On-Premises Analytics Hyper-V Deployment Guide

IPFIX Based Capacity Planning

The following table links hardware requirements to license levels and flows/logs per second or per day.

Typical Installations Storage(based on licenses) Flows per second or day
4 Core, 8 GB -default 2 GB/ day 300 flows/sec and 20 million flows/day
8 Core, 16 GB 5 GB/ day 750 flows/sec and 20 million flows/day
16 Core, 32 GB 15 GB/ day 2250 flows/sec and 20 million flows/day
32 Core, 64 GB 30 GB/ day 4500 flows/sec and 20 million flows/day
64 Core, 64 GB 100 GB/ day 15000 flows/sec and 20 million flows/day

In the following three tables, hardware requirements for specific license levels are linked to specific numbers of different models of firewalls.

VM Hardware Configuration TZs / SOHOs / NSv low capacity (number of firewalls)
4 Core, 8 GB - default 10 (Includes all TZ and SOHO models along with NSv models 10 to 100.)
8 Core, 16 GB 40
16 Core, 32 GB 80
32 Core, 64 GB 160
64 Core, 64 GB 350
VM Hardware Configuration NSa / NSv medium capacity (number of firewalls)
4 Core, 8 GB - default 1 (Includes NSa 2600-6600, NSv 200-400.)
8 Core, 16 GB 3
16 Core, 32 GB 6
32 Core, 64 GB 12
64 Core, 64 GB 25
VM Hardware Configuration SM / NSa / NSv high capacity (number of firewalls)
4 Core, 8 GB - default 0 (Includes SuperMassive 9000 series, NSa 9200-9800, NSv 800-1600.)
8 Core, 16 GB 1
16 Core, 32 GB 3
32 Core, 64 GB 6
64 Core, 64 GB 12

The following table shows recommended guidelines for main memory to support different numbers of firewalls.

Number of Firewalls Recommended Amount of Main Memory
10 8 GB
40 16 GB
80 32 GB
350 64 GB

Example:

This example considers license levels required to collect and analyze IPFIX data from five TZ series firewalls and one NSa 9450 firewall.

Looking at the table linking VM hardware configurations to entry-level firewall numbers, we see that a 4 CPU, 8 GB VM should handle up to ten of these TZ series firewalls.

VM Hardware Configuration TZs / SOHOs / NSv low capacity (number of firewalls)
4 Core, 8 GB - default 10

Likewise, we see that a 8 core, 16 GB can handle IPFIX flows from a single high-capacity firewall such as the NSa 9450.

VM Hardware Configuration SM / NSa / NSv high capacity (number of firewalls)
4 Core, 8 GB - default 1

So, it makes sense choose the license level associated with 12 cores 24 GB VM. This will support 50 million log entries per day and should cover these six firewalls. 10 cores may suffice, but 12 should provide head room.

Of course, this sort of heuristic approach has its limits. Whether the firewalls are running applications that throttle throughput (for example, Advanced Threat Prevention), or whether the firewalls are deployed on the perimeters of a single-site, enterprise network or, instead the NSa 9450 is on an intercontinental link within the enterprise network; these are all factors to consider.

Contact you SonicWall sales representative for further guidance.

Was This Article Helpful?

Help us to improve our support portal

Techdocs Article Helpful form

  • Hidden
  • Hidden

Techdocs Article NOT Helpful form

  • Still can't find what you're looking for? Try our knowledge base or ask our community for more help.
  • Hidden
  • Hidden