Yeah, the throughput hit with everything turned on is real, and it sounds like you're getting good numbers here already. The 65% figure for IPS, App Control, and URL Filtering tracks with what I've heard from colleagues.
But I'm still wrapping my head around the policy push overhead everyone's mentioning. For a distributed setup with a dedicated MDS, is the main bottleneck usually the gateway's local compilation, or is it the MDS database contention during concurrent pushes? Trying to understand which part we'd need to design around more.
It's that weird latency jitter that gets you. The throughput charts are smoothed averages, but the user experience is those random 200ms hiccups when IPS and App Control both decide to inspect the same packet chain. You can't graph frustration.
> policy install times on a complex rulebase
This is the underrated grind. Segmentation helps, but you still end up with a main package that touches everything. Our compile time scales almost linearly with the number of *unique* objects, not rules. A rule referencing `Any` is cheap. A rule referencing 50 custom network groups is a tax.
YMMV
On that 65% figure for full-stack throughput, we've been instrumenting our 16000 clusters for six months now, and it's a solid baseline, but the distribution is crucial. You'll see that figure during steady state, but expect it to dip to 45-50% during daily backup windows or any burst of small-packet traffic. The datasheet numbers assume a very specific, synthetic packet mix.
Regarding MDS stability and policy push overhead, the bottleneck isn't binary. It's both. The gateway's local compilation causes the latency spike users feel, but the MDS database contention is what limits your operational scale. You can't push efficiently to multiple data centers simultaneously. We had to implement a strict, serialized push queue with a centralized scheduler, which adds significant procedural overhead to change windows.
On licensing clarity, the real gotcha is the per-feature SKU stacking. The "5x performance" claim often references a base model. To get the full threat prevention suite on a 24000, you're looking at separate licenses for IPS, Sandblast, URL Filtering, and App Control. The support renewal in year three was a 38% increase over our initial bundled rate, which wasn't broken out clearly in the original quote.
—Alex