|
|
|
|
|
|
|
|
 |
 |
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [FW1] FireWall-1 and Dual CPU machine
Good point. My comment was more toward applications at a campus gateway installation. Discrete rulebases and low-capacity traffic isn't always a possibility in those locations. My concerns with linux would be its breaking point when assaulted with high-density traffic. -pl On Sat, 10 Feb 2001, CryptoTech wrote: > Peter, > A note to the contrary, a sun ultra60 will give you 120 mbit of data throughput, and a > standard linux box will get around 230mbits of traffic. The bus is, and will always > be the issue with any pc/server based firewall solution. While it is true that in a > complex rulebase you will benefit strongly by having a powerful processor, an average > 15-20 rule firewall on linux will still exceed 170 Mbps.... > > Just my $.02, > CryptoTech > > Peter Lukas wrote: > > > Even with a GigE adapter, the bottleneck is the processor as it crunches > > through the policy. > > > > The newer 900MHz UltraIII's would most likely enable you to approach the > > capacity of the 100Mbps ethernet adapter, but for sustained throughput, it > > may not come close. > > > > Some of the newer GHz x86 processors could probably tap a keg of whoopass > > on crunching through the policy and you may approach 100Mbps and > > beyond. You'd then need to bundle into that configuration some speedy > > memory, etc. > > > > The newer processors from AMD and (when they get their act together) Intel > > are capable of crunching through policy relatively well. Add that with > > faster memory, etc (should DDR-SDRAM materialize), and your x86 firewall > > will most likely smoke a Solaris/Sun-Based firewall. > > > > The real problem here is that you only have Linux or NT on which to run > > CP. Since neither can handle packets as well as Solaris, and Nokia > > selfishly clings to their IPSO/FreeBSD CP binary, we don't have a > > more efficient OS to slap atop this newer, speedier hardware. > > > > Either we pressure Nokia/CP to release native *BSD binaries of their > > product, or we wait for Nokia to "support" better and more capable > > hardware. > > > > Peter Lukas > > > > On Tue, 6 Feb 2001, Craig Skelton wrote: > > > > > > > > Couldn't agree more. The ultra60 is such a nice desktop :). I fully believe > > > in single purpose firewalls. Why waste cpu cycles on any other task. > > > > > > Have you tried any gigbit adapters at fast ethernet speeds? (Or has anyone?) > > > I'm wondering if that is not the *best* way to get maximum performance. > > > > > > Has anybody got any references for how disk speed affects fw1? I'm assuming > > > that the faster the drive, the faster the logging. Does that increase fw1 > > > performance at all? I would think that it would at least reduce the memory > > > footprint a bit (If log entries are buffered in memory before being > > > written.) Comments anyone? > > > > > > Cheers, > > > Craig > > > > > > ----- Original Message ----- > > > From: "Peter Lukas" <[email protected]> > > > To: "Craig Skelton" <[email protected]> > > > Cc: "William Pope" <[email protected]>; <[email protected]>; > > > <[email protected]> > > > Sent: Tuesday, February 06, 2001 6:43 AM > > > Subject: Re: [FW1] FireWall-1 and Dual CPU machine > > > > > > > > > > THis is precisely what the Nokia folks realized in their devices. A > > > > celeron with 64MB is going to do just as well when pusing policy as a Sun > > > > Ultra60 (can you believe these are being used as firewalls? Nice graphics > > > > on your "headless" firewall). > > > > > > > > PCI is PCI is PCI - for the most part at least. Some implementations > > > > leave much to be desired (thanks 810). > > > > > > > > However, the SunQFE can ride the 66MHz 64-bit PCI bus if configured > > > > properly. That'll provide some improvement over the 33MHz jalopy riding > > > > the Nokia Intel MB. I believe the Micron folks implemented a Samauri > > > > chipset (a pre-AGP concoction) which accomplished the same thing. On the > > > > downside, the extremely high markup of the four Intel speedo's with a