems with IPsec, but it shouldn't affect the speed of your connections.

I will keep that in mind. None of my customers are using IPsec, instead they are using RDP over SSL.
I am only forwarding ports 25 and 443 to the server (internet --> router --> UTM110 --> server)

If there ever will be the need to connect customers via IPsec-VPN to the UTM I hope I will remember your words.

I believe that an old bug came back sometime in 9.2, and that it's still with us in 9.309.  It seems to affect a few UTMs and not others.  I have no idea why.  Try setting Anti-Virus to dual-scan everywhere.

Anti-Virus was not enabled for FTP --> I just changed that to 'enabled' and 'dual scan'.
SMTP and POP3: Both modules are not currently in use.
Is there any place else to look for av settings? [:$]

[Edit: ATP is not enabled]

For someone with a UTM 110, an SG 105w would make  an awesome replacement and I think would handle at least 50Mbps.  The SG 115 would "future-proof" better, but if the 105 is adequate for two or three years, it's money saved.  The 105w that I configured had a wireless signal as strong as an AP 30.

Wow, are these new machines this better/faster?!
So for this specific customer a 115/125 would be a very, very, strong/fast alternative but even the 105 would suffice?

I would not renew a 110/120, and would freely replace a 220 with a new 125/135, and a 320 with a 135/210/230

This, I did not understand. [;)]

So are you saying you would not replace an existing 110?

PS Dein Englisch ist fast Fehlerfrei - besser als viele meiner Landsmänner !  In fact, the only "errors" I see that aren't typos indicate that your command of the German language is also very sophisticated.  For example, using "had been" in the last paragraph instead of "was" and "had deployed" in the first sentence instead of just "deployed."

Danke schön... [:$]
My German is quite ok, my English hearing skills are way better than a year ago (thank you, Netflix [:D]).
But speaking and writing in proper English - still a long way to go...
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data