The objective of this master’s thesis is to provide a comprehensive presentation of next-generation firewalls, to test the impact of various network traffic parameters on CPU load, and to compare the testing results across different high availability architectures.
The theoretical part introduces the types of firewalls and their key roles in securing and controlling network traffic. Special attention is given to the advanced design of next-generation firewalls, which, in addition to the classical analysis of IP packet headers, also perform in-depth inspection of content and implement additional security functionalities such as intrusion prevention systems, TLS decryption, and sandboxing. Furthermore, various firewall deployment models are described, highlighting the advantages and disadvantages of individual architectural approaches.
In the practical part of the thesis, the testing methodologies are first presented, along with the importance of selecting appropriate traffic patterns when evaluating firewall performance. Particular focus is placed on traffic with variable parameters, such as the number of connections per second, packets per second, and bit rate. This synthetic traffic is used to simulate various load scenarios by altering these values, significantly influencing the testing results. Tests are then carried out on three different high-availability firewall architectures, each based on different technologies and processing traffic in distinct ways. In addition to performance comparison, the analysis also examines the effects of enabled security functionalities on CPU load.
The test results clearly demonstrate that the type of traffic and the selection of parameters have a crucial impact on defining firewall throughput. The data shows that a high number of connections and packets per second impose a greater load on the CPU than a high bit rate. The findings also confirm the advantages of distributed architecture, in which offloading individual CPU cores enables more efficient traffic processing.
|