Sun > > > > emblem on the Sun QFE is ludicrous. Looks like they fostered the Nokia > > > > markup as well. > > > > > > > > I've had a relatively high failure rate on the Luna PCI adapter (see > > > > previous threads of failing Luna PCI's with an "E.T." syndrome). The > > > > point of the post was that the UltraSPARC can be much faster than the > > > > Intel SA-110 on the LUNA PCI adapter. I'm not sure how the "Soft" LUNA is > > > > licensed. This only benefits VPN users who were conned into buying SMP > > > > powerhouses for their firewall device, though. > > > > > > > > -pl > > > > > > > > On Tue, 6 Feb 2001, Craig Skelton wrote: > > > > > > > > > Memory, bus speed, adapter speed, and base processor speed are the > > > biggest > > > > > factors in FW1 performance. > > > > > > > > > > The Luna VPN card will increase preformance only if you are implemeting > > > a > > > > > VPN. If you don't plan on using an IKE or IPSEC VPN then it won't do > > > > > anything for you. (Although they are cool if you do.) > > > > > > > > > > One thing people missed is the bus speed of your machine. This is a big > > > > > deal. You should examine the bus speed of the machine, and the ability > > > of > > > > > the ethernet adapters to utilize that top speed. Some docs suggest that > > > > > gigabit cards will support slightly higher speeds even when run at Fast > > > > > Ethernet speeds. Stands to reason that the higher the performace > > > capability, > > > > > the better the performance at nominal speeds. Obviously, if you already > > > own > > > > > the machine, then you might not get to choose, but a slow bus speed > > > might > > > > > mean that you are better off upgrading now (or that the second proc > > > won't > > > > > matter). > > > > > > > > > > For dual cpu info, you should check the doc at: > > > > > > > > http://www.checkpoint.com/techsupport/documentation/FW-1_VPN-1_performance.h > > > > > tml > > > > > "SMP (2-4 CPUs) has the most effect on Resource and VPN policies > > > performance > > > > > (up to 35-54% performance improvement). Make sure to run multiple > > > instances > > > > > of security servers (see the VPN-1 Tuning chapter). " > > > > > > > > > > If you run lots of security servers, or have many people viewing > > > logfiles > > > > > (nt clients being worse than command line warriors) then the dual cpu > > > will > > > > > really help. Especially if they are not too good at refining their > > > > > selections. Obviously, the kernel modules are monolithic (most likely > > > due to > > > > > severe security issues in multi-threaded kernel mods). The security > > > servers > > > > > and other portions of vpn1/fw1 are not. (pbind etc. to take advantage.) > > > You > > > > > should run multiple instances to increase preformance. Multiple > > > instances > > > > > will ensure that the second cpu is truely utilized (at least on > > > solaris.). I > > > > > doubt there is much need for more than a dual box. > > > > > > > > > > As far as I am aware, there are no specific dual processor tuning points > > > for > > > > > fw-1 on solaris (if you hear of any, let me know.) You might want to > > > take a > > > > > look at sunsolve.sun.com for the doc id 1442 (white papers/ tech > > > bulletins). > > > > > > > > > > Cheers, > > > > > Craig > > > > > > > > > > ----- Original Message ----- > > > > > From: "Peter Lukas" <[email protected]> > > > > > To: "William Pope" <[email protected]> > > > > > Cc: <[email protected]> > > > > > Sent: Monday, February 05, 2001 6:42 PM > > > > > Subject: RE: [FW1] FireWall-1 and Dual CPU machine > > > > > > > > > > > > > > > > > > > > > > I did notice a version of the Luna VPN driver optimized for the > > > dormant > > > > > > CPU. Seeing as how a relatively fast UltraSPARC can effectively dust > > > the > > > > > > StrongARM on the Chrysalis-ITS, it may be worth a looksee for people > > > who > > > > > > ended up purchasing a multi-CPU system for their firewall... > > > > > > > > > > > > -peter > > > > > > > > > > > > On Mon, 5 Feb 2001, William Pope wrote: > > > > > > > > > > > > > > > > > > > > I do not think