topic Re: Blocking vs. logging throughput in General Topics

Blocking vs. logging throughput

JonIsaacson — Wed, 06 Nov 2019 17:57:45 GMT

If I have a security policy applied to all my zones which includes profiles for everything (AV, spyware, vulnerability protection, etc.) but the actions are all just logging or alerting and not blocking, would that affect my throughput? I was wondering if I could run all of these services and still get the box's max throughput if I'm not blocking anything, or if these will still impact throughput capacity and they should be disabled in zones where they're not needed.

Re: Blocking vs. logging throughput

Remo — Wed, 06 Nov 2019 18:44:09 GMT

Hi @JonIsaacson

As soon as you configure any profile (url filtering / vulnerability protection / ...) even only for logging this affects the throughput and you will no longer reach the box max. throughput which is only with app-id enabled and not more.

Re: Blocking vs. logging throughput

JonIsaacson — Wed, 06 Nov 2019 19:00:40 GMT

Is this true for the whole box, even for zones/interfaces the rules aren't applied on?

For example, if all these rules are applied on traffic coming in and out from the internet, the max throughput capacity of two trusted internal interfaces with a simple rule in between zones would be reduced?

Re: Blocking vs. logging throughput

OtakarKlier — Thu, 07 Nov 2019 17:15:12 GMT

Hello,

It'll take a bit of overhead from the PAN's CPU and maybe a bit of throughput, but its negligible because you are protecting your network! I find it best practice to block anything medium and higher and only log the lower two.

Regards,