Situation - My group hosts 'private clouds' for a few clients. We are looking to migrate away from several Cisco devices for various reasons. The main one is bandwidth limitations. For this example we'll take two data centers where we have gigabit service. With no firewalls in place between two fully exposed VMs, we can obtain around 850Mb/s with reasonable stability over several hours. We stood up two virtual UTMs v9.315-2. Each UTM is on the same physical hardware where we achieve 850Mb/s. Hyper-V 2012R2 is the VM host. Each UTM is allocated 4.5GB mem, 150GB HDD, 4 cores of dual hex core 2.5Ghz Xeons.
Problem - Throughput of a tunnel between these two VMs achieves about 150Mb/s.
--Only the firewall is active, no other items such as IPS.
--Support path MTU discovery is on (both sides)
--Rulez have been reviewed and followed where applicable. This setup is fairly basic so most are not a factor.
--Nothing odd in logs
--Intel NICs on one end
--Broadcom NICs on other end
--CPU utilization is at 4% or so when we are hitting the 150Mb/s peak with about 80Mb/s stable.
--MTU between 1350-1500 tried in increments of 50. 1500 seems to give best performance.
--Testing with a 50GB file, CIFS and FTP
I called Sophos for some pre-sales tech support since we were considering becoming a reseller to our private cloud clients. They tell me their support is only for break-fix, no pre-sales.
Just for kicks, we stood up a couple TMG images and we acheived about 650Mb/s without any effort beyond a quick base config.
Our ideal target would be 800/Mbs but we are a long way from there at this point and may be on the wrong path.
We are open to all input and have looked through many performance threads but most are for lower bandwidth allocations.
Is it likely two SG 135's (or SG 210s) could achieve 800Mb/s in this given scenario? If we are fighting VM/NIC issues then we'll give that a try, however this doesn't fit as well into our all VM model and HA requires more hardware.
This thread was automatically locked due to age.
Guest User!
You are not Sophos Staff.
