UserGate Details FPGA Acceleration to Turbocharge Next-Generation Firewalls

UserGate has published a detailed technical overview of hardware acceleration techniques designed to maintain full next-generation firewall performance when multiple security functions are enabled.

Product manager Pavel Molodan compares a fully loaded NGFW to a sports car whose engine power is gradually consumed by accessories. Basic L4 filtering delivers high throughput, yet enabling stream antivirus, IDS/IPS, SSL/TLS inspection, application control, and content filtering quickly reduces effective bandwidth and increases latency.

The article identifies four acceleration categories: hardware methods (ASIC, FPGA, SmartNIC, SSL offload), software-architectural approaches (DPDK, eBPF), system-level scaling (clustering), and policy optimization. FPGA was selected for its reprogrammability, allowing updates for new protocols or attack signatures without replacing hardware.

Inside the FPGA a processing pipeline replaces sequential CPU handling. While one packet undergoes IDPS inspection, another can be decrypted and a third can have firewall rules applied in parallel. The first packet of a new session is still evaluated by the CPU; subsequent packets follow the hardware fast path once a flow rule is installed.

Two experimental platforms illustrate the results. The Katun-2 PCIe card adds 10 Gbit/s of IDPS capacity per module. On platform F, six cards raise throughput from 30 Gbit/s to 90 Gbit/s. The FG platform, sharing the same CPU as the D250 but equipped with a 500 000 LUT FPGA, achieves 85 Gbit/s firewall on EMIX traffic, 150 Gbit/s L4 UDP performance, and more than 90 000 connections per second.

Additional benefits include sub-microsecond latency for database replication and high-frequency trading, plus significantly lower power consumption: an FPGA handling 100 Gbit/s uses roughly 45 W versus 450 W for dual-CPU servers.