topic Re: Vulnerability protection in Advanced Threat Prevention Discussions

Vulnerability protection

Charlie80 — Tue, 22 Nov 2022 12:59:48 GMT

I am going to activate a profile with vulnerability protection enabled.

I have many rules without TP profile that I need to enable, but I want to know if the firewall can handle them.

What is the best way to calculate how much CPU load the TP adds to the firewall? I need to be sure that I don't exceed the firewall's limit.

At the moment, the CPU load peaks at 50% during working hours.

According to best practice, what is the CPU load that we must not exceed?

Re: Vulnerability protection

Metgatz — Wed, 23 Nov 2022 06:15:12 GMT

Hello @Charlie80

Hello, if here you will not have that problem, to apply the security profiles in all your policies.

The alarming CPU usage of the dataplane, in average and/or in peak hours would be when it is at 75% or 80%, and if the average is higher than that, it is time to pay some attention to the firewalls.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRTCA0#:~:text=Many%20cores%20regularly%20surpassing%2075%25%20warrants%20an%20investigation.

Regards

Re: Vulnerability protection

Charlie80 — Wed, 23 Nov 2022 16:17:23 GMT

Thanks for tips