topic Re: The maximum throughput of 3260 firewall is 8.8 Gbps. How does the firewall handle the traffic entering through the QSFP+ ports with 40gig throughp in General Topics

The maximum throughput of 3260 firewall is 8.8 Gbps. How does the firewall handle the traffic entering through the QSFP+ ports with 40gig throughput?

benafra — Mon, 22 Jul 2024 12:24:32 GMT

Hello,

We have a Palo Alto 3260 firewall with two 40 Gbps QSFP+ ports, but its maximum firewall throughput is 8.8 Gbps. How does the firewall handle the traffic entering through the QSFP+ ports, considering the potential incoming traffic exceeds the firewall's throughput capacity? How does the device manage this traffic, and what happens to the packets when the traffic exceeds the firewall's 8.8 Gbps throughput limit? And the percentage of packet dropping is 3%.

Thanks.

Re: The maximum throughput of 3260 firewall is 8.8 Gbps. How does the firewall handle the traffic entering through the QSFP+ ports with 40gig throughp

reaper — Tue, 23 Jul 2024 08:22:45 GMT

The 40gb is just link speed so there's no issue there

Once you reach the firewall's maximum capacity, several things can happen depending on the kind of traffic and how much 'over' it's limit you go

the firewall will always try to forward packets accordingly, but may not be able to buffer everything flooding in (if buffering is needed) so packetloss may occur.

you can see buffering via the CLI command > show running resource-monitor

packet buffer: 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 packet descriptor: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

buffer is software, descriptor is hardware

Re: The maximum throughput of 3260 firewall is 8.8 Gbps. How does the firewall handle the traffic entering through the QSFP+ ports with 40gig throughp

benafra — Tue, 23 Jul 2024 09:55:48 GMT

Thank you for your answer but I checked the device and observed that 40 Gbps of traffic is entering the firewall. I want to understand how it manages to handle 40 Gbps of traffic, especially considering that the packet drop rate is very low.
Thanks again.

Re: The maximum throughput of 3260 firewall is 8.8 Gbps. How does the firewall handle the traffic entering through the QSFP+ ports with 40gig throughp

reaper — Tue, 23 Jul 2024 10:48:53 GMT

how are you observing 40gbps?

can you run > show session info

Re: The maximum throughput of 3260 firewall is 8.8 Gbps. How does the firewall handle the traffic entering through the QSFP+ ports with 40gig throughp

Brandon_Wertz — Tue, 23 Jul 2024 14:17:14 GMT

I would agree with @reaper and where he is likely going. You mention the advertised throughput capacity of the 3260 being substantially lower than the 40Gb transceiver speed, but just because you have network connectivity of 40Gbps doesn't mean there's actually traffic coming to the FW of that or even close to it.

While Palo Alto advertises a certain throughput limit for it's hardware that number is a factor of probably 100+ different variables. In some situations the hardware might be able to do double the advertised throughput or in some cases you might only get 1/4th. The max throughput number is simply a guide customers can use to help gauge the relative performance they could expect from a certain hardware model.

--edit-- shared the hardware specs of the 3200/3400

As an FYI the 3200 hardware platform is being EOLd and replaced with the 3400s. You can see from the specs the 3400s performance is substantially greater than the older 3200 generation.