topic PA-500 and Jumbo Frames in General Topics

PA-500 and Jumbo Frames

GtY007 — Wed, 24 Jul 2013 22:27:06 GMT

Background:

I've been doing some testing with a pair of A/A PA-500's and decided to enable jumbo frames on a file server. I understand that the PA-500 does not support jumbo frames but when I begin a file transfer, it works, running at about 5,017 Kbps. After a little while the frame size reaches 4464-bytes and my speed increases to 392,644 Kbps, way above the Threat prevention throughput of the firewall, listed as 100 Mbps (~102,400 Kbps). When this happened my CPU usage goes from 99% to about 66%, so something is still being processed. The Session Browser still shows all traffic being matched through my test rule called "Allow All". This rule has Anti-virus, Anti-spyware, Vulnerability Protection, and URL filtering turned on.

Questions:

- Is there any documentation about Jumbo Frame for the PA-500, I haven't been able to find an explanation that accounts for my test scenario?

- What happens when the PA-500 encounters a frame size over 1500 MTU, does is just pass it through without inspection (hence the speed increase)?

- When the Session Browser says that the "Allow All" rule is being matched, does that mean the Jumbo Frames are being processed, if not, why is there a rule match, if yes, how is it possible to get such speed and low CPU usage?

- Should I force the firewall to drop Jumbo Frames if they are encountered, to ensure security (if they are not processed), if so, how?

Any thoughts are appreciated.

Thank you,

Alain

Re: PA-500 and Jumbo Frames

HULK — Wed, 24 Jul 2013 22:57:46 GMT

Hi Alain,

Please find below mentioned discussion, hope it will help you for the 1st Qn.

https://live.paloaltonetworks.com/docs/DOC-2208#comment-4467

Thanks

subhankar

Re: PA-500 and Jumbo Frames

HULK — Wed, 24 Jul 2013 23:01:46 GMT

Hi,

What happens when the PA-500 encounters a frame size over 1500 MTU, does is just pass it through without inspection (hence the speed increase)?

Ans:- No, it should fragment the packet into a smaller size as per the MTU of that link.

Thanks

Subhankar

Re: PA-500 and Jumbo Frames

GtY007 — Wed, 24 Jul 2013 23:01:55 GMT

Thank you, I did see that doc, but it only helps me understand that the PA-500 does not support Jumbo Frames. With that in mind, I'm trying to figure out what exactly happens when it does encounter one.