Who rated this post

Bypass Under Load: On

The F2F percentage remains low because IPS is still off, but was disabled by the Bypass under Load feature.  This feature does not work correctly in today's world of multi-core firewalls, as it will disable IPS on all cores even if only one of them is above the high watermark for CPU use due to an elephant flow.  Disable the Bypass under Load feature and the high F2F should return.

SecureXL is properly handling your SYN Flood protection.

You probably need to disable the Small PMTU signature to start with and see how that affects F2F.  Although Phoneboy said it only disables SecureXL templating and not throughput acceleration, I'm not sure if that is correct.

If still high F2F, next you need to examine your IPS protections and sort them by performance impact rating.  Try disabling any IPS protections with a performance impact of Critical.  Do the same thing with Inspection Settings, sort them by performance impact and disable any that are Critical unless you really need them.  This procedure is covered on pages 359-363 of the third edition of my book and should make a big difference.