topic Re: Throughput of an Active/Active HA pair in General Topics

Throughput of an Active/Active HA pair

RaveDave92656 — Fri, 09 May 2014 19:34:05 GMT

I believe that in an active/active HA pair the total throughput is equal to the performance of a single box, not the sum of both boxes.

For the PA-5050, the throughput for an Active/Active HA pair is 5Gbps with threat prevention.

Where is this documented?

I need to show it to management

Dave

HULK — Fri, 09 May 2014 20:31:23 GMT

Hello Dave,

In Active/Active mode, Both devices in the cluster are active processing and passing traffic:

> Devices back each other, taking over primary ownership if either one fails

> Both devices load share the traffic

> w/o external load balancers, traffic is “shared” between devices based on routes on up/downstream devices, or manipulating default gateways

BUT REMEMBER

> No increase in session capacity

> Not designed to increase throughput

I would recomend you to contact with your Palo Alto SE to get a proper documentation for the same.

Thanks

pulukas — Sun, 11 May 2014 13:21:32 GMT

In Palo Alto Active/Active is not at all about capacity, so you won't find it mentioned in the documentation. The use cases are just two:

Asymmetrical routing - there are two active paths and source and reply traffic can appear on different links. The A/A setup allows the sessions to still be matched and processed by the original firewall.
Dynamic routing protocol load balancing - There are two paths that traffic could take through the firewalls and that path is selected by routing preferences in dynamic routing protocols outside the PA firewall. The inactive path interfaces must remain up for the dynamic peers to maintain their routing tables. In an active/passive design the passive firewall links are down and the peers on the secondary path cannot remain up.

See the discussion in the Active/Active Tech note for more details.