topic Re: PA-5050 8.1.11 Inter Vsys traffic in General Topics

PA-5050 8.1.11 Inter Vsys traffic

MarcelBolleboom — Wed, 22 Apr 2020 08:20:41 GMT

Hi all,

We got a Palo Alto 5050 active/passive HA configuration with two vsys with a lot of inter-vsys traffic.

Our DP1 is running at 100% during working hours.

I am convinced that the problem is that inter-vsys traffic can't be offloaded to hardware.

If i configure physical interface 1 and 2 to vsys1 (L3) and physical interface 3 and 4 to vsys 2 (L3), connect them with a physical cable, aggregate these two links (port-channel) and route inter-vsys traffic over that physical link. Would that be a good practice? Now traffic can be offloaded to HW.

Thank u for your feedback!

Re: PA-5050 8.1.11 Inter Vsys traffic

nextgenhappines — Wed, 22 Apr 2020 12:06:11 GMT

Hello @MarcelBolleboom ,

If your environment only have 2 vsys and it won't get any bigger. That is one way to resolve the inter-vsys performance issue.

Do you have a diagram that can help us understand the problem?

Have you able to identify the traffic pattern? Is there a specific zone/subnet in one vsys that all the systems from the other vsys need to access?

Re: PA-5050 8.1.11 Inter Vsys traffic

MarcelBolleboom — Wed, 22 Apr 2020 12:29:27 GMT

Hi,

Thank u for your reply.

All internet traffic from the LAN uses the inter-vsys connection (red) for internet. Best way to tackle this would be to consolidate the two vsys to one but that would be a large operation.

Re: PA-5050 8.1.11 Inter Vsys traffic

nextgenhappines — Wed, 22 Apr 2020 13:30:31 GMT

How is the inter-vsys connection currently setup? and the proposal fix look like?

Re: PA-5050 8.1.11 Inter Vsys traffic

MarcelBolleboom — Wed, 22 Apr 2020 14:00:47 GMT

Current: Direct inter vsys routing between two vsys on same physical device.

New: Using 4 interfaces (2 per vsys) and aggregate them to form a 2 Gbit link (UTP). SFP 10 Gbit interfaces are all in use. Traffic won't exceed 2 Gbit. Make it a L3 connection.

So, direct cables from one interface to another between two vsys on same physical device.

Re: PA-5050 8.1.11 Inter Vsys traffic

nextgenhappines — Wed, 22 Apr 2020 14:08:34 GMT

thanks! let's us know if the change helps!

Re: PA-5050 8.1.11 Inter Vsys traffic

MarcelBolleboom — Wed, 22 Apr 2020 14:17:47 GMT

i will