topic Re: Can we use 10GbE SFP+ on PA-3220 to connect directly to NetApp SAN over optical connection in Next-Generation Firewall Discussions

Can we use 10GbE SFP+ on PA-3220 to connect directly to NetApp SAN over optical connection

marcusserrao — Tue, 28 Feb 2023 20:14:52 GMT

Hey all. We're kind of in a bind. We procured a NetApp AFF A220 SAN that only have 10GbE optical transceivers for data access. We have no network hardware (no fabric or network switch) that support 10 gigabit except potentially our PA-3220 that have 4 x SFP+ ports capable of 10GbE.

Is it possible to connect the SAN directly to the SFP+ ports on the PA-3220 for access by our ESXi nodes? The ESXi nodes are connected via RJ-45 1GbE connections from Cisco switches connected to the PA-3220.

thanks in advance!

Re: Can we use 10GbE SFP+ on PA-3220 to connect directly to NetApp SAN over optical connection

murali438 — Wed, 01 Mar 2023 11:24:36 GMT

Hello,

Please check this How to make unused ports of Palo Alto Networks firewall into a ... - Knowledge Base - Palo Alto Networks

Re: Can we use 10GbE SFP+ on PA-3220 to connect directly to NetApp SAN over optical connection

TomYoung — Wed, 01 Mar 2023 12:42:36 GMT

Hi @marcusserrao ,

Yes, you can connect the NetApp directly to the PA. There are a number of things to consider:

Using L2 interfaces as @murali438 suggested is probably the best way to go, but you could also use L3 interfaces.
Most SFP+ transceivers will work, but TAC only supports PA transceivers.
The max throughput of the PA-3220 is 4.2 Gbps or 2.3 Gbps with threat prevention. https://www.paloaltonetworks.com/products/product-comparison?chosen=pa-3220,pa-3250
If you create a separate rule for the traffic without a security profile, you should get 4.2 Gbps.
If the backup traffic is still slow, consider an application override rule to bypass Content-ID completely. https://live.paloaltonetworks.com/t5/blogs/tips-amp-tricks-how-to-create-an-application-override/ba-p/451872 A custom App-ID is required.
Configure QoS on the NetApp if possible to shape the traffic at 4 Gbps. Otherwise, the NetApp will send 10 Gbps and may overrun the buffers on the NGFW.

Thanks,

Tom

Re: Can we use 10GbE SFP+ on PA-3220 to connect directly to NetApp SAN over optical connection

marcusserrao — Wed, 01 Mar 2023 16:28:02 GMT

Thank you both!