topic Testing Performance in General Topics

Testing Performance

luk — Tue, 22 Nov 2016 13:56:27 GMT

I would like to get to know which specifc traffic is being checked by specific features of Palo-alto NGFW. To be more precise after enabling all the features on the device which traffic is being checked by URL filtering , IPS Anti- Spyware and other features. The traffic must be using specific ports?

Re: Testing Performance

TranceforLife — Tue, 22 Nov 2016 14:27:14 GMT

Hi,

It is all depends on how do you configure your profiles. For the URL depends on of the category and the action, for the file blocking depends on the file type/extension, etc.

https://www.paloaltonetworks.com/documentation/60/pan-os/pan-os/threat-prevention/about-security-profiles

Cheers,

Myky

Re: Testing Performance

bmorris1 — Tue, 22 Nov 2016 19:13:16 GMT

Hi luk,

Here's what you'll need to do:

Access the monitor tab and select traffic logs from the left hand side.
Identify the traffic you're looking for either by scrolling through the logs or applying a filter. You can apply a filter easily by selecting the + button on the right hand side.
Once you've found the traffic note down the security policy that this traffic is matching.
Select the policies tab from the top and select security from the left hand side.
In the search bar type in the name of your policy.
Once you've found your policy you can find out what content-ID profiles are attached to it by looking in the action tab.
To find out more info about the profiles that are attached then select the objects tab from the top of the gui and you'll have the specific profiles on the left.

Hope this helps,
Ben

Re: Testing Performance

luk — Wed, 23 Nov 2016 10:59:04 GMT

So when I generate UPD traffic for example 64 bytes of random data with destination port for protocols like POP3 IMAP SMTP and others and correctly configured security profiles I should see performance degradation ?

Re: Testing Performance

bmorris1 — Wed, 23 Nov 2016 11:47:07 GMT

Yes that is right in theory as the firewall throughput speeds are less when content inspection is applied.

Ben