C613-22104-00 REV B Packet Flow Architecture | Page 27
Selecting a Security Solution Advanced Network Protection
matches. For example, an HTTP/1.1 Get request containing a URL would be processed via the URL
filtering rule-set within the Suricata engine, whereas an IP data stream not containing a URL would
not be matched against the URL filtering rule-set.
UTM CPU processing requirements
As each security function is enabled, the additional processing cost results in less CPU processing
cycles being available to be dedicated to packet forwarding, so therefore overall throughput can be
reduced.
The key point is that all packets are processed in software within the device and that security
functions require much more processing per packet/byte than just forwarding a packet.
This diagram below is indicative only, based on test conditions, and highlights the number of CPU
cycles that may be required for various functions.
Figure 6: CPU processing requirements by feature
Updates By default, a UTM firewall regularly checks for updates, and downloads and installs any updates
available. In general, this will suit most networks. However, some of the resources can be large, so
the process of downloading and installing them adds extra load to the firewall. In some busy
networks, this may affect the general performance of the network while it is updating. If this is
negatively affecting your network, you could consider disabling some or all of the automatic updates
and scheduling regular updates (update <resource-name> now command, see the Update
Manager Feature Overview and Configuration Guide) during off-peak times by using a time trigger
(see the Triggers Feature Overview and Configuration Guide).
Anti-virus
Forwarding
VPN
Malware
DPI
NG Firewall
IP Reputation
IPS
URL Filtering
0 2 4 6 8 10 12 14 16
To Next Page
Loading...
Need help?
General
