1. Firewall Testing Update Paul Schopis pschopis@itecohio.org

2. Overview Problem Statement Participants Problem Classification Scope of Current Testing Preliminary Results

3. Participants Terri Beamer – Denison (Check Point) Joe Simpson – Miami ( PIX ) Tom Ridgeway – UC (PIX) Greg Trefz – Stratacache (Packeteer) Gene Bassin/Jason MacDonald – OARnet IOS Firewall

4. Reported Problems H.323 won’t work at all. Connection gets made but performance is not good. H.323 seems to be in a state of flux e.g. it changes over time (can get better or worse).

5. So what are the problems? Protocol Specific –Firewall assumes it is an attack –NAT is generally bad for H.323 Packet Handling –Does firewall exceed necessary parameters for good performance to meet security need? Network in Conjunction with other two –Traffic Bursts

6. Scope of Current Testing We know what is necessary for good H.323 sessions –http://www.adec.edu/nsf/Traffic%20draftv3. 0.pdfhttp://www.adec.edu/nsf/Traffic%20draftv3. 0.pdf –http://www.adec.edu/nsf/Summary%20Test %20H.323.v7.pdfhttp://www.adec.edu/nsf/Summary%20Test %20H.323.v7.pdf Is it simply a case of poor performance at the packet layer?

7. Basic Testing Procedure Use Smartbits 600 with SmartFlow and SmartWindow Added VoIP PSQM for further insight Find effective throughput without filtering e.g. baseline Test by systematically varying allowed/denied traffic ratio to find performance bounds.

8. Preliminary Results Cisco 2651 Running IOS Firewall Suite Version 12.2(7c) –2600-dos3s-mz.122-7c.bin Tested on two Fastethernet ports

9. Raw Throughput Max @ 1518 Byte Frames (Including ethernet header and FCS fields) 27.578 Mbps Min @ 64 Byte Frames 12.109 Mbps

11. Raw Latency Jitter = Max - Min Max Jitter @ 128 Byte packet 10 Mbps Load 118ms Min Jitter @ 256 Byte Packet 20 Mbps Load 1ms Packet Sizes 128-1518 bulk of 10-50ms Latency 1152 at 10-20 Mbps down ward shift

15. Throughput Filtered Max @ 1518 Byte Packet 20Mbps – ~26% hit Min @ 64 Byte Packet 4.375 Mbps – ~67% hit

17. Latency Filtered Max @ 64 Byte Packet 20 % load 57ms Jitter Min @ 64 Byte Packet 10% Load less than 1ms Latency Distribution –100-50ms below 128 Bytes –50-10ms around 256 –100-50ms at 1024 bytes

21. Throughput Mix 20/5 –Max @ 1518 Byte Packets is 20 Mbps –Min @ 64 Byte Packets is 2.687 Mbps 15/10 –Max @ 1518 Byte Packets 11.875 Mbps –Min @ 64 Byte Packets is 1.562 Mbps 10/15 – Router dies

25. Jitter Mix 20/5 –Max @ 64 Byte Packets is 135ms STD 6.234 ms –Min @ 512 Byte Packets is 6ms STD 2.295 ms 15/10 –Max @ 64 Bytes is 112ms STD 5.6 ms –Min @ 1280 Bytes is 12 ms STD 6.206 ms 10/15 –Death

26. Latency Distribution Mix 20/5 –Lt 512 is 50-100ms range 15/10 –Ditto

31. PSQM 0 is best 6.5 is worst Not real measure for H.323 but might help give insight G.711 ulaw = 218 byte frames e.g. four codec frames per packet It is less than 1% of traffic

32. 64 byte background

33. 128 Byte Background

34. 256 Byte Background

35. 512 Byte Background

36. 1024 & 1518 Byte Background