A test of NAC appliance performance

For ConSentry and Nevis boxes, it’s a tradeoff between speed and security.

Line-rate performance may be a given in Layer-2/3 switches, but what about the NAC devices that sit alongside them? To find out, we loaded up the ConSentry and Nevis devices with the kind of Windows application traffic they’re likely to see in the enterprise.

Both the ConSentry and Nevis boxes ran at or near line rate when configured as Layer-2 switches, but that’s not how anyone uses them. Performance was less speedy when these devices firewalled traffic and inspected packet payloads. Tradeoffs between performance and security are nothing new, but in the case the differences ranged from slight to huge.

NAC forwarding rates

We tested NAC performance using the Common Internet File System (CIFS), the protocol used by Microsoft Windows. We captured live traffic as a client mapped a network drive on a server, uploaded and downloaded a 1-MB text file and then disconnected the network drive. This traffic pattern ensured that multiple types of CIFS transactions were involved and also (because of the 1-MB transfer in each direction) that the pipe would be full in both directions. These devices are designed to sit in the core of the network and are not traditional Internet-facing firewalls. This means that a Windows-heavy traffic mix for stress testing is more meaningful than heavy HTTP traffic.

To scale up traffic across eight pairs of ports on each NAC device, we used the Spirent Avalanche and Reflector test instruments to replay the captured traffic from 1,500 concurrent users.

In a baseline measurement with no device on the test bed, the aggregate forwarding rate between Avalanche and Reflector test instruments was about 8.67 Gbit/s, or roughly 4.3 Gbit/s in each direction. That’s a little shy of the 10-Gbit/s capacity of these devices, but as it turned out both devices tested ran slower than this level in anything but a layer-2 configuration.

We assessed NAC device performance in three modes: as a simple layer-2 switch, allowing all traffic to be forwarded, as a firewall with common enterprise rules enabled and as a firewall with layer-7 content inspection enabled.

In the layer-2 tests, the ConSentry device forwarded traffic at essentially the same rate as our baseline test, with Nevis about 100 Mbit/s slower. These are minor differences; as switches, these devices run at or close to line rate. However, you don’t buy these boxes to use as switches, so while these numbers are admirable, they aren’t very useful.

As firewalls, both the ConSentry and Nevis devices reduced forwarding rates by about 1 Gbit/s, to 7.55 Gbit/s in ConSentry’s case and 7.68 Gbit/s in Nevis’ case. These numbers represent 86% and 90%, respectively, of these devices’ layer-2 forwarding rates.

There was a far larger tradeoff in ConSentry’s case once we enabled layer-7 inspection. ConSentry device’s rate plummeted to 2.05 Gbit/s, less than 24% of its layer-2 performance.

The slowdown appears to be specific to CIFS inspection. We also tried testing the ConSentry device using Web traffic rather than CIFS, and results were close to line rate. As a result of our testing, ConSentry found an issue in its inspection software that increased the performance “cost” for CIFS compared with Web traffic. The company was already testing a fix at press time, but no release date was available.

Nevis doesn’t support layer-7 inspection, but does have a sophisticated intrusion-prevention system, a typical performance killer. To push Nevis to its limits, we enabled its “Threat Control” blocking and found that the Nevis device forwarded traffic at essentially the same rate as in the firewall tests, 7.67 Gbit/s.

Nevis says it has achieved the 10-Gbit/s rated capacity for its system in internal testing, but that was using a mix of UDP and TCP traffic. We stayed away from the approach of bit-blasting IP or UDP packets in this test, because these devices are more likely to handle stateful CIFS (or other TCP flows) in enterprise settings.

Thanks to vendors that supplied test-bed infrastructure for this project. Spirent Communications supplied its Avalanche and Reflector traffic generator/analyzers and helped debug test configurations. Apcon supplied its IntellaPatch physical layer switch. Extreme Networks supplied Summit S7i switches. And APC provided NetShelter VX racks to hold the test gear.

David Newman is president of Network Test, an independent test lab in Westlake Village, Calif. Snyder is a senior partner at Opus One, a consulting firm, in Tucson, Ariz. They can be reached at dnewman@networktest.com and Joel.Snyder@opus1.com, respectively.


Return to main NAC test

Learn more about this topic

NAC Buyer's Guide

ConSentry upgrades its NAC software, boosts capacity

11/06/06

NAC will make a splash at Interop

05/01/06

Mirage updates network access control appliance

01/30/06

Join the Network World communities on Facebook and LinkedIn to comment on topics that are top of mind.
Related:
Must read: 10 new UI features coming to Windows 10