311B - need more IPS power

[snobs]

Hello, I have an active-active cluster of 311B running with firewall/IPS enabled, 4x 1Gbps for WAN connection. (VPN is outsourced to another box) Unfortunately even with the active active cluster, the system hit the 100% mark for the last weeks. => I need more power. So, what do we have here: " ASM-FB4" But this one is for firewall/IPSec acceleration only, right? Or will I gain more ressources for IPS, too? If not I will have to buy new hardware and with those prices for firewall/IPS/NGFW I will have to do a public tender. In this case Fortigate will not win the bid (unfortunately) because of its pricing for 10Gbps+ devices. What would you suggest? Regards, Michael

[Carl_Wallmark]

Hi Michael, Are you sure its the IPS that hits 100% ? you can run this in CLI " diag sys top" to see what process is taking 100% And also, please provide what firmware you have, in the past there have been several bugs which will cause the " ipsengine" to go crazy.

[ede_pfau]

The 310B is rated at 800 Mbps for IPS. You are in need of 5 times that much. I' d say it' s time for new hardware... For example, the 1500D is rated at 11 Gbps IPS due to the new NP6 and CP8 ASICs. You could easily run a 1500D cluster in A-P mode for more stability and have ample room to grow. Pricing is always a matter of negotiation.

[snobs]

Well, don´t look at the LACP trunk (I have 4 ports each for up/down, 2 for interconnect. It´s nice to have 10 ports...) I just looked at the device (It´s 10:18pm): bandwidth: ~450 Mbit/s sessions: ~120000 version: v5.0,build3608 (GA Patch 7) It´s indeed " ipsengine"

ipsengine 76 R < 45.8 9.5 miglogd 49 S 0.2 5.1 updated 124 S 0.0 2.7 cmdbsvr 43 S 0.0 2.0 httpsd 129 S 0.0 2.0 httpsd 123 S 0.0 1.9 pyfcgid 5091 S 0.0 1.9 pyfcgid 5093 S 0.0 1.9 pyfcgid 5092 S 0.0 1.9 pyfcgid 5094 S 0.0 1.9 proxyworker 69 S 0.0 1.4 httpsd 56 S 0.0 1.3 httpsd 122 S 0.0 1.3 newcli 5556 R 0.0 1.2 newcli 5555 S 0.0 1.2 wad 89 S 0.0 1.2 fgfmd 111 S 0.0 1.2 hasync 92 S < 0.0 1.1 scanunitd 5549 S < 0.0 1.1 scanunitd 5548 S < 0.0 1.1

[Carl_Wallmark]

Ok then I would follow Edes advice and get bigger boxes.

[neonbit]

Have you tried to trim your IPS signatures so they are specific to the policies and services they protect? Scanning Windows signatures for a policy that protects your Linux Apache server is not the best use of available resources.

[Dave_Hall]

Scanning Windows signatures for a policy that protects your Linux Apache server is not the best use of available resources.

Pretty much my own thinking. Some years back, our company " standardize" our fgt configs, including tailoring the IPS signatures for different network traffic. After doing this, we saw a tremendous performance gain in almost all UTM areas. :)

[snobs]

Thanks for the hint. I do not " IPS" everything and actually already use different server groups and set appropriate IPS profiles. Let´s see whether I can tune a little with single IPS profiles for each server (and wait till next year for replacing those boxes) => I need money :-) P.S.: - So, the " ASM-FB4" doesn´t help at all, I guess? - NP6 and CP8 ASICs? Which Cavium ASIC are being used this time?

[ede_pfau]

- So, the " ASM-FB4" doesn´t help at all, I guess?

No, just accelerates firewalling and IPsec. And yes, of course you' d think of tailoring the IPS profiles first; in case of your 310Bs, they' re probably both speed and memory limited. As I don' t see much headroom for future releases or features you will want to use I recommend new hardware. The new ASICs mentioned are deployed in the 1500D and 3700D. I' ve got no further info on that hardware. For your figures a (pair of) 200D would suffice, at a fraction of the cost of a 1500D. Firewalling at 3 Gbps, IPS at 1.7 Gbps, 1.4 M concurrent sessions. And it' s got the CP8 as well.