topic Re: Does Policy blocking/deny huge traffic cause High CPU utilization in General Topics

Does Policy blocking/deny huge traffic cause High CPU utilization

sandeep.paul — Fri, 13 Oct 2017 05:52:49 GMT

I have a PAN 200 at sales office, I have temp deny policy in place as I saw huge traffic (Genetec Traffic) from/to a specific destination/source.

But I still see High CPU causing the Firewall to Reboot and which triggered Site Down Alerts( Downstream device lost connection).

Does the Deny Policy for huge traffic (Number of Packets or Size of traffic) cause CPU Utilization by any means?

Re: Does Policy blocking/deny huge traffic cause High CPU utilization

kiwi — Fri, 13 Oct 2017 07:30:32 GMT

Hi @sandeep.paul,

In short, yes it does.

It's far less CPU consuming to block the traffic before checking policy.

For example with zone-protection or dos-protection.

Cheers,

-Kiwi.

Re: Does Policy blocking/deny huge traffic cause High CPU utilization

sandeep.paul — Fri, 13 Oct 2017 16:16:11 GMT

Thanks Kiwi, is it documented anywhere. Please let me know if you have any link.

Re: Does Policy blocking/deny huge traffic cause High CPU utilization

sandeep.paul — Fri, 13 Oct 2017 16:17:38 GMT

You mean zone protection will not have traffic going through the policy?

Re: Does Policy blocking/deny huge traffic cause High CPU utilization

BPry — Sun, 15 Oct 2017 02:59:54 GMT

@sandeep.paul,

I'm not sure if it's directly documented everywhere. Just from a get go through the processing goes in different steps, so zone protection and DOS policies are monitored prior to the secuirty policies when you look at how the traffic is actually processed. The quicker you can have your firewall drop any traffic that would get denied the better from a processing standpoint.

If you have a large amount of traffic (lets say a DoS attack) that sits there and hammers a deny rule within your security policies, it would be much better from a processing standpoint to have that traffic get blocked by a DoS profile or a zone protection profile then actually making it to the security policy, as it has to process far fewer things in that scenario.

Re: Does Policy blocking/deny huge traffic cause High CPU utilization

Raido_Rattameister — Wed, 18 Oct 2017 02:21:36 GMT

FYI DoS mitigation in Zone Protection uses less resources than DoS Protection policy.

Re: Does Policy blocking/deny huge traffic cause High CPU utilization

sandeep.paul — Wed, 18 Oct 2017 09:47:48 GMT

Thanks Raido,

Let's say specific IP traffic to be mitigated through Zone protection, can we do it on PA?

Re: Does Policy blocking/deny huge traffic cause High CPU utilization

BPry — Wed, 18 Oct 2017 13:46:26 GMT

@sandeep.paul,

You can not specify IPs in Zone Protection, that would be a DoS policy configuration instead of Zone Protection policy.