topic Re: Virtual Checkpoint Security GW Vmware in Cloud Firewall

Virtual Checkpoint Security GW Vmware

ChristianoLucas — Thu, 12 May 2022 19:48:49 GMT

Is there a documentation that shows about the capacity of FW with 16 vCORE?
Is there a calculator to validate this capability before putting it into production?
Does anyone have a success story using this solution?
Is there any performance comparison Virtual vs Devices from Checkpoint?

Re: Virtual Checkpoint Security GW Vmware

Chris_Atkinson — Fri, 13 May 2022 13:03:07 GMT

Unfortunately we currently don't publish 16-core performance numbers or compare the same against our appliances.

Simply the underlying hardware for one VMware environment to the next will vary i.e. not all CPU cores are created equal
(As will things like use of SR-IOV, number of interfaces, dedicated hardware/resource mapping etc).

With that said you can extrapolate based on the numbers published for the 8-core instance with the stated HW spec less ~25% for buffer as there isn't a linear gain beyond a certain point.

Re: Virtual Checkpoint Security GW Vmware

PhoneBoy — Fri, 13 May 2022 16:48:04 GMT

My understanding is you won’t see much of a performance improvement beyond 8 cores in a virtualized environment due to limitations in the underlying hardware emulation.

Re: Virtual Checkpoint Security GW Vmware

ChristianoLucas — Fri, 13 May 2022 17:00:08 GMT

But how many connections can I get with 8 cores? And concorrent connections? Have any information about this?

Re: Virtual Checkpoint Security GW Vmware

Chris_Atkinson — Sun, 15 May 2022 10:27:32 GMT

After setup, concurrent connections is based largely on available memory / RAM.

Re: Virtual Checkpoint Security GW Vmware

Bob_Zimmerman — Sun, 15 May 2022 16:37:08 GMT

Concurrent connection count depends almost exclusively on RAM capacity with RAM performance being a pretty distant second limitation.

Connections per second depends on the type of processor core. VMware ESX can run on an Atom C2718, which would give you eight cores at 2 GHz with an 18W package TDP. It can also run on a Xeon W-1390P, which would give you eight cores at up to 5.2 GHz with a 125W package TDP. Each Xeon core would give several times the performance of each Atom core.

Packets per second depends partially on processor performance and partially on I/O performance. x86 hypervisors are comically bad at I/O performance. With VT-d/Vi and/or SR-IOV, you can hand a whole network card or a part of one directly to a VM. That significantly cuts the virtualization overhead, so packets per second returns to being almost entirely processor-bound.