topic Re: Commit times in General Topics

Commit times

rsullivan — Fri, 22 Aug 2014 18:07:54 GMT

I'd like to hear some feedback from users on the 3050 hardware. We currently use the 2020's and commit times are between 30-60 minutes. We've been using this platform for several years and been through tech support dozens of times on this issue. I understand it's more of a hardware design issue and has been corrected in newer models. For anyone on the 3000 series can you give me some feedback on commit times? We have roughly 300 rules and are running in HA active/passive.

Thank you

Re: Commit times

HULK — Fri, 22 Aug 2014 18:14:32 GMT

Hello Rsullivan,

Custom Apps will increase the commit time about factor 5. If your candidate configuration contains a new or modified custom App-ID or custom Vulnerability signature, then those signatures must be re-compiled (along with Palo Alto Networks' signatures) upon commit. That compilation process will add quite a bit of time to a standard commit process (on PA-200/500/2000 platforms). The additional compilation time is negligible on the higher-end platforms (3000/4000/5000).

Commit times will be extended if you add or edit a custom signature. However, subsequent commits will return to "normal" because you're not adding/editing more custom signatures. This is true for all platforms

Hope this helps.

Thanks

Re: Commit times

licenselu — Fri, 22 Aug 2014 18:47:51 GMT

Hello,

We moslty deployed PA500.

With the new memory upgrade kit, commit time is about 2 minutes...

I played with a PA3020 for a POC. Commit is LESS than... 15 seconds !!

Regards,

Re: Commit times

tshiv — Fri, 22 Aug 2014 21:28:48 GMT

It is well known fact among all the customers that PA-2000's are not well equipped on the management plane.

- First step is to identify if there are unnecessary jobs carried out by the management plane which can be verified with support by opening up a support case.

- If the management plane of the device is still being maxed out with all the necessary configuration and settings in place, then it is better to upgrade the hardware.

PA-3000's are very well equipped on the management plane. They have much faster commit times and presents minimal management plane issues.

You can also take help from your Account manager/ Sales Engineer in this case.

Thanks

Re: Commit times

darren_g — Mon, 25 Aug 2014 04:20:28 GMT

rsullivan wrote:

Thank you

I've got a HA pair of 2020's at my main site, and a single 3020 at a remote.

I can download (with a slower link), install and validate two dynamic updates (content and virus) on the 3020 in the time it takes to HALF commit the virus definition update on the 2020's.

The 3020 commits config changes like lightning compared to the 2020.

The big difference is the 3000 series has more RAM for the management plane and a faster processor. If you can convince management to upgrade your 2020's - do it. You won't regret it.