RFC 9411

InfotecsTech Builds Custom Kubernetes-Based Traffic Generator for NGFW RnD and Performance Testing

InfotecsTech developed an in-house traffic generator to support development and testing of its high-performance NGFW cluster in active-active mode. The team rejected commercial solutions from IXIA and Xinertel due to high cost, insufficient flexibility for complex NGFW functions, and geopolitical restrictions. The resulting platform runs on Kubernetes with a master node managing Registry, Discovery, and Crux components while worker nodes host containerized generators. Supported generators include Cisco TRex for throughput and connection testing, SIPp for VoIP scenarios, pyftpdlib-based FTP generator, Yandex Tank with Nginx for live TLS traffic, and Selenium-based legitimate clients against OWASP Juice Shop. Practical scenarios cover VoIP call storms, maximum concurrent connections, 400 Gbit/s UDP throughput, 5 million CPS, and IMIX traffic at 300 Gbit/s with packet loss analysis. The system integrates Camunda for full automation of test scenarios and device configuration.

How Ideco Measures NGFW Performance Using TRex ASTF and RFC 9411 Methodology

Ideco engineers have published a detailed methodology for benchmarking the performance of their Ideco NGFW Novum product on the Ideco EX hardware platform. The team uses TRex in Advanced Stateful mode to generate realistic L4-L7 traffic and follows RFC 9411 guidelines to ensure reproducible results across different test environments. Key metrics include throughput on UDP 1518-byte frames reaching 200 Gbit/s, TCP/HTTP performance varying from 100 Gbit/s down to 62 Gbit/s depending on object size, and EMIX mixed traffic dropping from 92 Gbit/s with firewall only to 15.5 Gbit/s when all inspection engines are enabled. The methodology incorporates binary search for maximum load, a 1% session drop threshold, and 300-second hold times per test point to capture real-world behavior rather than short-term peaks. All tests were performed without TLS decryption, with separate plans for hardware-based Keysight BreakingPoint testing when decryption is required. The full article includes hardware specifications, traffic profiles, loss calculation formulas, and configuration details to allow anyone to reproduce the measurements.