Forum Discussion

Manuel_Kuenzi_5's avatar
Manuel_Kuenzi_5
Icon for Nimbostratus rankNimbostratus
Nov 26, 2012

How do ASM and http profile add to the roundtriptime

Hi everyone

 

I am looking for figures on how asm and the http profile add to the roundtriptime.

 

Currently we are making some performancetestes for an application wit asm and http profile enabled. What we see is, that we add 150ms to the roundtriptime as soon as we add a http Profile. We add another 100ms if we enable asm. Without http profile (and asm) we have a roundtriptime of 350ms. I find it is clear, that these numbers are dependet of the application behind the asm (and this application is quite complex). But still 250ms additional RTT for asm seems like quite a lot for me.

 

Is there any way to optimize these numbers?

 

Thanks for your help

 

Manuel

 

app sec
BIG-IP Access Policy Manager (APM)
security

4 Replies

  • What_Lies_Bene1's avatar
    What_Lies_Bene1
    Icon for Cirrostratus rankCirrostratus
    Nov 27, 2012
    Performance and how to measure it is always a bit of a contentious subject but I'd be interested to know how you are measuring this additional latency.

     

     

    Additionally, I'm sure performance is affected by;

     

    1) Load on the device possibly

     

    2) What features you are applying with the HTTP Profile

     

    3) What features you are NOT applying/using that might improve things

     

     

    For instance, the RTT won't change but far fewer packets will be exchanged with the client if you have compression enabled.
  • Mike_Maher's avatar
    Mike_Maher
    Icon for Nimbostratus rankNimbostratus
    Nov 27, 2012
    I am using ASM to protect over a dozen web applications/services and I have never seen this kind of performance hit to my application. Is there only one application you using ASM and HTTP profiles for? What advanced features of ASM are you using (Data Guard, Anomaly detection, Content Profiles)? Also what version are you running?
  • Manuel_Kuenzi_5's avatar
    Manuel_Kuenzi_5
    Icon for Nimbostratus rankNimbostratus
    Nov 30, 2012
    Hi Steve and Mike

     

     

    Thanks for your answers. We use a basic http Profile with X-Forwarded-For enabled and an simple ASM Rapid Deployment Profile. It is not the only ASM profile on that machine but there is not a lot of traffic other than that from the tests on the device.

     

     

    Thanks also for the tip with the Compression. I think this will probably be worth a try later. For the moment i will not turn it on because i'm not sure if this will not falsify the test results by putting the testing clients under a heavier load.

     

     

    Regards

     

    Manuel