In reply to Arthur Chilipweli.

Hi Arthur,
You are right that the sigs ship disabled to avoid performance impact. The first sigs we released could have a performance impact on an IPS but we wanted to provide coverage and suggested to only apply them to interesting traffic and calibrate to the environment's needs. Since update S789, sigs 4187/3 and 4187/4 should be used. These signatures have been calibrated to only look in limited parts of the packet for better performance. Our performance tests showed that there is no significant performance change when having these sigs enabled compared to older signature packages for various traffic patterns tested.

Having said that, someone should have in mind that performance cannot be accounted for everyone's environment. Depending on traffic profiles, enabled sigs and applications, IPS performance could change. Our tests are reference to show how the sigs affect the appliance, compared to previous tests, but we would suggest to everyone to monitor the load after applying the changes.

I hope it helps.