Hi Wise,
I understand your confusion caused by cisco marketing foo. To start of with your first question surounding this statement:
1)
"From preliminary testing, we’re seeing minimal impact on large packet firewall throughput when enabling intrusion inspection, SSL decryption, and other functions. In fact, with IPS fully enabled, we see with large packets less than 1% throughput degradation to network traffic. Contrast that with the typical 50% or greater impact in competing designs"
This is marketing at its best. I am not sure how the person who wrote this defines *minimal impact* but I think is wrong. Sizing firepower solutions is still the same its just that they were conservative on the minimal throughput of the solution without avc & ips.
SSL Decryption will still cause a 80% performance hit since the crypto chips are not used yet and AMP will still cause a 30-50% performance hit.
2)
Smaller packets will always cause less firewall throughput. As a general rule of thumb 440/450 byte is a good representation of real world traffic. Keep in mind that throughput reduction is not linear, if you want to know how many percent performance degradation you can expect take a look at NSS Labs NGFW report which tests firewalls using 64,128,256,512,1024,1512 byte sized packets.
For IPS appliances 440 bytes are commonly used to measure performance, for classic firewalls 1024/1500 byte packets are mostly used. Since NGFW fit in both spaces the packet size used for performance numbers will be listed with higher packet size (e.g. 1024) to paint an accurate comparison to other vendors which also use 1024 byte sized packets for testing.
3)
The transaction size is the amount of data transfered during a single http session used for performance testing. From my understanding this value alone doesnt have much significance without knowing the packet size.
