topic Re: same zone and throughput in General Topics

same zone and throughput

migration — Mon, 11 Apr 2011 13:49:40 GMT

Hello guys,

My question is about a Palo Alto PA-500.

The firewall througput is around 250Mbps, and 100Mbps with inspection of packets.

I have 1 Firewall PA-500, with 5 interfaces (L3):

Eth1/1: Untrust zone

Eth1/2: DMZ Zone

Eth1/3 to Eth1/5: Trust zone

What about the throughput between 2 interfaces (L3) in the same zone ?

As far as I understand, this trafic is allowed with a implicit rule (unless we configure a "deny all" rule at the end of our rules).

Does the firewall inspect (APP-ID) the packets between a same zone or not? What will be the throuhput in this case? 250Mbps? More?

I read the document about the packet flows, but it's not clear for me about these questions I have...

Thanks you for your answers,

Regards

Khay

Re: same zone and throughput

jpa — Tue, 12 Apr 2011 21:37:49 GMT

Khay

The throughout will not change, for inter or intra zone traffic. APPID will still be applied for all traffic . Unless you create an intra zone policy to permit traffic you will not be able to see the detected apps.

Thank you

Jerish

Re: same zone and throughput

KGC — Tue, 12 Apr 2011 22:17:49 GMT

Can I ask a stupid question - is there a simple way to report on the throughput on a given interface?

Re: same zone and throughput

alliance — Wed, 13 Apr 2011 10:33:58 GMT

Thanks you Jerish for your answer.

Just a last question about that:

Is there any way or trick to desactive the APP-ID for particulars flows which go through the firewall ?

Ksemenov > A simple way will be to use SNMP (SNMP Traffic Grapher / CACTI / etc.) and graphe the real-time throughput on the interfaces. With Palo Alto, maybe there is another way with the WEBUI or CLI...

Khay

Re: same zone and throughput

migration — Wed, 13 Apr 2011 13:59:59 GMT

alliance ha scritto:

Thanks you Jerish for your answer.

Just a last question about that:

Is there any way or trick to desactive the APP-ID for particulars flows which go through the firewall ?

Khay

Hi alliance.

The only way to deactivate App-ID is through an Application Override policy that match the app you want to exclude from App-ID identification.