SWG 13.0 E Model Appliance Sizing Guide

Sizing Assumptions

This sizing guide assumes the following conditions:

• The appliance operates at 60% of its maximum capacity.
• SSL (HTTPS) scanning is enabled for 80% of traffic.
• Anti-malware uses the Full Coverage configuration, which Skyhigh Security recommends.

Recommended Sizing Method

Skyhigh Security recommends using the following metrics for sizing, in order of priority:

1. Peak bandwidth for web traffic
2. Requests per second (RPS)

These workload-based metrics provide more accurate sizing because they reflect real-world traffic patterns and application processing requirements.

• Obtain peak bandwidth data from a firewall or router.
• Collect RPS data from an existing proxy deployment.

When sizing based on bandwidth, include only web-related traffic instead of the total external network bandwidth.

This method provides more reliable results because Web Gateway operates at Layer 7 and evaluates both:

• Network traffic processing (up to Layer 4)
• Application-level processing (Layer 7)

User-Based Sizing Considerations

User-based sizing can vary significantly across organizations. For example, an ecommerce company with 1,000 users may generate much higher traffic volume and request rates than a retail organization with the same number of users.

Although user-based sizing may not accurately represent actual workload requirements, you can use it as an initial estimate when bandwidth or RPS data is unavailable.

Architecture and Management

Skyhigh Security Web Gateway includes built-in Central Management and does not require dedicated standalone policy management servers.

The integrated management framework also supports:

• Anti-malware
• Data Loss Prevention (DLP)
• URL filtering

Virtual Appliance Sizing

If you want to size a virtual machine hosted on Hyper-V or VMWare ESX, you can size with VM-8 or VM-16 recommendations. As web filtering needs a reasonable amount of resources, the recommendations assume that there is no other guest than SWG. The performance of virtual appliances depends on the number of cores and CPU type of the host. If the CPU is slower than the Intel(R) Xeon(R) Gold 6426Y @ 2.50GHz, you need to increase the amount of guest systems. The size of memory and storage space listed in the table is the recommended minimum. For example, if you want to size a guest with 4 threads, simply divide the web capacity values of the system listed with VM-8 by two.

Important Considerations

• The sizing calculations assume that hyperthreading is enabled.
• Security features enabled within the proxy can significantly affect throughput and require proper evaluation during sizing.
• Features such as authentication, URL filtering, media type filtering, anti-malware scanning, and SSL decryption can reduce throughput by more than 10x.
• Connection capacity varies depending on:
  • Hardware platform
  • Web policy configuration
  • Traffic characteristics and workload complexity