topic Re: long time to implement "commit" in General Topics

long time to implement "commit"

TI_IIISERVICIOS — Tue, 06 Sep 2011 16:42:07 GMT

Hi,

PA2020
to make a change and use "commit" takes about 2 to 3 minutes, I make many changes a day and I traceback, why take so long, is it bad configuration or pa2020 is normal?

regards

Arturo Vázquez Figueroa

Re: long time to implement "commit"

mharding — Tue, 06 Sep 2011 17:32:54 GMT

I would say you're on the lucky end. Take about 15 minutes on my 2050.

It mostly depends on the size of the configuration file and what changes were made.

Re: long time to implement "commit"

TI_IIISERVICIOS — Tue, 06 Sep 2011 18:43:24 GMT

not depend on size, I have 20 rules and only 100 users always takes the same time or longer, but just add a single user

Arturo

Re: long time to implement "commit"

COMIP — Tue, 06 Sep 2011 21:35:30 GMT

Hi,

I have the same issue with PA2020 4.0.4 version (5-6 minutes of boredom). I tried with the new 3.1.10 and works fine, we have to wait for tech support response or try with the new 4.0.5...

Bye

Re: long time to implement "commit"

ucteam — Wed, 07 Sep 2011 01:35:35 GMT

From my experience.. yes committing changes always takes a long time.. my understanding is that when committing changes you are essentially reprogramming all the FPGA's on the device.. this is unfortunately a slow process.. but once complete its what enables the PA firewall to process data/traffic at super high speeds (as most EVERYTHING is been done in hardware).. As opposed to normal firewalls which have hardcoded ASICS which can only offload some of the tasks whilst the rest is handled by the CPU.

If you've never done an OS upgrade on PA firewall yet.. hmm.. well be prepared for a very long wait for it to come back after the reboot (sometimes ~20mins+).. especially when going between major versions (eg. 3.x-4.x).. same deal.

Re: long time to implement "commit"

bradenmcg — Wed, 07 Sep 2011 02:08:12 GMT

Rumor has it that one of the major improvements in 4.1.x when it releases is speed improvements to the GUI and possibly to commit as well.

But yes, it's slow. It's the tradeoff. I'll gladly take it for a device that is far better than everything else on the market.

Why are you adding users to the firewall, you have no other LDAP/directory infrastructure? Much easier to add people to that directory and have the PAN access LDAP/ActiveDirectory instead.

Re: long time to implement "commit"

MSJ — Thu, 15 Sep 2011 16:42:57 GMT

The speed (or lack thereof) in the management GUI is ridiculous.

Adding a single rule is a 10-15min process on our PA-2050 boxes running 4.0.4. I love the feature set, but adding a single rule on our old PIX was about a 30 second process.

It's going to be a nightmare troubleshoot connectivity issues if I have to wait 10 minutes to test every change. I really hope this can be sped up in the next release, if not I'm going to regret this purchase.