Comparison SSL VPN - Clients | Watchguard vs. Sophos UTM

Markus_LBMarkus_LB
edited July 2021 in Firebox - VPN Mobile User

Hi all,

we just compared the Watchguard SSL VPN client with the Sophos OpenVPN client and found that on the same system with measured and controlled bandwidth, the Sophos OpenVPN was significantly faster than the one from watchguard.

We are talking about 8-15 Mbps in both directions on the same system with the same destination-host. The tests were performed with iperf3, several times with different targets in the LAN -> similar results here !

What can be the trigger here ?

The Watchguard does NOT have a large set of rules, the Sophos is almost "bursting" with rules and various interfaces that sometimes have massive traffic, so I would actually expect the result the other way around.

Any ideas about this ?

Thanks and best regards,

Markus from Munich

Comments

  • Bruce_BriggsBruce_Briggs

    Perhaps this:

    Sophos ramps up hardware acceleration for TLS inspection in XGS Series firewalls
    https://channelbuzz.ca/2021/04/sophos-ramps-up-hardware-acceleration-for-tls-inspection-in-xgs-series-firewalls-36462/

  • mboscolomboscolo Moderator, WatchGuard Representative

    Hello Markus,

    Fireboxes process SSLVPN connections using only CPUs, the encryption chips are not used to process SSLVPN encryptions.

    To ensure the best performance we recommend using an AES encryption -

    Encryption

    Select an algorithm to encrypt the traffic: 3DES, AES (128-bit), AES (192-bit), or AES (256-bit). In Fireware v12.2 or higher, you can also select AES-GCM (128-bit), AES-GCM (192-bit), or AES-GCM (256-bit). We recommend AES encryption. For the best performance, choose a 128-bit AES variant. For the strongest encryption, choose a 256-bit AES variant.

    If you select 3DES, be aware of a potential, but unlikely, security attack. For more information, see Sweet32 Vulnerability in the WatchGuard Knowledge Base.

    https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/mvpn/ssl/configure_fb_for_mvpn_ssl_c.html#Advanced

    Mark Boscolo
    WatchGuard Moderator

  • greggmh123greggmh123

    Mark,

    Which is faster, AES 256-bit or AES-GCM 256-bit?

    Gregg Hill

  • james.carsonjames.carson Moderator, WatchGuard Representative

    @Greggmh123
    It'll depend on the processor and load of the device you're using.

    On a T70 that has a processor that's more optimized for that type of work, GCM will go faster. On a bigger device (M-series) AES will usually be faster.
    You also have to take into account the client devices and what their processors are more efficient at.

    If you'd like to use hardware acceleration on the WatchGuard, using IKE (IPSec or IKEv2) may be a better choice.

    -James Carson
    WatchGuard Customer Support

  • greggmh123greggmh123

    @James_Carson said:
    @Greggmh123
    It'll depend on the processor and load of the device you're using.

    On a T70 that has a processor that's more optimized for that type of work, GCM will go faster. On a bigger device (M-series) AES will usually be faster.
    You also have to take into account the client devices and what their processors are more efficient at.

    If you'd like to use hardware acceleration on the WatchGuard, using IKE (IPSec or IKEv2) may be a better choice.

    Thank you. My client base is T35 devices. I have a T20, and any new sales will be T40 units.

    Gregg Hill

  • Ville2Ville2

    @james.carson said:
    @Greggmh123
    It'll depend on the processor and load of the device you're using.

    On a T70 that has a processor that's more optimized for that type of work, GCM will go faster. On a bigger device (M-series) AES will usually be faster.
    You also have to take into account the client devices and what their processors are more efficient at.

    Is this documented somewhere?

    Does this also concern BOVPN connections? I now have M270 <> T80 BOVPN with GCM256, DH20 - could I expect a meaningful change in throughput / CPU usage if I opted for AES256 instead?

    If you'd like to use hardware acceleration on the WatchGuard, using IKE (IPSec or IKEv2) may be a better choice.

    Does Watchguard have plans to support hardware acceleration with SSL?

  • james.carsonjames.carson Moderator, WatchGuard Representative

    @Ville2

    For a T80, AES256/GCM won't have much if any difference. Dropping to DH 14 might give you a (small) increase, but I wouldn't expect anything hugely substantial.

    We don't document benchmarks for every cipher pair/DH group, but knowing the architecture for the devices helps highlight what each is good at. T70 has an intel based processor that has some optimization for AES-GCM. T80 is ARM based. Processor types are documented in the hardware guides for each device.
    https://www.watchguard.com/wgrd-help/documentation/hardware-guides

    -James Carson
    WatchGuard Customer Support

Sign In to comment.