IPS kills UTM 9 - Model: ASG320

Hi Francois,

this behaviour has been confirmed by Sophos Support, stating that IPS could consume up to 60% of your Bandwith. I don't find the original thread where this topic has been discussed right now, but you might find it through search. I can reproduce this behaviour on my SG 230 as well with my 200/25 Mbit line. The Problem was identified as the SNORT engine which is used by IPS in UTM, nothing helps a lot, you could try things like reducing IPS ruleset or setting more granular exceptions - didn't do the trick for most ppl though.

The conclusion on this topic was, that Sophos is most likely going to change the IPS Engine in Sophos XG Firewall OS, but not for UTM anymore.

Regards,

Martin

Hi Martin

Thank you very much for your informed Reply.

I do understand exactly what you said.

Its sad, but then what can we do.

Much Appreciated

Have a nice day

Kind Regards

Francois

You're welcome, not happy about that either. :-) I think if I can remember right, it had to do something with CPU Core Utilization of the SNORT Engine, which is just using one CPU core of the UTM for scanning the packets of one Client connection. They also said in the discussion, that this only affects one Client at a time. Therefore a second/additional Client connection would be able to get the some of the missing ammount of bandwith available because scanning packets would be utilized by another CPU core. The bigger the appliance (=faster CPU/Core) the less the impact on bandwith has been, they ended up in testing this on VMWare UTM Appliance where they have been able to play with assigned CPUs.

But as you said, apparently doesn't help us much.

Regards,

Martin

Francois, if you used one of the standard speed measuring tools, you found the limitation for a single download.  Try running the same test simultaneously from two PCs and watch the dashboard in WebAdmin to see what combined speed is achieved.  Snort is single-threaded per connection.

Cheers - Bob

Francois, if you used one of the standard speed measuring tools, you found the limitation for a single download.  Try running the same test simultaneously from two PCs and watch the dashboard in WebAdmin to see what combined speed is achieved.  Snort is single-threaded per connection.

Cheers - Bob

Hi Bob

Thank you for all the information.

I will test and play around a bit.

Have a pleasant day

Kind Regards

Francois