topic Re: Tips to improve mgnt tasks in a PA-2020 in General Topics

Tips to improve mgnt tasks in a PA-2020

FabioGarcia — Fri, 07 Mar 2014 14:49:39 GMT

Hello Everyone,

Does anybody knows any tips to improve mgnt tasks (policy changes, monitors checks, commits... etc etc) in a slow box PA2020?

I am working w/ this model since november 2013 and I am facing so many problems w/ slow response during management....

My box do:

- User identification from external agent

- URL filtering by bright cloud

- Around 200 security policies

- Around 5 Nats (all of them outbound)

- Usually 2 users do changes at same tima during our normal business hours.... (1 deals w/ URL filtering e another one w/ FW rules, monitors, etc etc....)

- Usually we see mgnt plane working at 98% all the time....

thanks in advance for any help on that!

Re: Tips to improve mgnt tasks in a PA-2020

ericgearhart — Fri, 07 Mar 2014 14:55:01 GMT

Honestly PA needs to throw in the towel on the PA 2000 platform, and replace everyone's PA2020 with a PA3000 series box for free. I could never get published bandwidth specs out of our PA2050, I can't imagine how painful it must be using a PA2020 for real workloads outside of a lab 😞

Re: Tips to improve mgnt tasks in a PA-2020

Retired Member — Sat, 08 Mar 2014 07:36:20 GMT

Hi,

using service route rather than management interface ( for management)

Cleaning All logs(if they are not important already sent to Panorama,syslog etc..) ( for commit time)

Re: Tips to improve mgnt tasks in a PA-2020

Retired Member — Mon, 10 Mar 2014 03:02:31 GMT

You don't mention anything about what PAN-OS version you are running or your management resource utilization. I would suggest following below article for some commands to view overall system utilization.

Troubleshooting Slowness with Traffic, Management, or Intermittent SSL Decryption

If you still have issue, I would recommend contact TAC to see if there is anything perhaps consuming inordinately large amount of resources or not.

-Richard

Re: Tips to improve mgnt tasks in a PA-2020

dieter_b — Thu, 13 Mar 2014 14:07:56 GMT

Sadly, this seems to be the default answer to all 2000 series performance issues threads in this forum...

Re: Tips to improve mgnt tasks in a PA-2020

ericgearhart — Thu, 13 Mar 2014 15:00:32 GMT

dieterb they should just issue a mass recall and replace everyone's PA2000 with either a PA500 (which in my personal experience can outperform a PA2000) or better yet replace them with the lowest end PA3000!

Re: Tips to improve mgnt tasks in a PA-2020

dieter_b — Thu, 13 Mar 2014 16:37:33 GMT

I totally agree with you. We've had these issues for quite some time now. We currently even have a support case open with our local support reseller right now.

Basically, PaloAlto wants "proof" that there is an issue, before they do anything. We've been collecting commit issues, commit times, memory utilization for some time now.

But still, I fear PA will not act. By the time our issue-report is complete, I expect PA support to say "please upgrade to version X first" (what we just did because they told us to) ... to start all over again.

Re: Tips to improve mgnt tasks in a PA-2020

gafrol — Fri, 14 Mar 2014 11:50:13 GMT

Absolutely, the main negative feedback we get from customers is due to the slowness of the MP of the 2000 Series boxes. People tend to generalise this slowness to all the PAN Firewalls which leads to a bad reputation in the market. PAN should really do something about it.

Re: Tips to improve mgnt tasks in a PA-2020

darren_g — Fri, 21 Mar 2014 03:14:27 GMT

dieterb wrote:

Sadly, this seems to be the default answer to all 2000 series performance issues threads in this forum...

Yeah, and the default reply is "We can't find anything wrong, this is expected behaviour".

I got told last time I logged a job that I should select "manual" updates when I'm sitting in the console instead of the periodic 1 minute I have it set at to take load off the management plane. Ridiculous.

Re: Tips to improve mgnt tasks in a PA-2020

darren_g — Fri, 21 Mar 2014 03:15:43 GMT

ericgearhart wrote:

Or at least put out an upgrade kit to put more RAM into the management plane. I understand why they won't make it customer upgradable like the PA500 (because you have to expose the power supply on the 2000 series), but for f*** sake, I'd *pay* to have someone come out and upgrade the RAM on my 2020's.

Re: Tips to improve mgnt tasks in a PA-2020

darren_g — Fri, 21 Mar 2014 03:17:49 GMT

dieterb wrote:

Been there, done that. At least twice.

I've got a 3020 in service at another location, and the difference in commit times is staggering - I can commit the config through *10* changes on the remote site before I get *one* change done on my central site's 2020's.

Software version doesn't make one bit of difference. If anything, it gets slower with software upgrades as they push more "features" into the base OS install/

Re: Tips to improve mgnt tasks in a PA-2020

${userLoginName} — Fri, 21 Mar 2014 08:16:01 GMT

darren.g I've seen cases where the performance is increased (a lot) by upgrading the PANOS version. Except introducing new features, Palo Alto is also improving their code and making it more efficient

Re: Tips to improve mgnt tasks in a PA-2020

darren_g — Sun, 23 Mar 2014 23:11:09 GMT

bdeschut - I saw an improvement exactly *once* - when I upgraded from, I think, 4.1.6 to 4.1.8-h3 - management CPU went from 70% constantly with spikes to 100% to only having spikes to 70% every five minutes - and it's been that way *ever* since. That's not an improvement - that's simply a change in priority/frequency of the process which is causing the issue.

Re: Tips to improve mgnt tasks in a PA-2020

dieter_b — Mon, 24 Mar 2014 07:30:01 GMT

darren.g wrote:

.... I understand why they won't make it customer upgradable like the PA500 (because you have to expose the power supply on the 2000 series)...

This, I sadly have to say, is typical American "no liability" nonsense.

Come on, we're all professionals here. Or we can find someone really easy who has the right certification to open te box. As if anyone would attempt a RAM upgrade on a box like that while it's running...

Re: Tips to improve mgnt tasks in a PA-2020

ericgearhart — Mon, 24 Mar 2014 12:24:46 GMT

Unfortunately the reality of it is Palo Alto Networks is headquartered in America, and the sue happy society we have makes corporate lawyers gun shy about letting customers open up the boxes they sell (rightfully so.. all it would take would be one person getting shocked and PA could have a huge lawsuit on their hands).

Re: Tips to improve mgnt tasks in a PA-2020

dieter_b — Thu, 24 Apr 2014 16:22:49 GMT

Did anyone have any luck with this ?

So far, our support case is still open ... and has been quiet for some time :smileyconfused:

Re: Tips to improve mgnt tasks in a PA-2020

keith.b — Sat, 11 Jul 2015 13:30:01 GMT

I am sad that this is still an issue, we are a small University, and are having this data-plane issue, we are biting the bullet and moving to the 3020, but its horribly painful, the last week we have had to reset the data-plane every couple hours...