A UTM firewall inspects all traffic on the network and makes a decision for every packet. A performance loss therefore reaches the user directly. The assumption that “the device is good enough” becomes one of the most expensive mistakes as the network grows.
Where the bottleneck appears
The performance of a UTM device is determined by three components: the hardware platform, the enabled features and the traffic profile. The same box can produce very different results under different configurations.
- Hardware: The processing capacity of CPU, memory, flash and network cards.
- Features: Every active feature (UTM, IPS, anti-virus, content filtering) adds processing load.
- Traffic profile: The number of concurrent connections and the protocol mix during peak hours.
Measuring capacity
The “firewall throughput” figure from the manufacturer does not reflect real performance. It is usually measured in an ideal scenario with empty rule sets and IPS and anti-virus disabled. The target has to be measured in an environment where the rules are active.
A measurement needs a defined traffic profile, a number of concurrent connections and an average packet size. Load tests should run in a maintenance window or in a non-production environment. The result has to be reported together with the share of the current utilisation it represents.
Thresholds and monitoring
Measuring is not a one-off exercise. The following indicators have to be watched continuously.
- CPU and memory usage when session count thresholds are crossed
- Temperature and fan status, which trigger hardware health alarms
- Traffic profile changes, which reveal new applications and services
- Rule set logs, which show misconfiguration and suspicious changes
- Connection drop rates, which indicate insufficient resources
Rule set hygiene
A significant part of the performance loss comes from rules that accumulated over the years. Broad rules that start with “allow everything” leave traffic uninspected and reduce the security value at the same time. Rules have to be reviewed periodically, unused entries removed and similar rules grouped.
Redundancy and high availability
A single device is a bottleneck for all traffic. In production the device should run in high availability mode, and the state synchronisation and automatic failover have to be verified with tests. Configuration backups should be taken regularly for disaster recovery.
A correctly planned firewall capacity carries the infrastructure comfortably for at least two years. The Serventa team extracts the real usage profile of your current device and prepares an upgrade or refresh recommendation where it is needed.