that Checkpoint has released a multithreaded version > > > of > > > > > > > Firewall-1 yet. I have had some luck using pbind & renice to force > > > the > > > > > > > Checkpoint services to the second processor leaving the first for > > > the > > > > > O/S. > > > > > > > > > > > > > > -----Original Message----- > > > > > > > From: [email protected] > > > > > > > [mailto:[email protected]]On Behalf Of > > > > > Vincent, > > > > > > > Mike > > > > > > > Sent: Monday, February 05, 2001 10:59 AM > > > > > > > To: 'Damon Starkey '; ''Arie Gilboa' '; ''fw-1 Mailinglis' ' > > > > > > > Subject: RE: [FW1] FireWall-1 and Dual CPU machine > > > > > > > > > > > > > > > > > > > > > > > > > > > > Checkpoint did release a multi-threaded device driver to accelerate > > > > > > > encryption and decryption on SMP SPARC/Solaris and Windows NT > > > systems. > > > > > > > > > > > > > > -----Original Message----- > > > > > > > From: Damon Starkey > > > > > > > To: 'Arie Gilboa'; 'fw-1 Mailinglis' > > > > > > > Sent: 2/5/01 10:15 AM > > > > > > > Subject: RE: [FW1] FireWall-1 and Dual CPU machine > > > > > > > > > > > > > > I was told no when I went through the Checkpoint Certification. It > > > > > > > benefits from a good amount of memory. > > > > > > > > > > > > > > Damon Starkey > > > > > > > Network Administrator > > > > > > > Digital Access Corporation > > > > > > > > > > > > > > -----Original Message----- > > > > > > > From: Arie Gilboa [mailto:[email protected]] > > > > > > > Sent: Monday, February 05, 2001 9:44 AM > > > > > > > To: 'fw-1 Mailinglis' > > > > > > > Subject: [FW1] FireWall-1 and Dual CPU machine > > > > > > > > > > > > > > Hello!, > > > > > > > I would like to instal CP-2000 on Dual CPU Solaris machine. > > > > > > > Does CP-2000 software know to use more than one CPU ?. Is there any > > > > > > > special configuration which should be done ?. > > > > > > > > > > > > > > Thanks, > > > > > > > Arie Gilboa > > > > > > > > > > > > > > > > > > > > > > > > > > > > > ============================================================================ > > > > > > > ==== > > > > > > > To unsubscribe from this mailing list, please see the > > > instructions > > > > > at > > > > > > > http://www.checkpoint.com/services/mailing.html > > > > > > > > > > > > > > > ============================================================================ > > > > > > > ==== > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > ============================================================================ > > > > > ==== > > > > > > > To unsubscribe from this mailing list, please see the > > > instructions > > > > > at > > > > > > > http://www.checkpoint.com/services/mailing.html > > > > > > > > > > > > > > > ============================================================================ > > > > > ==== > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > ============================================================================ > > > > > ==== > > > > > > To unsubscribe from this mailing list, please see the > > > instructions at > > > > > > http://www.checkpoint.com/services/mailing.html > > > > > > > > > > > > > > ============================================================================ > > > > > ==== > > > > > > > > > > > > > > > > > > > > > > > > > > > ================================================================================ > > > To unsubscribe from this mailing list, please see the instructions at > > > http://www.checkpoint.com/services/mailing.html > > > ================================================================================ > > > > > > > ================================================================================ > > To unsubscribe from this mailing list, please see the instructions at > > http://www.checkpoint.com/services/mailing.html > > ================================================================================ > ================================================================================ To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================================================
|
||||||||||
 |
 |
 |
 |
 |
 |
 |
 |
 |
|
