Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

(Note: I went through the related questions list and couldn't find one that answers this situation.)

I'm running into an issue whose cause is difficult to spot but is easy to describe: if Windows Firewall and some related services (Windows Firewall, IKE, IPSec Policyagent, Base Filtering Engine) are stopped, then IIS performance doubles (from aprox. 650 to 1300 RPS).

Needless to say, stopping Windows Firewall is not an option.

Repro scenario is plain simple: just create an IIS web site and serve a single image i.e. http://server:9876/image.png. While CPU stays low with and without firewall enabled, CPU Privileged Time % increases in comparison with User Time %.

Has someone seen this before? Are we missing a configuration setting or else?

Environment is Windows Server Enterprise 2008 SP2, II7. Thanks.

share|improve this question

migrated from stackoverflow.com Dec 17 '09 at 17:26

This question came from our site for professional and enthusiast programmers.

    
Why is stopping the Windows Firewall not an option? –  Jeffrey Hines Dec 17 '09 at 16:53
    
Wow, server asked to do twice the work is only half as fast shock! If you really need the performance move your firewalling off the box. –  Chopper3 Dec 17 '09 at 17:41

5 Answers 5

Of course the Windows Firewall will degrade performance.

It has to inspect all packets in and out of the server.

That takes CPU.

If you need to increase performance on the server, then you will have to turn off the Windows Firewall and install a hardware firewall instead.

share|improve this answer
    
I understand that, but still, 50% performance degradation sounds a lot, and without CPU going more than say 20%... Thanks. –  Ariel Dec 17 '09 at 17:00
    
Deep packet inspection is not cheap. –  Jeffrey Hines Dec 17 '09 at 17:04
    
Plus the time to inspect the entire packet of you image may be substantially higher that the time necessary to simply serve it up with the Windows Firewall off. The real question is... How much overhead does the Windows Firewall have when the server is under real load and executing real web pages? –  Jeffrey Hines Dec 17 '09 at 17:06
    
@Jeffrey Does Windows Firewall do DPI? Netfilter on Linux and pf on *BSD can do quite a bit of packet inspection and mangling without a 50% performance drop. I'd expect Windows Firewall to have similar characteristics. –  Gerald Combs Dec 18 '09 at 17:53

Might I ask why stopping Windows Firewall is not an option? If you're running IIS from a computer within your organization, I would argue that it would be better to have a hardware firewall setup in front of your network, rather than relying on a software firewall such as Windows. Even if this is a personal machine, I wouldn't connect a computer directly to a network without some sort of hardware firewall up in the first place.

share|improve this answer

If you don't do anything specific only to the Windows Firewall, you might try an alternative firewall, maybe it'll do better. I'm writing this with wipfw in mind.

share|improve this answer

Is Windows Firewall is interfering with TCP offloading? KB 951037 says it may or may not depending on your implementation.

share|improve this answer

I wonder if it is because you are using a non-standard port 9876 for HTTP traffic. Have you tried on IIS' default HTTP port 80? Does that yield the same results?

If that's the same result, then I doubt there's much you can do, apart from turning Windows Firewall off.

Software firewalls do carry overhead.

share|improve this answer
    
Actually issue got detected on 80, so port is not the problem. Thanks anyway. –  Ariel Dec 17 '09 at 16:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.