Why IPS throughput is 1/2 than firewall throughput?

[ssancho]

I'm looking for explanation about why some appliances has IPS throughput that is a half than firewall throughput (for instance 4050), and why 4020 has 2 Gb of throuhput in both fields.

As I understand this is not that Palo Alto with IPS feature activate has half throughput than another without threat prevention but I have not the exact explanation.

Could someone explain to me??

Thank you in advance

Samuel

[pkruse]

Samuel,

The paloalto firewall by virtue of its advanced design performs all inspection in the first pass, by contrast an industry standard port based firewall must make multiple passes based on the degree of inspection. We use purpose build devices to achieve high levels of performance. In comparison many of the most popular firewalls out there are basically rewrapped pc’s with a tweaked OS. These boxes are fine for running a desktop operating system and playing games but mediocre in competing with a PAN.

As an example, some firewalls will claim to do Application level filter but will require a blade to achieve this. This means that after the firewall as inspected it must now go through a second device in line with the firewall, this extra overhead has a costs in total performance.

Paloalto builds their devices to perform these tasks out of the box, other vendors require additional hardware and software in an attempt to keep up. This is why we are called the next generation firewall.

~Phil

[jcostello]

Samuel,

Just to clarify. Are you asking why some Palo Alto firewalls show measureable drops in performance on the Spec Sheets when the IPS features are activated?

Thanks

James

[ssancho]

Hi all, and thanks for your answers.

Yes, I'm asking why some Palo Alto firewalls show on Spec Sheets that IPS throughput is 1/2 than firewall throughput. I could understand that with IPS activated the performance is reduced but, for instance PA 4020 has 2Gbps of throughput and 2Gbps of threat prevention and PA4050 has 10Gbps and 5Gbps. Thats it's mean that you have to select the appropiate hardware thinking in Threath prevention throughput instead of firewall throughput?.

Thank you in advance

Regards

Samuel