IPS versus performance of 1000c

[pj255]

Hi all, Does anybody know of roughly what sort of performance impact one could expect by enabling IPS scanning for some traffic flows on a 1000c? Does the the size of the IPS signature list directly affect the type of performance impact? The 1000c has just one NP4 processor and im assuming the IPS traffic needs to be handled by the CPU..also im assuming that the larger the list is and the greater the traffic = the higher the resource impact on the FG ? PJ

[Carl_Wallmark]

According to the website the 1000C can handle around 6 Gbs of throughput, And you can offload the IPS to NPx or CPx: Controlling IPS NPx and CPx acceleration You can use the following commands to enale or disable acceleration of IPS processing by NPx and CPx processors: config ips global set np-accel-mode {none | basic} set cp-accel-mode {none | basic | advanced} end The network processor (NP) acceleration modes are: none: Network Processor acceleration disabled basic: Basic Network Processor acceleration enabled The content processor (CP) acceleration modes are: none: Content Processor acceleration disabled basic: Basic Content Processor acceleration enabled advanced: Advanced Content Processor acceleration enabled

[pj255]

Thanks Selective, Do you know what the preference is in terms of design - to use the NP4 or CP8 for IPS? Also - can you clarify whether only IPS traffic throughput is reduced down from 20Gbps to 6Gbps...or does the overall performance of the box reduce down to 6 Gbps once IPS is enabled?

[Carl_Wallmark]

I would go with the CP8 as that is a content processor. Lets say you have one firewall rule in total, with IPS enabled, then the speed would be max 6Gbs But you dont need to enable IPS on evey firewall rule. So if you have traffic on non-IPS rules then the speed would be greater.

[pj255]

I need to give the hardware acceleration guide a good read but your pointers are a huge help - top marks!

[Dave_Hall]

@pj255 Generally (at least in my book) you would want to tailor your IPS signatures to the traffic -- by setting up various firewall policy rules covering certain traffic (i.e. DNS, NTP, HTTP/HTTPS, email, etc.) and applying different IPS signatures to them. For example, you may not want the Fortigate spending any time processing linux/windows server-based IPS signatures on Windows workstations that is doing mostly web traffic. You also have choices of algorithm method and pick of IPS database (regular or extended) to choose from, which can affect the Fortigate' s performance.

[emnoc]

And to what Dave stated, you need to factor in all other UTM features you have enabled. That will be a factor in what performance numbers you see.

[pj255]

Yes that makes sense - I have been bench marking the performance of our 1000c for over a month in CACTI and I hope to incrementally enable IPS and web filtering for some traffic flows to try and gauge the performance impact on the box. The plan is to only really do IPS scanning for a small subset of users and traffic which will be on a dedicated VDOM. Also - I plan to refine the defaulkt IPS signature list and remove un-needed signatures (for application we don' t run within the organisation) Hopefully if I take a steady approach to the deployment of new services we shouldnt' t risk any instability of resource issues. I have a few more weeks until I need to start pushing down the IPS policies so I think I need a bit more reading - the algorithm and the acceleration options will need a little bit of research! Thanks all for your input - priceless!

[emnoc]

Also - I plan to refine the defaulkt IPS signature list and remove un-needed signatures (for application we don' t run within the organisation)

That' s normally bcp. You also might want to monitor all rules and positive catch rates. This is just as import of thruput. Also latency could be hit up by a few ms or so. So in your graphing, you should measure server response times b4 and after engaging the IPS detection. also to add; the logging of attack.event and packet-logging should also be reduce & minimized. Most sec-engineers want to log everything but this generate more cpu time and any logging push to a remote network device, eat up CPU when building and sending the packet.

[ede_pfau]

And, if I may add, have a look at the vastly improved IPS engine in FOS 5.2. You may read up on it here on the forums in the recent posts from Sean_Toomey_FTNT. Specifically the new IPS engine uses flow mode which should improve latency a lot. Of course, don' t read this as " put a GA release into production no matter what" . But for testing it' s OK, and in a few weeks we' ll have the first or second stable patch.