Sizing Guide for ProxySG Deployments
WAN Optimization
SGOS Version 6.2
23 May 2011
Deployment Mode
Model
WAN Optimization
and 'Mixed Use' see notes
Recommended
Max WAN
Max
Bandwidth
Connections
Hardware Spec
Licensing
Client Manager
for ProxyClient
Licensed Client
IPs
Storage
Recommended Max
ProxyClients
Managed
With ADN Enabled ◊
Drives Total Storage (GB)
CPU
Cores
Memory
2Mbps
2Mbps
6Mbps
500
500
1000
800
800
2000
10
150
No limit
1
1
1
250
250
250
1
1
1
2GB
2GB
4GB
600-10
600-20
600-35
6Mbps
12Mbps
25Mbps
1000
2000
4000
2000
3000
4000
500
1000
No limit
1
2
2
250
500
500
1
1
1
4GB
4GB
4GB
900-10
900-20
900-30
900-45
45Mbps
90Mbps
155Mbps
200Mbps
6000
9000
15,000
20,000
8000
10,000
3500
6000
No limit
No limit
2
2
3
4
1000
2000
3000
4000
2
2
2
4
9000-10 155Mbps
9000-20 310Mbps
9000-30 622Mbps
9000-40 1000Mbps
12,000
24,000
60,000
100,000
No limit
No limit
No limit
No limit
8
10
10
15
4000
5000
10,000
15,000
2
4
8
12
nections is likely to be reached before this limit
These guidelines show the relative power of SG appliances. Appropriate configurations
can vary significantly from these guidelines and will depend on technical requirements.
WAN Optimization
Use this guide when a ProxySG is being used for WAN optimization with or without other
functionality like forward proxy. Both SGOS Acceleration Edition and SGOS Proxy Edition can
be used for WAN optimization. Special rules apply for sizing units running ‘Mixed Use’ loads both WAN optimization and forward proxy. See Example 2.
Max WAN Bandwidth
Maximum WAN link speed appropriate for this model. Using a ProxySG on a WAN link that
exceeds its maximum WAN link speed can result in suboptimal performance.
Recommended Max Connections
The recommended maximum number of connections. A rule of thumb is that each active user
will require ten connections.
Clustering
Clusters of up to 20 ProxySGs can be created to handle substantially more traffic and users.
On-board Network
Bypass
300-5
300-10
300-25
◊ Except for the 300-5, Recommended Max Con-
Preinstalled Cards and
Available Slots
Power
Supply
Other
2 x 1000BT 1 x 1000BT
2 x 1000BT 1 x 1000BT
2 x 1000BT 1 x 1000BT
Single
Single
Single
1 open slot
1 open slot
1 open slot
2 x 1000BT 1 x 1000BT
2 x 1000BT 1 x 1000BT
2 x 1000BT 1 x 1000BT
Single
Single
Single
6GB
8GB
12GB
16GB
2 open slots
2 open slots
2 open slots
2 open slots
2 x 1000BT
2 x 1000BT
2 x 1000BT
2 x 1000BT
8GB
16GB
40GB
64GB
SSL, 3 open slots
SSL, 3 open slots
SSL, 3 open slots
4 x 1000BT
4 x 1000BT
4 x 1000BT
4 x 1000BT
SSL, Compression, 2 open slots
Note: Hardware SSL support
is included on all models
2 x 1000BT
2 x 1000BT
2 x 1000BT
2 x 1000BT
‡
Single
‡
Single
Redundant
Redundant
Redundant
Redundant
Redundant
Redundant
‡ Redundancy
optional
Client Manager for Proxy Client
Assumes a dedicated ProxySG appliance at 45% peak CPU load for servicing ProxyClients.
Use of a dedicated ProxySG is recommended as a best practice. Always use SGOS Proxy
Edition for any ProxyClient deployments requiring remote filtering. SGOS Acceleration Edition
is sufficient for acceleration-only ProxyClient deployments.
Recommended Max ProxyClients Managed
Maximum number of ProxyClient instances connecting to a Client Manager, regardless of the
features enabled on the ProxyClient (filtering, acceleration or both).
Licensing
ProxySGs are licensed based on concurrent client IP addresses only. Other values such as
Max WAN Bandwidth and Recommended Max Connections are suggested based on the
physical capacity of the system.
