Innostage Lab Benchmarks PT NGFW 1.10.3 Performance in Eight Load Scenarios

Innostage researchers conducted extensive performance testing of PT NGFW version 1.10.3, the certified release at the time of trials. The evaluation covered TCP connection setup rates, concurrent session capacity, and throughput on a custom EMIX traffic profile with varying security modules enabled. Tests used Cisco TRex generators and a high-rule-count policy of 100,000 entries to simulate realistic enterprise conditions. Results showed the device sustaining 700,000 CPS and 6.4 million concurrent connections, matching or approaching vendor claims under HA-cluster configuration. Throughput remained above 27 Gbps even with IPS, application control, antivirus, NAT, URL filtering, and logging active. The report highlights differences in test methodology compared with vendor figures, including packet sizes and clustering setup.

HabrTranslated from Russian

Read at source

Innostage has published the first part of its independent laboratory evaluation of PT NGFW 1.10.3, focusing on performance under realistic loads rather than isolated vendor specifications.

The team selected version 1.10.3 because it carried the FSTEC certificate required for many Russian government and critical-infrastructure projects, even though 1.11.1 was already available.

Traffic was generated with Cisco TRex using an EMIX profile derived from real internal network captures. The mix comprised HTTPS (5 %), RTSP (28 %), HTTP (14 %), SMB (43 %), SIP (5 %), and RDP (5 %).

The test bed included two PT NGFW 2010 appliances in an HA cluster with aggregated 10/25 GbE interfaces, a management server running Debian 11, multiple Cisco TRex instances, and supporting Windows and Linux hosts.

In the first scenario the firewall sustained 700 000 new TCP connections per second before degradation, compared with the vendor claim of 900 000 CPS. The difference is attributed to the HA-cluster configuration with LACP and a 1 KB response size versus the vendor’s 0.001 KB test.

The second test confirmed the advertised 6.4 million concurrent sessions under a 10 000-rule policy with logging and application control enabled.

Subsequent EMIX tests measured throughput while progressively enabling IPS, application control, antivirus, NAT, URL filtering, and logging. Even with all modules active the device delivered approximately 27 Gbps, exceeding several vendor-stated figures obtained under lighter configurations.

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Other

Mail.ru Reduces Lifetime 1TB Cloud Storage Promo to Standard 8GB Quota for Select Users
Kimi K3 Open Model Surpasses Closed AI Leaders with Million-Token Context and 896 Experts
Innostage Completes Functional Testing of PT NGFW 1.10.3 Across 156 Criteria