Throughput Threat Prevention For Firewall Cluster

[Imad981]

Hello everyone , 

Our client is requesting for a firewall cluster consisting of two physical appliances in the same Datacenter (Load Balacing mode) .
He has requested a requirement : "Threat prevention throughput of the firewall cluster: minimum 18 Gbps."

Given that the architecture is based on Leaf-Spine . Does this throughput need to be guaranteed for each firewall, given that the traffic will ultimately be handled by a single firewall? Or does this mean that each must ensure a minimum of 9 Gbps? Because we cannot split a single session through 2 firewalls .

Thanks for assistance .

Regards 

Imad

[Chris_Atkinson]

It entirely depends on what the 18Gbps measure is in the customers view, aggregate peak traffic, redundant (protected) traffic?

Minimum might suggest one thing but probably best not to guess and ask him/her to clarify the requirement.

[Imad981]

Hi Chris , Thanks for your answer 

In fact , the client specified that the operating mode of the proposed firewalls is load balancing , which means that they will both active in the same datacenter . The traffic wil not be redundant , which means that only one firewall in the same time will handle and inspect the traffic .

Regards

Imad

[Tal_Paz-Fridman · Accepted solution]

Following the answers to the questions Chris raised you might want to consult Appliance Sizing Tool:

https://usercenter.checkpoint.com/ucapps/appliance-sizing-tool

[Lesley · Accepted solution]

This is the best link. What customer does now have also Check Point? If so consider cpsizeme tool. 

Second step is to contact local office. There are to many factors that are important for a good sizeing. 

[Imad981]

Hi , 

The client wants that all the checkpoint appliance be active for a maximum throughput 18 gbps and 32M concurrent sessions.

We want to propose maestro MHO 140 and 2 Quantum appliances 7000 .

Can maestro ditribute in this case session between this appliances ? this way each appliance can handle one session to avoid overloading or overflowing .

[the_rock]

I agree with the guys  as well, cpsizeme and your local SE would be your best options here.

Andy