Licensed Client IPs
Licensed users are measured by the number of unique client IP addresses with open inbound
TCP connections to the ProxySG. The measurement is instantaneous and concurrent. It is not
based on the average over any time interval. The administrator can configure the appliance to
either bypass connections from new users when the license limit is exceeded, to delay them
Copyright © 2011 Blue Coat Systems, Inc. All rights reserved worldwide. No part of this document may be reproduced by any means nor translated to any electronic medium without the written consent of Blue Coat Systems, Inc.
Specifications are subject to change without notice. Information contained in this document is believed to be accurate and reliable, however, Blue Coat Systems, Inc. assumes no responsibility for its use, Blue Coat is a registered
trademark of Blue Coat Systems, Inc. in the U.S. and worldwide. All other trademarks mentioned in this document are the property of their respective owners.
Page 1 of 3
until another client drops all of its connections or to attempt to accept them. The default is to
accept them.
For WAN Optimization deployments, Blue Coat recommends purchasing a ProxySG model
based on the maximum number of client connections it needs to support, not the maximum
number of users, since limits associated with connections are likely to be reached first. This
does not apply to the 310-5, however.
Hardware Spec
Hardware-based SSL acceleration is included for all models. A separate license is not
required to activate SSL termination. Ports on bypass-capable network interfaces can be
configured to be bridged pairwise or to act independently.
EXAMPLE 1: WAN Optimization Only
•
•
•
10 smaller branches with dual T1 lines (1.5Mbps each), each with less than 50 users
2 large branches, one with 150 users, the other with 200 users, with dual 6Mbps WAN
links
1 data center with a single DS3 link (45Mbps)
Deployment Mode
Model
WAN Optimization
Licensing
and 'Mixed Use' see notes
Client Manager
for ProxyClient
Licensed Client IPs
Max WAN
Bandwidth
Recommended
Max
Connections
Recommended Max
ProxyClients
Managed
With ADN Enabled ◊
300-5
300-10
300-25
2Mbps
2Mbps
6Mbps
500
500
1000
800
800
2000
10
150
No limit
600-10
600-20
600-35
6Mbps
12Mbps
25Mbps
1000
2000
4000
2000
3000
4000
500
1000
No limit
900-10
900-20
900-30
900-45
45Mbps
90Mbps
155Mbps
200Mbps
6000
9000
15,000
20,000
8000
10,000
3500
6000
No limit
No limit
9000-10 155Mbps
9000-20 310Mbps
9000-30 622Mbps
9000-40 1000Mbps
12,000
24,000
60,000
100,000
No limit
No limit
No limit
No limit
the SG300-25-M5 or the SG300-25-PR would be appropriate. Unless price is critical, Proxy
Edition (-PR) should be quoted for branch offices. Proxy Edition should always be quoted
when the branch users have direct internet access.
For the two larger branch offices, the maximum WAN bandwidth is 12Mbps (dual 6Mbps
links). The appropriate solution for these larger branch offices is SG600-20-M5 or SG60020-PR, which will accommodate up to 200 users at a connection to user ratio of 10-to-1. If
room for growth is desired, a SG600-35 should be quoted.
In general, the number of total connections needed at the data center can be calculated as
the sum of connections from all of the connected branch offices. In this case: (10 x 500) +
1500 + 2000 = 8500 connections. The data center in this example is connected via a
45Mbps link, which implies that the SG900-20-M5 model should be used (MACH5 editions
should always be quoted at the data center for pure WAN Optimization deals). Customers
will typically require redundancy for their data center, which means that two SG900-20-M5
models should be quoted. While the SG900-20-M5 is adequate for current performance
needs, if room for growth is required, quote an SG900-30-M5 as the data center
concentrator.
Therefore, the quote would include:
10 x SG300-25-PR (if price is a critical factor, quote 10 x SG300-25-M5 instead);
2 x SG600-20-PR (if price is a critical factor, quote 2 x SG600-20-M5 instead); and
2 x SG900-20-M5
NOTE: Include the appropriate support options for all models. Include the appropriate web
filtering licenses for Proxy Edition appliances that require web filtering. There is no need to
purchase software SSL licenses; they are now available at no charge on all 300, 600, 900
and 9000 models, no matter when they were purchased.
