Question to traffic processing (PA-3020)

MPI-AE — Thu, 14 Feb 2019 10:23:30 GMT

Hey guys,

Can someone tell me how exactly the Palo Alto firewalls, especially the PA-3020, process traffic?

Is that done via Software/CPU or via hardware?

I mean, if it's done via Software, the palo alto firewalls are just workstations with a linux os and network cards, aren't they?

Sometimes I observe that the latency in the network rises. That is when large files are copied to the fileserver with 1Gbit/s. (That's the speed of the interfaces of the Palo Alto, full speed so to say). That traffic is routed over the pa-3020 (8.0.7) since there are different vlans. (client in another vlan than the fileserver). Besides, the management and data plane cpu utilization rise, too.

Re: Question to traffic processing (PA-3020)

BPry — Fri, 15 Feb 2019 04:07:21 GMT

@MPI-AE,

Packet Flow is heavily documented, an example would be this knowledgebase article HERE. As for the device question, like most other networking hardware, the box is effectively a highly customized Linux installation with specific hardware to help accomplish high data rates.

If you haven't done so already options to speed up SMB traffic processing would be to disable DSRI or utilize an application-override policy to disable layer7 inspection and app-id to your file servers.

topic Re: Question to traffic processing (PA-3020) in General Topics

Question to traffic processing (PA-3020)

Re: Question to traffic processing (PA-3020)