topic PA-200 and PANOS Version 8 in General Topics

PA-200 and PANOS Version 8

oscaringosv — Thu, 01 Jun 2017 15:28:15 GMT

Hello everyone,

A few days ago I was testing version 8 with a few PA-200s that we have in our lab, tested new features mostly with user credential Submission. I found that the performance of the devices were impacted (Data Plane CPU was around 70%-95%) only having one or two devices connected to it, is there any advise of using version 8.0.x for these specifics firewall models, or do I stay in version 7.1 ? any advise would be most appreciate.

Re: PA-200 and PANOS Version 8

VinceM — Thu, 01 Jun 2017 13:56:05 GMT

Hi,

We did some test on PA200 too but no issue with high CPU load.

Keep in mind the feature "credential submition" can be intensive for appliances. Need lot of request with special USer agent need to analyse all traffic ...

Then at the end, maybe not good idea to use new high load feature on neither PA200 nor PA500 🙂

But V8 on both of them is ok with "standard" featrure.

Hope help.

Re: PA-200 and PANOS Version 8

oscaringosv — Thu, 01 Jun 2017 15:24:22 GMT

Yes, that's what I think, also adding SSL decryption would add more CPU impact.

Re: PA-200 and PANOS Version 8

BPry — Thu, 01 Jun 2017 15:27:10 GMT

@oscaringosv,

Honestly I would avoid using the user credential submission on both the PA-200 and the PA-500 because of the stress that it actually puts on the system. Keep in mind that this is also dependent on the amount of traffic you were processing and could very depending on how you are actually responding to it. I would only recommend using the credential submission on the traffic that you actually care about if you are inclined to use it on the PA-200 or PA-500.