Symantec Protection Engine for Cloud Services 7.9 Sizing Guide

Transcription

1 Symantec Protection Engine for Cloud Services 7.9 Sizing Guide

2 Symantec Protection Engine for Cloud Services Sizing Guide The software described in this book is furnished under a license agreement and may be used only in accordance with the terms of the agreement. Legal Notice Copyright 2017 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This Symantec product may contain third party software for which Symantec is required to provide attribution to the third party ( Third Party Programs ). Some of the Third Party Programs are available under open source or free software licenses. The License Agreement accompanying the Software does not alter any rights or obligations you may have under those open source or free software licenses. Please see the Third Party Legal Notice Appendix to this Documentation or TPIP ReadMe File accompanying this Symantec product for more information on the Third Party Programs. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. The Licensed Software and Documentation are deemed to be commercial computer software as defined in FAR and subject to restricted rights as defined in FAR Section "Commercial Computer Software - Restricted Rights" and DFARS , "Rights in Commercial Computer Software or Commercial Computer Software Documentation", as applicable, and any successor regulations. Any use, modification, reproduction release, performance, display or disclosure of the Licensed Software and Documentation by the U.S. Government shall be solely in accordance with the terms of this Agreement. Symantec Corporation350 Ellis StreetMountain View, CA

3 Technical Support Symantec Technical Support maintains support centers globally. Technical Support s primary role is to respond to specific queries about product features and functionality. The Technical Support group also creates content for our online Knowledge Base. The Technical Support group works collaboratively with the other functional areas within Symantec to answer your questions in a timely fashion. For example, the Technical Support group works with Product Engineering and Symantec Security Response to provide alerting services and virus definition updates. Symantec s support offerings include the following: A range of support options that give you the flexibility to select the right amount of service for any size organization Telephone and/or Web-based support that provides rapid response and up-to-the-minute information Upgrade assurance that delivers software upgrades Global support purchased on a regional business hours or 24 hours a day, 7 days a week basis Premium service offerings that include Account Management Services For information about Symantec s support offerings, you can visit our Web site at the following URL: All support services will be delivered in accordance with your support agreement and the thencurrent enterprise technical support policy. Contacting Technical Support Customers with a current support agreement may access Technical Support information at the following URL: Before contacting Technical Support, make sure you have satisfied the system requirements that are listed in your product documentation. Also, you should be at the computer on which the problem occurred, in case it is necessary to replicate the problem. When you contact Technical Support, please have the following information available: Product release level Hardware information Available memory, disk space, and NIC information Operating system Version and patch level Network topology Router, gateway, and IP address information Problem description Error messages and log files Troubleshooting that was performed before contacting Symantec

4 Recent software configuration changes and network changes Licensing and registration If your Symantec product requires registration or a license key, access our technical support Web page at the following URL: Customer service Customer service information is available at the following URL: Customer Service is available to assist with non-technical questions, such as the following types of issues: Questions regarding product licensing or serialization Product registration updates, such as address or name changes General product information (features, language availability, local dealers) Latest information about product updates and upgrades Information about upgrade assurance and support contracts Information about the Symantec Buying Programs Advice about Symantec's technical support options Nontechnical presales questions Issues that are related to CD-ROMs, DVDs, or manuals Support agreement resources If you want to contact Symantec regarding an existing support agreement, please contact the support agreement administration team for your region as follows: Asia-Pacific and Japan Europe, Middle-East, and Africa North America and Latin America customercare_apac@symantec.com semea@symantec.com supportsolutions@symantec.com

5 Contents Introducing Symantec Protection Engine for Cloud Services... 6 About Symantec Protection Engine... 6 Symantec Protection Engine integration over ICAP... 8 Popular Integration Scenarios... 8 Sizing Overview About sizing Performance Test Environment Test considerations Test data details Performance Data and Comparison Performance Tests Performance Test Results Red Hat Linux Server Test: Varying the MaxThreads parameter Microsoft Windows Server Test: Varying the MaxThreads parameter Sizing Calculation Performance Guidelines Performance Guidelines Symantec Protection Engine Documentation... 26

