Anybody got a Sophos XG (430) and a Gig internet connection, What's your actual speed

[Jaan]

We've just upgraded from 200/200 to 1000/1000.

 

Before the update, we were saturating the line (hence the update). They haven't actually finished the update yet (another visit is needed for the back up line). But initial tests show we're getting 100 down and 1000 up.

 

 

I'm worried that IPS is restricting throughput, but that doesn't explain why we're currently slower.......

 

What speed do you actually get on your Sophos XG and gig combo?

[yac2016]

Have you tested the connection speed directly into your termination equipment? Bypassing Sophos as a test?

[ZeroHour]

What are you using to speed test?

Iperf3 may be a good option as I have found a lot of the speed test sites have issues at high speed often.

 

iperf3.exe -t 120 -c paris.testdebit.info -p 9205 -P 20 -R

 

Although ideally run iperf from Linux/Mac or WSL Ubuntu as the windows networking stack can have issues. Some IDS has issues with ipv6 if you are using that and you can force it either way with -4 or -6 with iperf.

[PaddyNewman]

Real-time scanning can do this, had a customer recently that was seeing 950 upload, but download was crippled to around 100.

 

Turning off anything real-time as a test gave them full speeds.

[SchoolsBroadband]

When you start turning all the fancy deep scanning, IPS and other fancy processor intensive on lots or all traffic streams then any hardware vendor can start to have issues.

 

Perhaps look to put the IPS on only certain traffic destinations you don't trust.

 

I can't speak for Sophos but Fortinet give you what in theory the max throughput can do with a single "thing" e.g. SSL decryption can do and they also give you a typical setup and what the likely throughput will be with most things deployed but not for all traffic. This gives a decent indication of what a box can actually do.

 

Sometimes though firmwares have bugs in them so also look at the firmware release notes and release notes of newer firmwares to see if any bug is fixed that could be the issue you're seeing.

 

Are you able to see on a per policy basis which policy is using up all your CPU / memory? Again Fortinet can do this but I'm not sure about Sophos. This will help you to diagnose where the issue may be.

 

Dave

[Jaan]

before the "update" we had 200/200 and we were getting that up and down. nothing has changed from the FW config..... i need to do some more tests...... first day back here so fixing another issues at the mo