IXIA ThreatArmor: how does it work

No advertisement (unfortunately, vendor doesn't pay me for it :) ) but for technology review only: one more IXIA solution analysis.

There is some device provided for enterprise network implementation. It's' topological place may be external side of the network between corporate and the Internet, and the internal one behind the enterprise information security infrastructure. ThreatArmor protection is based on IP-addresses traffic filtering by source from the Internet and by destination from internal hosts.

It is a picture of TreatArmor-protected corporate network architecture.

Enterprise is on the left side and Internet is on the right one.

Packet brokers throughput math realism

This port was inspired by the IXIA seminar. As long as such events usually contain some advertising information it is necessary to search an information myself to have a material for analysis.

According to my hands-on experience with somw SPAN-aggregation solutions I can observe some mismatches.

Let me analyze some information according to some IXIA product. This information is also actual for another vendors using the same math.

1. Throughput. 

Let's try IXIA xStream 10. According to the datasheet one can see that the hardware throughput is 480 Gbps

but there are only 24 10G-interfaces in it. 

It is clear that each interface has Tx and Rx and some marketing approach allows 10G to 20G interface "transformation" on the paper. So, in theory, if some interface receives 10G and transmits the same 10G on the 24-ports device, total fabric throughput is:

24 x 20Gbps = 480Gbps

But even in this case it is impossible to have 480G in the production environment according to the...

2. ...architecture

The same document contains the solution architecture:

As I can understand some ports with IDS and VoIP recorder will be half-duplex and Hot Standby IPS will have a minimum load. Even if all ports are connected to the production line and IPS in-line, it is impossible to have 10G on Rx and 10G on Tx because an IPS will block some traffic.

So, all 480G described in the datasheet may go through the hardware fabric in the theoretical case meet such conditions:

• the peak lines throughput;
• broker's ports connect the productive line and in-line IPS only;
• no blocking actions in IPS enabled;
• IPS have real 10G throughput in each direction;
• no standby IPS nodes connected.

Or I have some misunderstanding?