topic Re: Cpsizeme result in Firewall and Security Management

Cpsizeme result

Moudar — Tue, 21 May 2024 08:57:34 GMT

I got these results from my gateway after running cpsizeme for 48 hours:

Measured Data ============= * Maximum gateway throughput: 1820.233056 Mbps * Maximum packet rate: 205321 Packets/sec * Maximum Total CPU: 75% * CPU core 0: 20% (Max core utilization: 85%) * CPU core 1: 93% (Max core utilization: 100%) * CPU core 2: 91% (Max core utilization: 100%) * CPU core 3: 92% (Max core utilization: 100%) * CPU core 4: 23% (Max core utilization: 96%) * CPU core 5: 93% (Max core utilization: 100%) * CPU core 6: 93% (Max core utilization: 100%) * CPU core 7: 92% (Max core utilization: 100%) * Maximum kernel CPU: 68% * kernel CPU core 0: 19% (Max core kernel Utilization: 85%) * kernel CPU core 1: 85% (Max core kernel Utilization: 100%) * kernel CPU core 2: 80% (Max core kernel Utilization: 100%) * kernel CPU core 3: 84% (Max core kernel Utilization: 100%) * kernel CPU core 4: 20% (Max core kernel Utilization: 88%) * kernel CPU core 5: 86% (Max core kernel Utilization: 100%) * kernel CPU core 6: 86% (Max core kernel Utilization: 100%) * kernel CPU core 7: 85% (Max core kernel Utilization: 100%) * Estimated number of unique IPs behind gateway: 9901 * Maximum concurrent connections: 69059 * Average concurrent connections: 26099 * Maximum memory utilization: 8757508 KB * Minimum Free Memory: 250 MB * Accelerated packets: 90.29% * VPN traffic: 0.19% * Detected interface packet drops: no * Detected install policy: yes * SMT status: Not supported * Estimated average of NAT connections: 0% (average concurrent connections:26098) ===================================

Is this gateway operating at the edge of its CPU capacity? Should I consider a more powerful gateway when we replace the current 6500 model?

Additionally, considering this situation, would enabling HTTPS inspection be advisable? I assume it might not be recommended, given the already high CPU usage.

Re: Cpsizeme result

the_rock — Tue, 21 May 2024 09:04:10 GMT

Seems to me you should definitely consider more powerful device. Might not be best to enable https inspection in this state.

Andy

Re: Cpsizeme result

_Val_ — Tue, 21 May 2024 09:52:59 GMT

Is this gateway operating at the edge of its CPU capacity? Should I consider a more powerful gateway when we replace the current 6500 model? - AS SOON AS POSSIBLE

Additionally, considering this situation, would enabling HTTPS inspection be advisable? I assume it might not be recommended, given the already high CPU usage. - Please don't, your machine is already jammed completely.

Re: Cpsizeme result

Moudar — Tue, 21 May 2024 10:33:11 GMT

Given the above information, what appliance would you recommend as a replacement for our 6500?

Re: Cpsizeme result

Chris_Atkinson — Tue, 21 May 2024 11:18:03 GMT

Please discuss this further with your local SE who will need to understand the currently enabled blades and your future intentions to recommend an appropriate 9000 series appliance.

Re: Cpsizeme result

_Val_ — Tue, 21 May 2024 12:01:51 GMT

I second what @Chris_Atkinson said, you need some assistance here. Ask your partner and/or your local CP representative to provide you with a list of appliances to choose from. They will need to feed CPSizeMe fil to a tool making the assessment, and they may have some more question about your near to mid-term plans