topic Re: Performance capabilities of Palo Alto 3000 Series Firewalls in General Topics

Performance capabilities of Palo Alto 3000 Series Firewalls

MarkTan — Mon, 23 Dec 2013 19:55:18 GMT

Hello,

We are currently building out our network infrastructure for a new office and have a question regarding the capabilities of the PA 3000 series firewalls. We want to use to be able to use two PA in high availability mode (active-passive) to do our routing, DHCP for different vlans, antivirus filtering, web filtering, vpn, potentially vlans, and active directory integration for the entire office. We will be implementing about 7 vlans (4 of them requiring DHCP); routing for an office of about 100 employees; internet connectivity for PCs, projectors, smart tvs, etc.; antivirus and other security features of the palo alto; ssl vpn; active directory integration for captive portal; and other items. Can anyone provide some insight on whether two PA 3000 firewalls will be able to handle this load?

Also, if anyone has any ideas on the proper method to perform DHCP on 4 vlans via subinterfaces, that would be great. I assume that I define the layer 3 interface, create the subinterfaces with the proper tagged vlan, and then set up the DHCP pool tied to that specific subinterface?

Thanks,

Mark

Re: Performance capabilities of Palo Alto 3000 Series Firewalls

tasonibare — Tue, 24 Dec 2013 16:40:11 GMT

Mark,

The PA-3000 firewalls will efficiently handle your described office requirements.

I can unicast you information on the capacities of the PA 3000 if you like, but your SE would be a great resource for this information as well.

Also for DHCP, your method will work just fine, having DHCP pools on each configured sub-interface.

Regards,

tasonibare

Re: Performance capabilities of Palo Alto 3000 Series Firewalls

mikand — Tue, 21 Jan 2014 07:32:06 GMT

Does the builtin DHCP in PA support logging of option82 information?

Because then the log in PA would be complete with information on where the client is physically connected to the network (given that you in your access-switches also use ip-source verify and such to block spoofing clients).