topic Re: sizing firewall in General Topics

sizing firewall

simsim — Fri, 25 Mar 2022 06:45:32 GMT

Hi,

I am looking for a firewall for 3000 users,

and 500 vdi access

expecting approximately igb internet traffic

Please help to size,

Ho much throughput I needed

Thanks

Re: sizing firewall

reaper — Mon, 28 Mar 2022 12:25:24 GMT

if you're a partner you can use 'popsicle' from the NextWave portal https://www.paloaltonetworks.com/partners/nextwave-partner-portal/cyberforce/cyberforce-members-only

to get a decent sizing you'll need to estimate how much ipsec, app-id and ssl throughput you will expect, and then guesstimate how much l7 scanning you're going to apply

ie.

1gbps app-ID sizes to pa-820,

1gbps threat-ID sizes to pa-3220,

1gbps ssl decryption + threat-ID sizes to pa-5220

Re: sizing firewall

simsim — Wed, 15 Jun 2022 15:02:47 GMT

Hi @reaper

Can you please elaborate How I determine the app-id throughput

Thanks

Re: sizing firewall

OtakarKlier — Wed, 15 Jun 2022 19:16:40 GMT

Hello,

Here is a link to the comparison sheet:

https://www.paloaltonetworks.com/products/product-selection

Then select the devices you think might work. In your case, start with the 3410 and 5410 as a comparison.

I always look a the smallest number and go from there, even if I'm not using it. This way if in the future you need that feature, you have it sized correctly, if nothing else changes. Also dont skimp on the licenses and features. They help you more than you know.

I'm only guessing but I bet a 3410 would work for you (but dont go by my advice only since I dont know your environment). Stay with the models that have the 4 as the second number, they are the newest architecture.

Cheers!

Re: sizing firewall

BSnow — Tue, 28 Mar 2023 19:03:02 GMT

What is the best way to size that for an existing customer, on an existing firewall?

Re: sizing firewall

OtakarKlier — Wed, 29 Mar 2023 18:39:38 GMT

Hello,

If the Palo Alto has already been deployed, check the CPU utilization. This is a good indicator (not the only one) of the performance of the existing system. If you are looking to replace another vendors firewall, What I do is take the amount of bandwidth that the traffic is going through and them spec the Palo Alto with that number using the most restrictive numbers, usually the 'Threat Prevent' numbers. Then make sure that its less than 50% of that. This give room for growth etc.

Regards,

Re: sizing firewall

OtakarKlier — Wed, 29 Mar 2023 18:43:22 GMT

Hello,

For those specs, I would go with a PA-5410 series.

Regards,