Virtual Checkpoint Security GW Vmware

[ChristianoLucas]

Is there a documentation that shows about the capacity of FW with 16 vCORE?
Is there a calculator to validate this capability before putting it into production?
Does anyone have a success story using this solution?
Is there any performance comparison Virtual vs Devices from Checkpoint?

[Chris_Atkinson]

Unfortunately we currently don't publish 16-core performance numbers or compare the same against our appliances.

Simply the underlying hardware for one VMware environment to the next will vary i.e. not all CPU cores are created equal
(As will things like use of SR-IOV, number of interfaces, dedicated hardware/resource mapping etc).

With that said you can extrapolate based on the numbers published for the 8-core instance with the stated HW spec less ~25% for buffer as there isn't a linear gain beyond a certain point.

[PhoneBoy]

My understanding is you won’t see much of a performance improvement beyond 8 cores in a virtualized environment due to limitations in the underlying hardware emulation.

[ChristianoLucas]

But how many connections can I get with 8 cores? And concorrent connections? Have any information about this?

[Chris_Atkinson]

After setup, concurrent connections is based largely on available memory / RAM.

[Bob_Zimmerman]

Concurrent connection count depends almost exclusively on RAM capacity with RAM performance being a pretty distant second limitation.

Connections per second depends on the type of processor core. VMware ESX can run on an Atom C2718, which would give you eight cores at 2 GHz with an 18W package TDP. It can also run on a Xeon W-1390P, which would give you eight cores at up to 5.2 GHz with a 125W package TDP. Each Xeon core would give several times the performance of each Atom core.

Packets per second depends partially on processor performance and partially on I/O performance. x86 hypervisors are comically bad at I/O performance. With VT-d/Vi and/or SR-IOV, you can hand a whole network card or a part of one directly to a VM. That significantly cuts the virtualization overhead, so packets per second returns to being almost entirely processor-bound.