I have been conducting a series of standardized performance evaluations on the Barracuda CloudGen WAF and NGFW offerings in a lab environment, specifically focusing on the performance delta between a baseline configuration and a fully-secured deployment. My initial findings suggest a non-linear degradation in throughput as security inspection layers are sequentially enabled, but I lack peer-reviewed community data to corroborate or challenge my results.
My testbed is constructed as follows:
* **Hardware:** Bare-metal, dual-socket Xeon Gold 6348, 256GB RAM, dual 100GbE NICs.
* **Hypervisor:** KVM with SR-IOV passthrough for the CloudGen virtual appliance (allocated 16 vCPUs, 64GB RAM).
* **Software Version:** CloudGen OS 9.0.1.
* **Test Methodology:** I'm using a modified `wrk2` workload generator over HTTPS, with payloads designed to simulate a mix of static content (95%) and dynamic API calls (5%). Latency percentiles (p50, p90, p99, p99.9) and requests/sec are the primary metrics.
The security feature stack is applied incrementally in this order:
1. **Baseline:** Plain TLS termination (RSA-2048).
2. **Level 1:** + Intrusion Prevention System (IPS) with all recommended rule sets.
3. **Level 2:** + Full SSL Inspection (TLS 1.2/1.3 decryption & re-encryption).
4. **Level 3:** + Advanced Threat Protection (ATP) and Sandboxing for the dynamic payload portion.
5. **Level 4:** + All WAF rules (OWASP Core Rule Set, Bot Protection, API Security) set to "Block" mode.
My preliminary data for a ~16KB average response size shows a steep decline at Level 2 and another at Level 4.
```
Configuration | Avg Req/s | p99 Latency
----------------------|-------------|-------------
Baseline | 124,750 | 11.2 ms
Level 1 (IPS) | 118,200 | 13.5 ms
Level 2 (+SSL Inspect)| 41,850 | 87.4 ms
Level 3 (+ATP) | 39,100 | 102.1 ms
Level 4 (+Full WAF) | 18,300 | 245.7 ms
```
The most significant penalty is clearly introduced by full SSL/TLS inspection, which is expected but the magnitude (~70% drop) seems higher than some competing vendors' published specs. The second major drop occurs with the WAF in active blocking mode, which I suspect is due to the regex complexity of the rule set.
I am seeking comparisons from other community members who have performed similar reproducible tests. Specifically:
* Are your observed throughput deltas consistent with these figures?
* Have you found specific security features or rule subsets that are disproportionately expensive? (e.g., certain IPS categories, specific WAF rules).
* What, if any, hardware offload or tuning parameters (TCP settings, rule reordering, SSL inspection cache) have you found most effective in mitigating the performance impact?
* Does the performance profile change significantly under a different workload pattern, such as a higher percentage of small, dynamic API requests?
I will be happy to share my full testing harness, including the exact `wrk2` Lua scripts and CloudGen config exports, for anyone wishing to reproduce or build upon this. Reproducible data is key to forming a valid community understanding of the real-world cost of security in this platform.
-- bb42
-- bb42