topic Re: PA-2050 have problem performance CPU dataplane. (80 -95% all time) in General Topics

PA-2050 have problem performance CPU dataplane. (80 -95% all time)

EBSSupport — Tue, 13 Dec 2011 15:46:36 GMT

PA-2050 have problem performance CPU dataplane. (80 -95% all time)

Deploy paloalto 4 zones (inside, outside, DMZ, Server)
Enable IPS, Antivirus, Antispyware
firmware version 4.0.7
Throughput avearage 200 - 250 Mbps
Connection 20000 - 30000 session

Testing disable layer 7 application with create Application overide policy between inside and Server zones (All TCP and UDP Port)
result CPU dataplane 40-50 %
after 1 days
I create security policy allow ssh application between inside to outside
then paloalto firewall is down

Please propose solution to me ? (My customer want to view application traffic log between inside and server zone)

It's worst if use application overide solution.

Thanks, All

Re: PA-2050 have problem performance CPU dataplane. (80 -95% all time)

rmonvon — Wed, 14 Dec 2011 03:22:29 GMT

What is the network topology like where the PA device is deployed? Is the PA device in L3 or vwire?

Re: PA-2050 have problem performance CPU dataplane. (80 -95% all time)

EBSSupport — Wed, 14 Dec 2011 12:40:48 GMT

Network topology

L3 Mode

design 4 interface ( inside, outside, DMZ, Server )

Re: PA-2050 have problem performance CPU dataplane. (80 -95% all time)

rmonvon — Thu, 15 Dec 2011 03:55:19 GMT

Upon initial review of the network diagram and your description, there may not be a problem. The PA2050 is rated for 500Mbps threat prevention throughput under optimal condition. The average throughput you're seeing is 200M-250Mbps, which means the PA2050 would be at ~45-50% CPU at the very best. Other factors to consider are: types of traffic mix, packet size, zip contents that have to be scanned, etc. These factors would affect CPU usage.

You may want to contact Support or your local Palo Alto team to review your environment in more details.

Thanks.

Re: PA-2050 have problem performance CPU dataplane. (80 -95% all time)

EBSSupport — Thu, 15 Dec 2011 07:14:15 GMT

Thanks you for your answer