topic Sizing base on bandwidth for Cloud Guard Network Security in Firewall and Security Management

Sizing base on bandwidth for Cloud Guard Network Security

Mk_83 — Sat, 28 Dec 2024 19:36:46 GMT

Hello everyone,

I have a customer want to using Checkpoint in their Private Cloud (KVM Environment) - Cluster HA (Active/Standby)

- Physical Network: 2x 10Gbps

- Physical Host running VM Firewall: Chip 6448Y

- Blade FW only.

- Throughput ~ 40Gbs

I am planning to this license:

CPSG-VSEC-VEN-BUN-NGTP-*Y

1 CloudGuard Network virtual core for VMware ESXi, Hyper-V, KVM Gateway. Annual subscription for * year.

I tested 16 vCore => overload.
So, I just want to ask that with that such traffic/throughput, can 32 vCore handle it?

I hope anyone who have experience in this can help and give me your opinion, before I'm doing another test with 32 vCore.

Thanks & Best Regards.

Re: Sizing base on bandwidth for Cloud Guard Network Security

Chris_Atkinson — Sun, 29 Dec 2024 02:13:43 GMT

In general I would suggest working with your local Check Point SE / rep on this who can engage solution center where required.

What throughput did you see with the 16-cores?

Likely we are missing some details but the networking seems not to align with the throughput requirements?

Re: Sizing base on bandwidth for Cloud Guard Network Security

AlekzNet — Sun, 29 Dec 2024 02:34:51 GMT

Are there any online sizing tools to feed the results of cpsizeme to?

Re: Sizing base on bandwidth for Cloud Guard Network Security

Chris_Atkinson — Sun, 29 Dec 2024 03:20:02 GMT

Appliance Sizing Tool should be available to partners as I recall but its not entirely applicable here.

Re: Sizing base on bandwidth for Cloud Guard Network Security

AlekzNet — Sun, 29 Dec 2024 20:57:03 GMT

Do you, by any chance, have the direct link to this sizing tool? I can not find it anywhere... The closest is https://catalog.checkpoint.com/cat/quantum/security_gateway , but I wonder if there is anything more intelligent.

Re: Sizing base on bandwidth for Cloud Guard Network Security

Chris_Atkinson — Mon, 30 Dec 2024 01:05:45 GMT

sk144133 provides a link to the tool I mentioned above, but again it is appliance centric.

Re: Sizing base on bandwidth for Cloud Guard Network Security

AlekzNet — Mon, 30 Dec 2024 15:21:00 GMT

Thanks much Chris! That's exactly what I needed (sorry for hijacking the thread 😇 )

Re: Sizing base on bandwidth for Cloud Guard Network Security

AlekzNet — Tue, 31 Dec 2024 00:50:53 GMT

The only problem is - it does not work. Regardless of what I enter or choose, it shows either:

"Failed to get products for this CPSizeMe file. Please try to refresh the page"

"Failed to get products for this settings. Please try to refresh the page"

Re: Sizing base on bandwidth for Cloud Guard Network Security

PhoneBoy — Tue, 31 Dec 2024 01:20:39 GMT

Many things can impact performance.
We need a lot more details like:

Version/JHF
Precise testing methodology
Super Seven output while testing

In general, not sure that you can get that sort of performance in virtualized environments.
As @Chris_Atkinson said, you should work with your Check Point SE on your precise requirements.