topic Re: 5260 Experience in General Topics

5260 Experience

Brandon_Wertz — Fri, 12 Apr 2019 17:33:42 GMT

Looking for some realworld deployment experience. Anyone that's deployed a 5260 how much data have you guys pushed through it. Anyone pushing 20-30Gbps+? How does it perform?

I'm thinking about getting one and putting it off our tapping infrastructure for IPS/IDS functionality.

Re: 5260 Experience

Remo — Fri, 12 Apr 2019 18:39:33 GMT

So far we are still in a migration project, so right now our 5260s are still totally bored with peaks of about 5 Gbit 😛

Re: 5260 Experience

Brandon_Wertz — Mon, 22 Apr 2019 18:28:16 GMT

I ended up requesting a 5260 for a PoC which I'll hopefully get deployed this week. Soon after I'll put at least 30GB of traffic so I'll update here after it gets up and running.

Re: 5260 Experience

BPry — Tue, 23 Apr 2019 02:47:38 GMT

@Brandon_Wertz,

The pair I support have pushed just pass 15Gb/s without issue with a mix of non-decrypted and decrypted traffic utilizing full Threat Prevention without issue. If you're looking to push more than 30Gb/s you'll be maxing threat prevention capabilities on the box.

Re: 5260 Experience

Brandon_Wertz — Tue, 23 Apr 2019 03:06:32 GMT

Oh I'm attempting to "melt" the box. I know the spec sheet says 28-33G of "threat" throughput. I've got a unique use case though and really only need these boxes to do threat. (No SSL or ipsec)

Re: 5260 Experience

Brandon_Wertz — Fri, 26 Apr 2019 14:57:07 GMT

So far this box is a beast...Sending about 20Gb/s with around 280k session/s and it's only at 12% dataplane.

Re: 5260 Experience

Brandon_Wertz — Fri, 26 Apr 2019 18:48:49 GMT

We're up to 720k sessions/s and DP CPU is still at 14%. I'm really impressed with the capacity of the box

Re: 5260 Experience

Brandon_Wertz — Mon, 29 Apr 2019 12:55:56 GMT

So here's what I was trying to do and what I eventually deployed. I've got a fairly extensive tapping infrastructure at my company, which is aggregated into 8 x 40G links into an Gigamon HD4. These links are essentially the summation of "core / UCS" traffic.

I then took 6 x 10G ports from the HD4 and connected them to the 5260 and configured these in "tap mode" on the 5260. I know there's going to be some discrepancy is jumping down from 40G to 10G, but unfortunately I didn't have any 40G available on the HD4 so I had to compromise. Evenso the 5260 seems to be taking the traffic just fine. I'm not sure how it would perform in an inline deployment, but this box definitely has the legs to take considerable amounts of throughput.

Re: 5260 Experience

licenselu — Mon, 29 Apr 2019 17:44:13 GMT

Hi,

Nerver tested a PA 5260 but tested a PA5250.

Be carefull if you enaled VSYS !

Inter VSYS traffic was limited to 3,5 Gbps on PA 5250...

Regards,

Re: 5260 Experience

Brandon_Wertz — Mon, 29 Apr 2019 18:57:52 GMT

@licenselu wrote:
Hi,

Nerver tested a PA 5260 but tested a PA5250.
Be carefull if you enaled VSYS !
Inter VSYS traffic was limited to 3,5 Gbps on PA 5250...

Regards,

HA

That's something great to point out. I will say though that a 5260 has substainitally more capacity than a 5250. It's possible the 5260 has a greater capacity.

And for clarification you're referring to enabling "multi-vsys," right? Because "VSYS" is already enabled by default (VSYS1).

Re: 5260 Experience

Remo — Mon, 29 Apr 2019 19:27:25 GMT

Hi @licenselu

This is a known limitation of PaloAlto firewalls. If you do inter-vsys routing then everything is done in software. The only way to get the full performance of the box is if you "think outside of the box": the traffic needs to go out of the firewall and come back over a switch/router to another interface of the next vsys.