R80.10 performance on standalone 4200

[MichelB]

We have a few standalone SG-4200's running 77.30. We've been having performance issues with these units from the moment we bought them and I feel like they're seriously underpowered.
Regardless, we're running into several issues that have fixes for them, but only when we upgrade to R80.10.

Does anyone have any experience running R80.10 on the 4000 series? While I realize there are supposed to be several performance improvements, I'm already a bit wary of installing a new release on a unit that has difficulties enugh running the current one.

[dilianch]

You wont be able to run R80.10 on 4200 appliance, as it requires 8GB of RAM for standalone mode.
It is noted on page 12 of R80.10 Release notes.

[MichelB]

Thanks... I realized it 10 minutes ago as well. We were always told it was no problem that's why I didn't really look into it any further.

Perhaps anyone can say anything about the performance of R80.10 when using a seperate management server?

[GiladT]

Thanks... I realized it 10 minutes ago as well. We were always told it was no problem that's why I didn't really look into it any further.

Perhaps anyone can say anything about the performance of R80.10 when using a seperate management server?

Hi,

My name is Gilad and I'm the manager of the release management group which is responsible for the R80.10 release.
In R80.10, the Security Gateway performance and resource utilization are better compared to R77.30 Security Gateway.

Thanks,
Gilad Tavasi

[cciesec2006]

Hi,

My name is Gilad and I'm the manager of the release management group which is responsible for the R80.10 release.
In R80.10, the Security Gateway performance and resource utilization are better compared to R77.30 Security Gateway.

Thanks,
Gilad Tavasi

Since you're the manager of the release management which is reponsible for the R80.10 release, for crying out loud, please make R80.10 works the way it supposed to work so that I can migrate from R77.30 to R80.10. Not sure why you guys did a "half-baked" product in R80.10: https://www.cpug.org/forums/showthre...light=provider

[EricAnderson]

Hi,

My name is Gilad and I'm the manager of the release management group which is responsible for the R80.10 release.
In R80.10, the Security Gateway performance and resource utilization are better compared to R77.30 Security Gateway.

Thanks,
Gilad Tavasi

I spite of cciecec2006 venting his frustrations (understandable as they may be), let me welcome you, Gilad.

While some may take your presence here as an opportunity to vent frustrations , I'd like to make sure you understand that most of the community will welcome any guidance/suggestions/assistance you can give.

-E

[EricAnderson]

In response to the OP, while 4200's can run standalone (pre-R80), it's never really been an ideal situation.

All of the performance specs given for any gateway devices are based on them being run only as gateways. The second you task them with management duties, you're asking too much of them, and all of those numbers should be expected to drop - sometimes significantly. (Anyone ever try a UTM-1 130 in standalone?)

While R80.10 should offer some performance gains on any gateway, in your case, if you move management off to another device(s) and run the 4200's as only gateways, you'll definitely breathe new life into them.

-E

[PhoneBoy]

Anecdotal evidence suggests a 2200 (same basic hardware as a 4200) will have better performance on R80.10 than R77.30.
That assumes it is deployed in a distributed environment.

[MichelB]

In response to the OP, while 4200's can run standalone (pre-R80), it's never really been an ideal situation.

All of the performance specs given for any gateway devices are based on them being run only as gateways. The second you task them with management duties, you're asking too much of them, and all of those numbers should be expected to drop - sometimes significantly. (Anyone ever try a UTM-1 130 in standalone?)

While R80.10 should offer some performance gains on any gateway, in your case, if you move management off to another device(s) and run the 4200's as only gateways, you'll definitely breathe new life into them.

-E

Thank you for your response. We're dealing mostly with smaller environments here and the 4200's in this case were deployed in a small-enterprise setup. This were really our first steps into the whole Checkpoint product suite as we'd recently switched over from the old Juniper's. We've been in contact with our local supplier and Checkpoint in order to find the best solution for this environment and came up with a supported stand-alone setup. It saddens me that, now years later, I cannot count the amount of times I've been told something like: "yeah standalone is supported, but it's never ideal". The sizing tool, for example, also gives you the option to select local management, decreasing SPU, but it's still a valid option.

Anecdotal evidence suggests a 2200 (same basic hardware as a 4200) will have better performance on R80.10 than R77.30.
That assumes it is deployed in a distributed environment.

Thanks! It gives some hope for the near future for these devices. We're contemplating buying a Smart-1 and later on slowly replace the 4200 with a 5000-series.
I really feel like we were ill-advised on this...

[ShadowPeak.com]

The biggest constraint with the lower-end 2012 series of appliances in regard to a standalone setup was not CPU power, but amount of RAM. The original version of the 2200 shipped with 2GB of RAM, the 4X00 series with only with 4GB which is not really enough for standalone clustered operation (i.e. "Full HA") and caused a lot of swapping/paging to hard disk. Thankfully the replacement for the 2200, the 3100/3200 units, come standard with 8GB of RAM.

[MichelB]

The biggest constraint with the lower-end 2012 series of appliances in regard to a standalone setup was not CPU power, but amount of RAM. The original version of the 2200 shipped with 2GB of RAM, the 4X00 series with only with 4GB which is not really enough for standalone clustered operation (i.e. "Full HA") and caused a lot of swapping/paging to hard disk. Thankfully the replacement for the 2200, the 3100/3200 units, come standard with 8GB of RAM.

In your experience, would you say the hardware (in this case RAM) was therefor underpowered?

[ShadowPeak.com]

In your experience, would you say the hardware (in this case RAM) was therefor underpowered?

For Full HA operation while activating any reasonable number of gateway blades, yes. Thankfully RAM was bumped up a lot in the new generation of appliance hardware.

[tomersole']

Since you're the manager of the release management which is reponsible for the R80.10 release, for crying out loud, please make R80.10 works the way it supposed to work so that I can migrate from R77.30 to R80.10. Not sure why you guys did a "half-baked" product in R80.10: https://www.cpug.org/forums/showthre...light=provider

Hi, that thread seemed pretty done to me as Yaelle from CP gave her answer. If you feel like this doesn't address the needs, please reply over there.