6 Chapter 1 Introducing Symantec Protection Engine for Cloud Services This chapter includes the following topics: About Symantec Protection Engine Symantec Protection Engine integration over ICAP About Symantec Protection Engine Symantec Protection Engine, formerly known as Symantec Scan Engine is a carrier class threat protection engine for mission critical servers. Symantec Protection Engine is a TCP/IP protocolbased scan server that provides programming interface to give content scanning capabilities to any application on an IP network over supported protocols. Symantec Protection Engine integrates industry-leading antivirus as well as proprietary and patented URL filtering technology. It provides fast, scalable, and reliable content scanning services to help organizations protect against viral and non-viral threats. Symantec Protection Engine includes the following features: Protection against the latest security threats o LiveUpdate provides the latest antivirus definitions. Seamless integration with various application infrastructures o o The engine supports industry standard integration protocols like ICAP and RPC. For custom integrations, SDKs are available in C, Java and.net which internally use ICAP. Insight and APK Reputation

7 URL filtering URL Reputation Supported on Microsoft Windows and Linux Symantec Protection Engine accepts scan requests from client applications that use the following protocols: The Internet Content Adaptation Protocol (ICAP), version 1.0, as presented in RFC 3507 (April 2003) A proprietary implementation using remote procedure call (RPC) Figure 1-1 Symantec Protection Engine integration For detailed information about Symantec Protection Engine, please refer Symantec Protection Engine Getting Started Guide and Symantec Protection Engine Implementation Guide.

8 Symantec Protection Engine integration over ICAP Symantec Protection Engine for Cloud Services provides virus scanning and repair capabilities using ICAP. Any application on an IP network can use ICAP to communicate with Symantec Protection Engine to request the scanning of files. Popular Integration Scenarios Proxy Integration Messaging

9 Other custom integrations Symantec Protection Engine offers an industry standard integration through ICAP, thus any type of application like web server, line of business, custom etc. can avail its protection services. These integrating custom applications will have ICAP client or use any one of the Symantec Protection Engine SDKs. For more information on Symantec Protection Engine SDK s please refer Symantec Protection Engine Software Developer s Guide

10 Chapter 2 Sizing Overview This chapter includes the following topics: About sizing About sizing Customers face the following challenges when planning deployments of Symantec Protection Engine: Estimating the number of Symantec Protection Engines to handle the current data load Planning for future growth requirements For calculating sizing estimates one should consider the following factors: Data access - Customers need to know the amount of data that users access per day or the rate at which the scanning request generated by users. Factors like caching and filtering also play a role since an integrating application may support these features. Caching - File/URL is already scanned and if no changes to the file have occurred then file can be skipped from sending to Symantec Protection Engine. However with every definition updates, the file cache should be flushed so that all the files/urls are scanned with new definitions. Caching will influence the number of scanning request made to Symantec Protection Engine. Filtering o An administrator might set up a list of file types to be scanned or skipped. Customers might want to set up file exclusion lists for some file types that do not require scanning or if the engine does not support scans of certain file types. File exclusion may be required where customers are confident of certain file types or if certain file types are not supported by Symantec Protection Engine File exclusion lists are recommended to reduce unnecessary network traffic to the engine and potentially increase network performance and throughput.

11 o For the type of URLs related to categories like shopping, drugs etc., an administrator can select the required URL categories to block such URLs. Symantec Protection Engine throughput - The engine throughput varies depending on the environment. You should consider the following factors: operating system, hardware specifications (CPU Speed, RAM and disk space), network speed, and the Symantec Protection Engine configuration. Figure 2-1 ICAP deployment For example, in a Symantec Protection Engine - Proxy server integration as shown in the diagram, the flow of data is described as below: 1. End users will request data from network which is routed through some proxy server. 2. Proxy server will apply caching and filtering as per the configured policies. 3. After applying caching and filtering on requested data, connector will send certain data load to Symantec Protection Engine for scanning. The next section gives baseline performance statistics for Symantec Protection Engine with a sample configuration. Customer can use this data to extrapolate to their own environment and plan the sizing. For this sizing exercise performance tests were conducted on Symantec Protection Engine 7.9 integrated over ICAP protocol.

