What is the ratio of RX-DRP to RX-OK? If higher than 0,1% then tuning is needed.
RX-DRP means that firewall does not have enough FIFO memory buffer (descriptors) to hold the packets while waiting for a free interrupt to process them. What does this mean? In a very simplified explanation it means that the memory buffer on the NIC itself is not emptied quick enough by the CPU before new frames arrives.
To check for network buffer errors on that NIC run this command:
netstat -ni | grep interface_name (look for RX-DRP)
What kind of NIC hardware do you have on that interface?
ethtool -i interface_name to check what driver is used. If the driver is bge or tg3 then it's Broadcom which is not recommended for production traffic. If the driver is E1000, e100e,igb,ixgbe or w83627 then it's Intel which is recommended and can provide doubling of performance without additional tuning.
Increasing ring buffer size is a common recommendation but not desirable. The best way is to allocate more core processing resources.
4096 is the maximum ring buffer size on most NICs. 256/512 is default. What did you increase to? Why not set to maximum? Because if the buffer size is larger it also means that it takes more processing to service that buffer. Coming back to the actual problem, not enough CPU resources to empty the RX ring buffer. But in some cases there is not sufficient processing resources available because of underpowered firewall and increasing ring buffer size is the solution.
Run also the command sar -u to take a look at your CPU utilization or if you have the monitoring blade present for graphical view.