Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


17992 posts

Uber Geek
+1 received by user: 5179

Trusted
Lifetime subscriber

Topic # 199231 9-Aug-2016 14:00
Send private message

Hi. 

 

Anyone got this paired with a UFB 200/200 Service who could briefly run a Speedtest with and without UTM services enabled please?

 

 


Create new topic
77 posts

Master Geek
+1 received by user: 7


  Reply # 1609998 11-Aug-2016 11:07
Send private message

Do you have a specific model number?

 

Their performance can vary based on the model, and we found that the older devices (TZ205, etc) are very-very slow with UFB. Had to replace quite a few of them to get the full bandwidth out of the UFB connection.




17992 posts

Uber Geek
+1 received by user: 5179

Trusted
Lifetime subscriber

  Reply # 1610001 11-Aug-2016 11:13
Send private message

engedib:

 

Do you have a specific model number?

 

Their performance can vary based on the model, and we found that the older devices (TZ205, etc) are very-very slow with UFB. Had to replace quite a few of them to get the full bandwidth out of the UFB connection.

 

 

Yes, the Sonicwall SOHO (It's called that).


Meow
7788 posts

Uber Geek
+1 received by user: 3849

Moderator
Trusted
Lifetime subscriber

  Reply # 1610009 11-Aug-2016 11:29
Send private message

The SOHO (in just firewall mode - without content filtering or UTM) can route 200/200Mbit however this is pushing it to its limits. As soon as you enable UTM this will drop down to ~60-80Mbit. Really, not suitable for a UFB connection and rather suited for a small office lets say 50Mbit connection. They're not fast devices.

 

Take a look at the Fortinet products - they're fast (ASIC powered) and also have very good firmware Here. The local NZ supplier (Ingram Micro) was pretty happy to provide me with one for a couple of months for testing.







17992 posts

Uber Geek
+1 received by user: 5179

Trusted
Lifetime subscriber

  Reply # 1610011 11-Aug-2016 11:31
Send private message

michaelmurfy:

 

The SOHO (in just firewall mode - without content filtering or UTM) can route 200/200Mbit however this is pushing it to its limits. As soon as you enable UTM this will drop down to ~60-80Mbit. Really, not suitable for a UFB connection and rather suited for a small office lets say 50Mbit connection. They're not fast devices.

 

Take a look at the Fortinet products - they're fast (ASIC powered) and also have very good firmware Here. The local NZ supplier (Ingram Micro) was pretty happy to provide me with one for a couple of months for testing.

 

 

 

 

We have Sonicwall everywhere else, so I am not keen to switch brands and Fortinet are just as expensive or more so than Sonicwall. We are evaluating Sophos UTM appliances right now, and they are pretty slick despite the brand being pretty poor in terms of reputation. They are likely to be our low cost alternatives. 


Meow
7788 posts

Uber Geek
+1 received by user: 3849

Moderator
Trusted
Lifetime subscriber

  Reply # 1610014 11-Aug-2016 11:36
Send private message

The Sophos UTM appliances are indeed pretty good too. Depending on what you're doing (if it is just content filtering) the Edgerouter (believe it or not) is another option with its DPI L7 firewalling however won't scan for malware etc. I did really like the Fortinet products but yes they're expensive but they were almost wire speed on the connections I tested.

 

Another one is the Meraki line of routers except the entry level products won't be suitable for 200/200Mbit UFB.







17992 posts

Uber Geek
+1 received by user: 5179

Trusted
Lifetime subscriber

  Reply # 1610015 11-Aug-2016 11:39
One person supports this post
Send private message

michaelmurfy:

 

The Sophos UTM appliances are indeed pretty good too. Depending on what you're doing (if it is just content filtering) the Edgerouter (believe it or not) is another option with its DPI L7 firewalling however won't scan for malware etc. I did really like the Fortinet products but yes they're expensive but they were almost wire speed on the connections I tested.

 

Another one is the Meraki line of routers except the entry level products won't be suitable for 200/200Mbit UFB.

 

 

And Meraki are subscription based. No pay, no device. I won't sell products that work like that in good conscience. I don't mind paying for extra features, support, subscription for security services, I won't pay a sub for basic device functionality. 

 

I don't like the UI/Rules config on the edge routers, I think the Sonicwall, and Sophos are easier for our juniors to understand and manage too. 

 

 


309 posts

Ultimate Geek
+1 received by user: 69


  Reply # 1614666 19-Aug-2016 21:47
Send private message

SonicWALLs have better than an ASIC, they use Cavium Octeons (same network CPUs used in Palo Altos).

 

x86 = crap layer 3 performance, abysmal layer 7/DPI performance

 

ASIC = excellent layer 3 performance, meh Layer 7/DPI performance

 

Cavium = excellent Layer 7/DPI performance, good layer 3 performance.

 

 

 

The Soho is an older gen Cavium, the Soho W and up have the newer gen Cavium more suitable for UFB. On a 200/200 circuit with Intrusion Prevention/Gateway Antivirus/Gateway AntiSpyware/App Control/Web Filtering a 200Mbps download would load the CPU to ~ 50%. The comparible Fortigate 60D is spec'd at around 23Mbps (on Fortinets own datasheets).

 

The Cavium is also orientated to multicore operation (the little ones only have 2 cores, big ones scale up to 64). So on a single stream test the Fortinet may run a higher speed single core stream so does better. In real world multistream testing the Cavium shines. Also the Forti ASICs aren't always what they claim to be, if you need some bedtime reading check this: http://docs.fortinet.com/uploaded/files/2855/fortigate-hardware-acceleration-54.pdf

 

So if you want a plain layer 3 firewall, Fortigate, if you want to run the security services, SonicWALL. I would not touch sophos with a barge pole, they regularly fail independent testing (don't believe the miercom tests, they are paid for by vendors). Look at NSS Labs tests as a good guide. Sophos is also x86 based so DPI performance is attrocious.

 

Cisco... maybe if you want to NSA/Chinese/Russians in your network: http://www.networkworld.com/article/3109165/security/cisco-fortinet-issue-patches-against-nsa-malware.html

 

You should also start checking SSL decrypt performance, it's becoming important for malware protection now.

 

 

 

 


Create new topic

Twitter »

Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.