12 Chapter 3 Performance Test Environment This chapter includes the following topics: Test considerations Test data details Test considerations The Symantec Protection Engine server is configured to serve requests on ICAP. Symantec Protection Engine parameters MaxThreads was modified during test. All other parameters were kept constant. For more details on how to configure ICAP protocol and modify different configuration options of Symantec Protection Engine, please refer Symantec Protection Engine Implementation Guide Insight and APK Reputation feature is enabled. URL Filtering and URL Reputation feature is disabled. Live Update is disabled after updating virus definitions In house developed multi-threaded utility used from client computer to generate an ICAP load on Symantec Protection Engine. This simulates multiple simultaneous requests are sent to Protection Engine from ICAP connector. Each test was conducted for duration of two hours and the required statistical data gathered every minute. The documented values are an average of 120 readings.

13 All tests are conducted in a gigabit network environment. Figure 3-1 Network diagram Hardware details lists the hardware details. Table 3-1 Hardware details Specification Windows Linux Operating System Windows Server 2012 R2 Enterprise Red Hat Enterprise Linux Server release 5.5 Make Dell Dell Model R710 R710 Physical CPU Dual Proc Quad Core Xeon E5620 Dual Proc Quad Core Xeon E5620 CPU Speed 2.40 GHz 2.40 GHz Socket 2 2 Cores 4 4 Threads 2 2 Virtual CPU (logical with Hyper Threading in case of Intel CPU) System RAM installed 36 GB 36 GB RAM Type DDR3 DDR3

14 Disk One 3.5" SAS 300 GB, 15K RPM One 3.5" SAS 300 GB, 15K RPM Network Interface Card (connected) 1 Gbps 1 Gbps MTU Operating System Configuration Reduce the socket close time so that sockets will be available more quickly to cater new requests. Microsoft Windows 1. Start Registry Editor. 2. Locate the following key in the registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters 3. Add new DWORD value for the above key as TcpTimedWaitDelay and set its value to decimal This will set socket close time to 30 seconds. RHEL and its clone Update below configuration in /etc/sysctl.conf net.ipv4.tcp_fin_timeout = 15 net.ipv4.tcp_tw_recycle = 1 net.ipv4.tcp_synack_retries = 5 net.ipv4.tcp_syncookies = 1 net.ipv4.tcp_max_syn_backlog = 8192

15 Test data details The test data used in this sizing exercise was selected by considering a typical integration use case over ICAP in an enterprise environment. File Types lists the file types that were used for this sizing exercise. Table 3-2 File Types File types Microsoft Office 2003 Microsoft Office 2007/2010 Archive Internet files Open Office Adobe Acrobat Text Binary Image Files Mobile Platforms Extensions doc, xls, ppt docx, xlsx, pptx zip, rar,7z, zipx, tar html odt, odp, ods pdf txt, rtf exe, msi, dll jpg, png apk File Size Range lists the size ranges that were used for this sizing exercise. Table 3-3 File Size Range Files Up to 10 MB Files Up to 100 MB Up to 1 MB 1 MB to 3 MB 3 MB to 5 MB 5 MB to 10 MB 10 MB to 25 MB 25 MB to 50 MB 50 MB to 100 MB doc docx xls xlsx ppt pptx zip zipx rar tar z html odt odp ods

16 pdf txt rtf exe msi dll jpg png apk Total Files Size 41 MB 164 MB 346 MB 319 MB 1.03 GB 1.68 GB 1.75 GB Total Files of each category Total Size of Dataset 871 MB 4.47 GB Infected files in each category 7 (~2%) 2(~2%)

