2

I'm refining a Juniper SRX 210 UTM IDP implementation in a small business. I'm new to Junos, so I'm hoping someone will be able to point me in the best-practices direction.

The customer initially reported that tests using things like Speakeasy bandwidth test shows OK download speeds, but the upload speeds are cut in half; With a 50mbps synchronous connection, they're getting 50mbps down, but only 25mbps up. I'm hazarding a guess that this is because the SRX is inspecting these traffic types in detail as they exit the device.

The SRX 210 data sheet says it is capable of 65mbps IPS performance, but I'm not seeing that. Additionally, the log displays the following messages whenever I run a "speed test": 

PERF_MON: RTPERF_CPU_THRESHOLD_EXCEEDED: FPC 0 PIC 0 CPU utilization exceeds threshold, current value=97

I'm guessing that the UTM package is somehow putting a strain on the SRX, but I don't know enough about the SRX platform to troubleshoot this properly.

Suggestions appreciated.

Improve this question
1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 8, 2017 at 21:02

1 Answer 1

Reset to default
3

Per a JNCIE who offered help:

This behavior is expected on branch-devices which lack dedicated processing for UTM and IDP functionality.

The fix is to granularly apply an IDP policy which applies only to traffic you care a lot about and judiciously choose your applied signatures based upon needs versus performance impact.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.