How we did it

Testing gigabit firewalls isn't easy, so we turned to Spirent Communications for a SmartBits 2000 with 20 Fast Ethernet ports. We used Extreme Networks' Summit 48 switches to aggregate 10 ports of Fast Ethernet into each Gigabit port on the NetScreen-500. From there, we used Spirent's SmartFlow and SmartTCP applications to generate User Datagram Protocol (UDP) streams and TCP connections. For our "Internet packet size mix" profile, we used data collected from an Internet backbone to build a profile of approximately 50% small packets (96 octets or less), 10% large packets (1,518 octets, the Ethernet maximum transmission unit), 20% 576 octets (a common WAN maximum transmission unit), and 20% assorted between 192 and 1,024 octets. We set up 20, 2,000 and then 20,000 sessions with Spirent's SmartFlow through the NetScreen-500, using UDP as the transport protocol and measured loss rates. When loss went above 0.1%, we decided that the NetScreen had run out of steam and took the next lower bandwidth measure as total throughput capability. We tested throughput in two ways. For the statistics that are reported as "throughput," we set up a "pretest" that established the sessions before starting high load. For the "combination" tests, we cleared out all sessions and made the NetScreen-500 not only absorb a high data transfer load but also a high session establishment load. We also used Spirent's SmartTCP software to test connection establishment and tear-down rates using TCP. We increased the rate of connection set up and tear down until we had a loss rate above 0.1%.

For VPN testing, we used a combination of eight Nokia CC2500 VPN gateways and Alcatel 7137 VPN gateways, with a total combined throughput of 520M bit/sec. These systems established a small number of security associations to encrypt/_decrypt IP Security Triple-DES traffic to the NetScreen-500. We used the same SmartBits setup as in the previous test, but with 16 Fast Ethernet ports instead of 20.