Ideco NGFW

Ideco NGFW Novum v23 Adds Shadow AI Discovery, Dynamic Routing and QoS Controls

Ideco has released NGFW Novum v23, introducing detection for 83 AI application protocols including ChatGPT, Claude, DeepSeek, GigaChat and YandexGPT. The update enables organizations to identify Shadow AI usage across networks without mandatory TLS decryption and adds new content-filter categories for AI agents and AI services. Enterprise routing capabilities have been expanded with Prefix lists, Route maps, OSPF zones, BGP aggregation and BFD profiles to support large distributed environments. Additional features include internal Virtual Ethernet and Virtual Switch interfaces for VCE connectivity, QoS traffic prioritization, MTU/MSS tuning for IPsec, certificate-based authentication in Ideco Client and detection of tunneled traffic inside SSH and TLS sessions. The release positions the NGFW as the first layer of an emerging AI Security Layer that combines discovery, policy enforcement and future LLM proxy controls.

How Ideco Measures NGFW Performance Using TRex ASTF and RFC 9411 Methodology

Ideco engineers have published a detailed methodology for benchmarking the performance of their Ideco NGFW Novum product on the Ideco EX hardware platform. The team uses TRex in Advanced Stateful mode to generate realistic L4-L7 traffic and follows RFC 9411 guidelines to ensure reproducible results across different test environments. Key metrics include throughput on UDP 1518-byte frames reaching 200 Gbit/s, TCP/HTTP performance varying from 100 Gbit/s down to 62 Gbit/s depending on object size, and EMIX mixed traffic dropping from 92 Gbit/s with firewall only to 15.5 Gbit/s when all inspection engines are enabled. The methodology incorporates binary search for maximum load, a 1% session drop threshold, and 300-second hold times per test point to capture real-world behavior rather than short-term peaks. All tests were performed without TLS decryption, with separate plans for hardware-based Keysight BreakingPoint testing when decryption is required. The full article includes hardware specifications, traffic profiles, loss calculation formulas, and configuration details to allow anyone to reproduce the measurements.