* Traffic slows if all the security on a multifunction security device is running
A recent Network World story points out a simple truth that might come as a surprise to some people considering the purchase of multifunction security devices that include firewalls and VPNs.
If all the security on the device is turned on, traffic runs slower through the device. This makes sense because it is keeping state for the firewall, encrypting for the VPN and perhaps filtering for viruses or even content which requires digging deep into packets and chews up processing power.
Careful buyers shouldn’t be too surprised by this because they know how to see through performance numbers published by vendors. If the vendor says the throughput on the device is 1Gbps, the immediate follow-up question should be, “With what functions turned on?” Likely it will be just the firewall or just the firewall and VPN but not the full range of defenses the box can support, which might include antivirus, antispyware and content filtering. As the story notes, the performance when all the features are engaged could drop 50%.
People considering buying firewall/VPN gear now – either for the first time or for upgrades – should carefully factor in their use now or possible future use of VoIP. If voice packets are running through a VPN appliance with or without added features, they can be affected by any delay and jitter the boxes might introduce. The security device can become a problem for VoIP.
Vendors are working on this by coming up with special handling for voice packets. But customers should attempt to get powerful enough devices that can handle the worst-case load without injecting problems for voice.
