topic Port/Bandwidth Usage and Overhead in General Topics

Port/Bandwidth Usage and Overhead

derekgriffin2019 — Mon, 04 Mar 2019 17:31:18 GMT

We have a few firewalls and we are using Wildfire, Threat protection, routing and other features on the firewall. Our question is with all these features turned on will this affect the port traffic flow. We are looking for a scale or formula that we can refer to regarding these features and best practices for the configuration on our devices.

Re: Port/Bandwidth Usage and Overhead

jeremy.larsen — Mon, 04 Mar 2019 17:51:10 GMT

Have you looked at the product-selection page where you can compare firewalls?

https://www.paloaltonetworks.com/products/product-selection

This will show you expected throughput for each enabled feature. ie -

PA-5220

App-ID firewall throughput20 Gbps

Threat prevention throughput9 Gbps

Connections per second150,000

Max sessions (IPv4 or IPv6)4,000,000

Re: Port/Bandwidth Usage and Overhead

derekgriffin2019 — Mon, 04 Mar 2019 18:12:16 GMT

I see what the throughput is but if it is a 10G port and I have routing, Wildfire, Threat Protection etc with that oiverhead, i assume the port will not be pushing 10G through the port.

What is the throughput after these feature being turned on.

Re: Port/Bandwidth Usage and Overhead

jeremy.larsen — Mon, 04 Mar 2019 18:17:13 GMT

It's listed on the right hand side of the model. In my example, you will only get an average throughput of 9Gbs on the 5220 with Threat Protection turned on. Basically, look for the lowest number (Threat Protection) and this will be a pretty good gauge of expected throughput.

Re: Port/Bandwidth Usage and Overhead

Brandon_Wertz — Mon, 04 Mar 2019 18:55:51 GMT

The true answer to your question is, "it depends."

Realworld numbers will vary by all the various features and traffic scenarios. IPSec / SSL decrypt are big things which will significantly impact expected throughput as well as over all sessions per second with associated packet size. Each hardware type will have it's own variances.

In general though start off with the published numbers. Then you can hone in on exactly which hardware type is right for your environment.

Re: Port/Bandwidth Usage and Overhead

derekgriffin2019 — Tue, 05 Mar 2019 14:12:40 GMT

Thank you Brandon,

That is exactly what i am talking about. I undeestand the Threat protection and Wildfire but when it comes to routing and other features to the firewall how can I tell other than third party tools which will tell me such notes. I would assume palo alto would have some sort of documentation for this.

Re: Port/Bandwidth Usage and Overhead

Brandon_Wertz — Tue, 05 Mar 2019 16:51:38 GMT

@derekgriffin2019 wrote:
Thank you Brandon,

That is exactly what i am talking about. I undeestand the Threat protection and Wildfire but when it comes to routing and other features to the firewall how can I tell other than third party tools which will tell me such notes. I would assume palo alto would have some sort of documentation for this.

"Routing" won't necessarily impact throughput. "Interzone" routing of particular traffic types can impact throughput. You won't get the real numbers without a NDA from Palo, which your account team can get setup with your company.