topic Re: High Packet Rate / Throughput in General Topics

High Packet Rate / Throughput

nickcx1 — Fri, 20 Dec 2013 13:01:06 GMT

PA2020 4.1.14, 500 users. Recently we have added ~100 more users to our PA2020 and are seeing huge slow-downs for internet. Session stats show our device has a high packet rate and through put. We have been advised that~20,000 packet rate / 120 mb throughput are the limits and anything encroaching 80% of the limit will result in a slow down.

Device is up : 1 day 14 hours 3 mins 38 sec

Packet rate : 34580/s

Throughput : 115023 Kbps

Total active sessions : 8801

Active TCP sessions : 8644

Active UDP sessions : 33

Active ICMP sessions : 0

Any suggestions on how to further troubleshoot whether a specific user/rule is responsible or - grabs straws - ANYTHING else I can work through?

Re: High Packet Rate / Throughput

JimS2 — Fri, 20 Dec 2013 23:42:08 GMT

Some things you can do to reduce the load on the Palo Alto and improve performance.

1) Reduce logging on certain security policies which pass trusted traffic (i.e. internal DNS, internal web server). If you don't have rules specifically for that traffic create them and turn off the logging.

2) Create application overrides for trusted traffic (i.e. internal DNS, internal web server). This will reduce the load on the content inspection engine.

3) Look for large amounts of small packets such as high ping rates from monitoring devices.

Re: High Packet Rate / Throughput

stewart — Thu, 26 Dec 2013 00:54:53 GMT

Also check to make sure log at session start is not checked.

Check the ACC tab and see what app has the most sessions then follow step 1 from JimS2.

Re: High Packet Rate / Throughput

nickcx1 — Tue, 18 Feb 2014 11:58:03 GMT

Delayed reply..

Thanks for the suggestions. After having a PA engineer look at the device they concluded that the device was just not up to the job for us. The logging was minimal on policies but the sessions were just too high. We swapped out for the (much better) 3020s and the problem has gone.

Thanks again.

Re: High Packet Rate / Throughput

MydisplayNameis3 — Wed, 19 Feb 2014 18:23:53 GMT

What CLI commands should we be using to manage/monitor the effect as we make these changes?