17 File Distribution 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% doc docx xls xlsx ppt pptx zip zipx rar tar 7z html odt odp ods pdf txt rtf exe msi dll jpg png APK upto 1 MB 1 MB to 3 MB 3 MB to 5 MB 5 MB to 10 MB 10 MB to 25 MB 25 MB to 50 MB 50 MB to 100 MB A two percent infection ratio was considered with the following types of viruses: Non-repairable eicar, Annarep, Macro threats in Microsoft Office files

18 Chapter 4 Performance Data and Comparison This chapter includes the following topics: Performance Test Performance Test Results Performance Tests Customers can use the test results given in this chapter to help determine engine throughput in their own networks. The performance tests were conducted on different Symantec Protection Engine configurations as well as on different server hardware specifications. Tests conducted by varying MaxThreads (Number of maximum threads available for scanning) parameter of Symantec Protection Engine. For more details on how to modify different configurations options of Symantec Protection Engine, please refer Symantec Protection Engine Implementation Guide Also tests were executed with two different datasets: 1. Dataset containing files up to 10 MB 2. Dataset containing files up to 100 MB (inclusive of up to 10 MB files also) The following parameters were measured: System CPU utilization (Total CPU percentage) Physical memory consumption by Symantec Protection Engine process (Resident Memory in MB). In Microsoft Windows operating system it is termed as Working Set. Virtual memory consumption by Symantec Protection Engine process (Virtual Memory in MB) Number of files scanned per second Symantec Protection Engine throughput (MBps) Similar tests were executed on Red Hat Linux and Microsoft Windows platforms.

19 Performance Test Results The results of different tests conducted are as below: Red Hat Linux Server Test: Varying the MaxThreads parameter Tests were conducted by changing value of MaxThreads parameter used by Symantec Protection Engine. In this test two other parameters of Symantec Protection Engine were configured as below InMemoryFilesystemSize = 2048 MB MaxInMemoryFileSize = 256 MB The following table summarize the test results for 10 MB Dataset: Table 4-1 MaxThreads parameter Symantec Protection Engine performance on Linux server for 10 MB Dataset Total CPU percentage Resident memory (MB) Virtual memory (MB) Files Scanned Per Second Symantec Protection Engine throughput (MBps)

20 FIles Scanned/Sec Data Scanned (MB/s) The following table summarize the test results for 100 MB Dataset: Table 4-2 Symantec Protection Engine performance on Linux server for 100 MB Dataset MaxThreads parameter Total CPU percentage Resident memory (MB) Virtual memory (MB) Files Scanned Per Second Symantec Protection Engine throughput (MBps) The following chart summarize the test results for 10 MB and 100 MB Dataset: Figure 4-5 Results for 10 MB & 100 MB Dataset MaxThreads 20 0 Files Scanned Per Sec for 10 MB Dataset MBs Scanned Per Sec for 10 MB Dataset Files Scanned Per Sec for 100 MB Dataset MBs Scanned Per Sec for 100 MB Dataset

21 Microsoft Windows Server Test: Varying the MaxThreads parameter Tests were conducted by changing value of MaxThreads parameter used by Symantec Protection Engine. In this test two other parameters of Symantec Protection Engine were configured as below: InMemoryFilesystemSize = 2048 MB MaxInMemoryFileSize = 256 MB The following table summarize the test results for 10 MB Dataset: Table 4-4 Symantec Protection Engine performance on Microsoft Windows server for 10 MB Dataset MaxThreads parameter Total CPU percentage Resident memory (MB) Virtual memory (MB) Files Scanned Per Sec Symantec Protection Engine throughput (MBps) The following table summarize the test results for 100 MB Dataset: Table 4-5 MaxThreads parameter Total CPU percentag e Symantec Protection Engine performance on Microsoft Windows server for 100 MB Dataset Resident memory (MB) Virtual memory (MB) Files Scanned Per Sec Symantec Protection Engine throughput (MBps)

22 FIles Scanned/Sec Data Scanned (MB/s) Figure 4-17 Results for 10 MB & 100 MN Dataset MaxThreads Files Scanned Per Sec for 10 MB Dataset MBs Scanned Per Sec for 10 MB Dataset Files Scanned Per Sec for 100 MB Dataset MBs Scanned Per Sec for 100 MB Dataset