Example WAN Optimization Deployment Scenario - Application Acceleration
Each of the smaller branch offices requires 3 Mbps throughput (dual 1.5 Mbps links) and each
has fewer than 50 concurrent users. Applying the rule of thumb that each user needs 10
connections, the appliance should be able to optimize 500 connections. In this case, either
Copyright © 2011 Blue Coat Systems, Inc. All rights reserved worldwide. No part of this document may be reproduced by any means nor translated to any electronic medium without the written consent of Blue Coat
Systems, Inc. Specifications are subject to change without notice. Information contained in this document is believed to be accurate and reliable, however, Blue Coat Systems, Inc. assumes no responsibility for its use,
Blue Coat is a registered trademark of Blue Coat Systems, Inc. in the U.S. and worldwide. All other trademarks mentioned in this document are the property of their respective owners.
Page 2 of 3
EXAMPLE 2: ‘Mixed Use’ Branch Appliance
•
•
•
•
•
•
The branch has 200 active employees, all with Internet access
5 Mbps link to the WAN optimization concentrator
10 Mbps link to an ISP for direct-to-net access
Requires room for growth (+40%)
No ICAP, SSL or filtering
70% CPU utilization
This appliance is to be configured with both Secure Web Gateway forward proxy and WAN
optimization functions enabled. For this situation, use the following sizing guidelines:
Calculate the user count: Determine the concurrent user count for all traffic.
Determine the number of connections required for WAN optimization. A rule of thumb is
to multiply the number of concurrent users by 10.
Calculate the bandwidth: Add the WAN and ISP bandwidth (not offered load) and
compare that number to the WAN sizing guidelines. If using Blue Coat Web Filter, take
75% of the bandwidth in the sizing guide. If using another filtering product, take 50%, or
ask a sizing expert for assistance.
Use the more restrictive factor (bandwidth or user count) to determine the correct
appliance, remembering to allow room for application growth and for new functions
(ICAP, increased SSL load) that are expected in the future.
Only Proxy Edition models (-PR) should be considered because a secure web gateway
is required.
Analysis:
•
User count: 280 (200 concurrent users plus 40% growth)
•
Connections required: 2800 (280 users x 10 connections each)
•
Bandwidth: 21 (15 Mbps plus 40% growth)
From the WAN Optimization Sizing Guide:
•
Max WAN
Bandwidth
Recommended
Max
Connections
Recommended Max
ProxyClients
Managed
600-20
600-35
12Mbps
25Mbps
2000
4000
3000
4000
900-10
45Mbps
6000
8000
Now consider the same case, but with one difference: the customer will also use Blue Coat
Web Filter.
Analysis:
•
User count: 280 (200 concurrent users plus 40% growth)
•
Connections required: 2800 (280 users x 10 connections each)
•
Bandwidth: 21 (15 Mbps plus 40% growth)
•
Since Blue Coat Web Filter is being used, adjust the WAN optimization bandwidth
down by 25%:
Adjusting the WAN Optimization Sizing Guide:
Recommended
Max
Max WAN Bandwidth Connections
•
Recommended Max
ProxyClients
Managed
600-20
600-35
12Mbps 9.0Mbps
25Mbps 18.8Mbps
2000
4000
3000
4000
900-10
45Mbps 33.8Mbps
6000
8000
Choose the unit that supports the most restrictive factor: In this case, the SG600-35
does not offer the 21 Mbps required, so the SG900-10-PR is the correct choice.
NOTE: If web filtering is required at the branch offices, the appropriate web filtering
licenses and service offerings should also be included in the quote. There is no need to
purchase software SSL licenses; software SSL is now licensed on all 300, 600, 900 and
9000 models, no matter when they were purchased. Finally, consider adding an additional
power supply to the quote to take advantage of the redundant power option available on
the SG900-10 and -20.
Choose the unit that supports the most restrictive factor. In this, case that is the SG60035-PR since it meets both the 2800 connection requirement and the 21 Mbps bandwidth
requirement.
Copyright © 2011 Blue Coat Systems, Inc. All rights reserved worldwide. No part of this document may be reproduced by any means nor translated to any electronic medium without the written consent of Blue Coat
Systems, Inc. Specifications are subject to change without notice. Information contained in this document is believed to be accurate and reliable, however, Blue Coat Systems, Inc. assumes no responsibility for its use,
Blue Coat is a registered trademark of Blue Coat Systems, Inc. in the U.S. and worldwide. All other trademarks mentioned in this document are the property of their respective owners.
Page 3 of 3