• On-Premises Analytics 2.5.5 for ESXi
• About this Guide
  • Guide Conventions
• System Requirements
  • Supported Firewalls
  • Additional Firewall Requirements
  • Supported Platforms
  • Hardware Compatibility
  • Minimum Requirements
  • IPFIX Based Licensing Model
  • IPFIX Based Capacity Planning
  • Backup and Recovery Information
  • Importing Firewall Configurations
  • Creating a MySonicWall Account
• Installing On-Premises Analytics on ESXi
  • Obtaining the Installation Image
  • Installing On-Premises Analytics on ESXi
  • Configuring On-Premises Analytics on ESXi
  • Adding Firewalls to On-Premises Analytics
• Licensing and Registering Your On-Premises Analytics Instance
  • Registering the On-Premises Analytics Instance
  • Activating Firewall Licensing for Syslog-Based On-Premises Analytics
  • Deregistering Your On-Premises Analytics Instance
• Upgrading On-Premises Analytics
  • Upgrading Analytics 2.5.5
    • Upgrading Analytics with data in external disk
    • Upgrading Analytics with data in internal disk
      • [[[Missing Linked File System.LinkedTitle]]]
    • Unmounting the Hard Disk from older Analytics Version
    • Mounting the Hard Disk on new Analytics
  • Upgrading Analytics using SWI file
• Migrating Data From Internal to External Disk
  • Preparing the Analytics to Add External Disk
  • Adding External Disk
  • Migrating the Data To External Disk
• Using the Management Console
  • Connecting to the Console
  • Management Console Operations
    • System Info
    • Storage
    • Network Interfaces
    • Diagnostics
    • NTP Server
    • Reboot | Shutdown
    • About
    • Logs
  • Using SafeMode on the Management Console
    • Enabling SafeMode
    • Disabling SafeMode
    • Configuring the Network Interfaces in SafeMode
      • Configuring Interface Settings
      • Disabling an Interface
    • Installing a Software Upgrade in SafeMode
    • Downloading Logs in SafeMode
• SonicWall Support
  • About This Document

IPFIX Based Capacity Planning

The following table links hardware requirements to license levels and flows/logs per second or per day.

Typical Installations	Storage(based on licenses)	Flows per second or day
4 Core, 8 GB -default	2 GB/ day	300 flows/sec and 20 million flows/day
8 Core, 16 GB	5 GB/ day	750 flows/sec and 20 million flows/day
16 Core, 32 GB	15 GB/ day	2250 flows/sec and 20 million flows/day
32 Core, 64 GB	30 GB/ day	4500 flows/sec and 20 million flows/day
64 Core, 64 GB	100 GB/ day	15000 flows/sec and 20 million flows/day

In the following three tables, hardware requirements for specific license levels are linked to specific numbers of different models of firewalls.

VM Hardware Configuration	TZs / SOHOs / NSv low capacity (number of firewalls)
4 Core, 8 GB - default	10 (Includes all TZ and SOHO models along with NSv models 10 to 100.)
8 Core, 16 GB	40
16 Core, 32 GB	80
32 Core, 64 GB	160
64 Core, 64 GB	350

VM Hardware Configuration	NSa / NSv medium capacity (number of firewalls)
4 Core, 8 GB - default	1 (Includes NSa 2600-6600, NSv 200-400.)
8 Core, 16 GB	3
16 Core, 32 GB	6
32 Core, 64 GB	12
64 Core, 64 GB	25

VM Hardware Configuration	SM / NSa / NSv high capacity (number of firewalls)
4 Core, 8 GB - default	0 (Includes SuperMassive 9000 series, NSa 9200-9800, NSv 800-1600.)
8 Core, 16 GB	1
16 Core, 32 GB	3
32 Core, 64 GB	6
64 Core, 64 GB	12

The following table shows recommended guidelines for main memory to support different numbers of firewalls.

Number of Firewalls	Recommended Amount of Main Memory
10	8 GB
40	16 GB
80	32 GB
350	64 GB

Example:

This example considers license levels required to collect and analyze IPFIX data from five TZ series firewalls and one NSa 9450 firewall.

Looking at the table linking VM hardware configurations to entry-level firewall numbers, we see that a 4 CPU, 8 GB VM should handle up to ten of these TZ series firewalls.

VM Hardware Configuration	TZs / SOHOs / NSv low capacity (number of firewalls)
4 Core, 8 GB - default	10

Likewise, we see that a 8 core, 16 GB can handle IPFIX flows from a single high-capacity firewall such as the NSa 9450.

VM Hardware Configuration	SM / NSa / NSv high capacity (number of firewalls)
4 Core, 8 GB - default	1

So, it makes sense choose the license level associated with 12 cores 24 GB VM. This will support 50 million log entries per day and should cover these six firewalls. 10 cores may suffice, but 12 should provide head room.

Of course, this sort of heuristic approach has its limits. Whether the firewalls are running applications that throttle throughput (for example, Advanced Threat Prevention), or whether the firewalls are deployed on the perimeters of a single-site, enterprise network or, instead the NSa 9450 is on an intercontinental link within the enterprise network; these are all factors to consider.

Contact you SonicWall sales representative for further guidance.