23 Sizing Calculation This chapter includes the following topics: Sizing Calculation Chapter 5 Sizing Calculation To calculate the required number of Symantec Protection Engines, use the steps listed in the table below: Table 5-1 Sizing calculation Step Step 1: Determine the number of URL scanning request made to Symantec Protection Engine Step 2: Determine the Symantec Protection Engine throughput Description Obtain the peak number for URL Scanning requests made from the ICAP connector to Symantec Protection Engine. This can be dependent upon the following: User population Peak number of simultaneous users Average data access by each user Caching percentage on the ICAP connector. URLs already scanned will not be sent to Symantec Protection Engine until cache is cleared. This information helps you to determine the value of the URL scanning request from the ICAP connector to Symantec Protection Engine on a per second basis. Obtain the Symantec Protection Engine throughput values for the relevant hardware and Symantec Protection Engine configurations. You need to know the network and hardware setup of the deployment and the desired Symantec Protection Engine configurations. Use the given performance data details to estimate the throughput. See "Test considerations" See "Performance tests

24 Step 3: Sizing calculation You can use the following formula to calculate the sizing: Number of Symantec Protection Engines required = Total data flow from ICAP connector to Symantec Protection Engine / Symantec Protection Engine throughput An example to calculate the required number of Symantec Protection Engines is given below: Step 1 Let s assume a scenario where the peak user population requests data at the rate of 400 MBps and file accessed will be up to 100 MB. At the same time, some files are accessed by multiple users, so caching is a consideration. Also some file types are filtered. We can assume 15% caching and 5% filtering. With this assumption 80% of the accessed data will be sent to Symantec Protection Engine for scanning. The estimated data rate is 320 MBps (400 * 0.8). Step 2 Assume that Symantec Protection Engine is installed on Microsoft Windows server and configured with the following parameters: o o InMemoryFilesystemSize = 16 MB MaxInMemoryFileSize = 3 MB o MaxThreads = 64 According to Performance Test Results table the Symantec Protection Engine throughput is MBs per second for above configuration. Step 3 To calculate the required number of Symantec Protection Engines, divide the data load by the throughput (320/104.13). In this example, the estimated number of required Symantec Protection Engines is approximately 3. These numbers may vary depending on your environment.

25 Chapter 6 Performance Guidelines This chapter includes the following topics: Performance Guidelines Performance Guidelines You can use the following guidelines when you plan and estimate sizing for a Symantec Protection Engine deployment: Network connectivity - A Gigabit (1 Gbps) Ethernet network is recommended between the ICAP connector and Symantec Protection Engine. The gigabit network lowers network latency and optimizes data transfer to the Symantec Protection Engine. Socket Close Time Reduce the socket close time so that sockets will be available more quickly to cater new requests. Microsoft Windows: o Start Registry Editor. o Locate the following key in the registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters 3. Add new DWORD value for the above key as TcpTimedWaitDelay and set its value to decimal This will set socket close time to 30 seconds. RHEL and its clone: Updated below configuration in /etc/sysctl.conf net.ipv4.tcp_fin_timeout = 15 net.ipv4.tcp_tw_recycle = 1 net.ipv4.tcp_synack_retries = 5 net.ipv4.tcp_syncookies = 1 net.ipv4.tcp_max_syn_backlog = 8192

26 Appendix Symantec Protection Engine Documentation For more information on Symantec Protection Engine refer the following links: Symantec Protection Engine Product Page Symantec Protection Engine Release Notes Symantec Protection Engine Getting Started Guide Symantec Protection Engine Implementation Guide Symantec Protection Engine for Cloud Services C SDK Guide Symantec Protection Engine for Cloud Services SDK Guide Symantec Protection Engine Platform Support Matrix Symantec Protection Engine Platform Support Virtualization Matrix Symantec Protection Engine Platform Support Matrix for SDK