The published specs for the FortiGate 100F list a "Threat Protection Throughput" of 1.5 Gbps. In my experience, vendor benchmarks are conducted under ideal, synthetic conditions that rarely map to production traffic patterns. I'm looking to gather and analyze real-world, operational data points to understand the actual performance degradation when all Unified Threat Management (UTM) features are enabled at line rate.
Specifically, for a deployment scenario with:
* **Full SSL Inspection** (including TLS 1.3 with proxies)
* **Application Control** (with full categorization)
* **IPS** (with a comprehensive signature set)
* **Web Filtering** (with full FortiGuard rating lookups)
* **Antivirus** (flow-based and proxy-based where applicable)
* **DNS Filtering**
My hypothesis, based on similar deployments, is that the effective throughput for mixed, real-world traffic (not just large-file TCP) will drop significantly below the 1.5 Gbps mark, likely into the 500-800 Mbps range under sustained load. The primary bottlenecks I've observed are not necessarily CPU, but rather the overhead of deep packet inspection and the latency introduced by multiple proxy-based services operating in series.
I'd like to see data from others who have conducted measurements. Please include:
* **Traffic Profile:** e.g., "70% web (HTTPS), 20% database, 10% video streaming."
* **Packet Size Distribution:** Average and median packet sizes are critical.
* **Measurement Methodology:** Were you using `diagnose hardware sysinfo` performance counters, SNMP graphs, or external tools like iperf3? Note: iperf3 alone is nearly useless for this, as it doesn't simulate inspected traffic.
* **FortiOS Version:** Performance characteristics can vary significantly between major releases.
* **Observed Latency Increase:** What was the incremental latency added by the UTM stack?
Example of the performance counters I monitor:
```
# diagnose hardware sysinfo
...
Current Heap Usage: 280.31 MB / 1.91 GB
Maximum Heap Usage: 432.19 MB / 1.91 GB
Current Session Usage: 5672 / 5000000
Maximum Session Usage: 19872 / 5000000
Network CPU: 12%
User CPU: 45%
System CPU: 32%
Interrupt CPU: 11%
1 min CPU avg: 45%
5 min CPU avg: 42%
10 min CPU avg: 40%
```
Without concrete data, capacity planning becomes guesswork. The financial and operational risk of undersizing a firewall is far greater than the upfront hardware cost. Let's move beyond the datasheet.
-- alex
Your hypothesis on the primary bottlenecks is spot on. In my own logs from a similar deployment, I've seen that the 500-800 Mbps range is realistic, but it's heavily dependent on the specific traffic mix. The biggest hit comes from enabling TLS 1.3 deep inspection, as the proxy process for that is far more resource-intensive than older protocols.
The other factor that often gets overlooked is the impact of FortiGuard lookup latency. When you have Web Filtering and DNS Filtering both set to do full rating checks, a burst of new connections from something like a software update can cause a queueing effect even if the CPU isn't maxed out. You'll see a throughput drop coupled with a spike in session setup time in the logs.
Have you considered the impact of the IPS signature set? Running a comprehensive set on a 100F, I've found that tuning out the noise for your specific environment is critical. Leaving thousands of irrelevant signatures enabled for, say, industrial control systems when you're a retail business adds unnecessary overhead that directly chips away at that usable throughput.
Logs don't lie.
You're totally right to question the vendor spec. I've got a 100F running exactly that config for a remote office, and your 500-800 Mbps estimate is bang on for sustained real-world traffic.
We actually tracked this for a month. The biggest surprise wasn't the average, but the *variance*. Software update Monday? Throughput could tank to 300 Mbps for 15 minutes because of all the new SSL inspection sessions and FortiGuard lookups hitting simultaneously. It's the bursty pattern that really stresses it, not the steady state.
One tip: double-check your IPS sensor. If you're using the "all_default" signatures, try pruning out categories you know are irrelevant. That gave us a consistent 5-10% boost in our worst-case scenarios. The CPU cores handling proxy services just can't keep up with the full load.
Pipeline Pilot