Supported SR-IOV for Palo Alto in WS

MarnieFellows — Sun, 29 Nov 2020 03:50:46 GMT

Hello everybody,
I see that we have SR-IOV and DPDK modes supported for Palo Alto in AWS and understand that DPDK is proffered mode which provides fast processing. 192168101.com
so are there any specific situation where SR-IOV mode is preferred over DPDK?
are you know? 19216811.dev

Re: Supported SR-IOV for Palo Alto in WS

nanasin — Mon, 30 Nov 2020 04:17:58 GMT

SR-IOV and DPDK can be enabled simultaneously.

Slightly misleadingly, SR-IOV is assisted by the network card and DPDK is assisted by the CPU.
https://en.wikipedia.org/wiki/Data_Plane_Development_Kit
https://en.wikipedia.org/wiki/Single-root_input/output_virtualization

Enabling SR-IOV bypasses the hypervisor that exists between the PAN-OS(VM-Series) and physical NICs.

Enabling DPDK bypasses the PAN-OS (linux kernel) that resides between the NIC bypassed by SR-IOV and the pan_task (a process that represents the data plane).

DPDK is effective for simple processes such as just moving data from east to west, raising the limit from around 20 Gbps to around 100 Gbps.

I think DPDK probably won't be effective until Threat Prevention's throughput exceeds 30 Gbps, which is not very useful at the moment.
In other words, I don't think it's very useful at this time (the unconfigured defaults should be the most secure).

Where DPDK is useful is in eliminating most of the bottlenecks, even in configurations that connect via Open vSwitch (OVS).

Here are Intel's test results
https://builders.intel.com/docs/networkbuilders/demonstrating-data-plane-performance-improvements-using-enhanced-platform-awareness.pdf

It should be possible to use OVS in AWS as well, but there should be little benefit to using it (although I did some research).

Therefore, I think it's enough to just enable SR-IOV, and I think it's safer to not change the default.

Re: Supported SR-IOV for Palo Alto in WS

Sidneyy — Fri, 18 Dec 2020 10:10:29 GMT

Supported SR-IOV for Palo Alto in WS. Hello everybody,I see that we have SR-IOV and DPDK modes supported for Palo Alto in AWS and understand that DPDK

topic Re: Supported SR-IOV for Palo Alto in WS in VM-Series in the Public Cloud

Supported SR-IOV for Palo Alto in WS

Re: Supported SR-IOV for Palo Alto in WS

Re: Supported SR-IOV for Palo Alto in WS