topic Aggregated Ethernet interfaces - recommended maximum number of sub-interfaces in General Topics

Aggregated Ethernet interfaces - recommended maximum number of sub-interfaces

JulianH — Tue, 01 Jun 2021 09:06:42 GMT

I'm just after a bit of advice.

PA3220 - I have configured an aggregated interface and configured a number of sub-interfaces below this for each individual client - is there a maximum recommended number of sub-interfaces that can be configured below the aggregated interface? I am concerned I have over 20 at the moment and I don't want to hinder the PA performance in any way.

Thanks in advance

Jules

Re: Aggregated Ethernet interfaces - recommended maximum number of sub-interfaces

Remo — Tue, 01 Jun 2021 10:50:10 GMT

Hi @JulianH

There is no recommended maximum for subinterfaces. There are only the specification max numbers for interfaces and subinterfaces which are the following for a PA-3220:

802.1q tags per device	4,094
802.1q tags per physical interface	4,094
Max interfaces (logical and physical)	4,096

As these interfaces are used in PAN-OS to decide where to forward traffic and this is all done in hardware you will not see a performance impact even if you go way above your currently 20 subinterfaces. I personally did not use the interfaces until the specified max so far but at least with more than hundret subinterfaces the firewall forwards the traffic as if there would be only one or two interfaces.

Hope this helps,

Remo

Re: Aggregated Ethernet interfaces - recommended maximum number of sub-interfaces

aleksandar.astardzhiev — Tue, 01 Jun 2021 17:23:53 GMT

Hi @JulianH,

Fully aggree with @Remo. I will only add the possibility to reach the maximum capacity if the aggregated interface.

You may want to consider QoS with separate profile for each sub-interface. Unfortunately here you have limit for of 32 different profiles for each sub-interface. Which means if you plan to go with applying QoS (which probably is good idea to limit the posibility one client to consume most of the interface capacity) you will be limited to 32 sub-interfaces.

Re: Aggregated Ethernet interfaces - recommended maximum number of sub-interfaces

OtakarKlier — Wed, 02 Jun 2021 15:58:30 GMT

Hello,

Another thing to consider is that the other technologies involved. In Hyper-V for example, you are limited to 32 vlans per interface group.

Regards,

Re: Aggregated Ethernet interfaces - recommended maximum number of sub-interfaces

JulianH — Thu, 03 Jun 2021 07:55:42 GMT

Thanks all for the responses - much appreciated