Cato Cloud Thresholds and Limits

This article provides a list of the main default thresholds, and limitations, for various features and capabilities available for use in the Cato Cloud.

These limits are designed to support the Cato best practices to ensure the reliability and performance of the service. If there is a requirement to increase a threshold or limit, please contact Cato Support to discuss further.

For more information about API limits, see Understanding Cato API Rate Limiting.

Data Thresholds and Limits

Events and Alerts Thresholds

Feature	Limit
Event	2,500,000 events/hour*
Alerts	50 alerts/hour (per alert sub-type)
Events CSV export	250,000 events per export
eventsFeed API	see Understanding Cato API Rate Limiting

*Dependent on DPA agreement:

For accounts operating under DPA 2021, the Event limit is 2,500,000 events/hour per event sub-type.
DPA 2023 includes a bundled Event limit of 2,500,000 events/hour which can be extended by licensing additional Data Units (each Data Unit provides 2,500,000 events/hour). For more information, see Guide to Cato Data Lake.

Event Discovery Search

The Event Discovery tool allows admins to search and analyze the account events for a maximum time frame of 3 months. The Usage Analytics tool for exploring and analyzing usage statistics supports a maximum time frame of 31 Days

Supported Encryption Algorithms Based on IPsec Site Bandwidth

For IPsec sites with bandwidth greater than 100Mbps, use only the AES 128 GCM-16 or AES 256 GCM-16 algorithms.

AES CBC algorithms are only used on sites with bandwidth less than 100Mbps.

Supported Throughput for Cato Sites

The Cato Cloud supports site throughput of up to 10Gbps for the X1700B Socket and Cloud Interconnect, which is immediately available in many PoP locations.

These are the details for the supported throughput of different site types:

Cloud Interconnect: Up to 10Gbps
Physical Sockets
- Socket X1500: Up to 500 Mbps
- Socket X1600/X1600 LTE: Up to 1 Gbps
- Socket X1700: Up to 3 Gbps
- Socket X1700B: Up to 10 Gbps
Virtual Sockets
- Azure:
  - 2 NIC - up to 1Gbps
  - 3 NIC with accelerated networking - up to 2Gbps
- Google Cloud Platform (GCP): Up to 2 Gbps
- Amazon (AWS) and VMware ESXi: Actual throughput will depend on various factors including the instance type, network configuration, and environmental conditions in the specific deployment
IPsec sites
- IPsec IKEv1 (Cato-initiated): Up to 3 Gbps
- IPsec IKEv2: Up to 3 Gbps

Transaction Processing Latency

Transaction processing latency measures the time from when the Cato Single Pass Cloud Engine (SPACE) receives network data packets for a transaction until the complete transaction is received by the client or host. This latency can be up to 10 milliseconds for both decrypted and non-decrypted transactions of up to 1MB of data.

Cato SDP Client

Supported Throughput for Cato SDP Clients

The throughput for Cato SDP Clients is influenced by various factors, such as the client's hardware, operating system, system resources and internet connectivity. The encryption and encapsulation between the SDP Client and the Cato Cloud may add an overhead of up to 20% of the throughput.
There are some Cato PoP locations where each client is limited to a maximum throughput. Specifically, clients in China and Vietnam are limited to 20Mbps.

Restrictions in China

The following functionality is not available for Cato PoPs located in China:

SDP Clientless Access
Remote port forwarding (RPF)
Off-Cloud traffic
Traffic Egress: Only available for business applications according to Chinese regulations

2 comments

Yaakov Simon
- February 12, 2025 10:23
Updated Supported Throughput for Cato Sites
Don P
- Edited April 10, 2025 22:11
How is this throughput calculated for Cato Sockets when doing the performance evaluation ? I'm little unclear on that.eg : Socket X1700B: Up to 10 Gbps . What are the features enabled when testing, and what is the packet size etc ? Would be great to add that info too.