topic Re: Does Active-Active HA supports more users? in General Topics

Does Active-Active HA supports more users?

Satyam — Thu, 15 Jul 2021 14:39:17 GMT

Hi Guys,

My company bought a PA firewall a few months back. At that time we had around 85 users and PA technical person suggested that it will handle up to 100 users in our environment. Now, we have around 70 more people who joined our company, so total employees will be around 160. Now I have few questions -

1) If we buy one more firewall (same model) and use it in Active-Active HA mode, will it be able to handle the extra employees we have now? Meaning, (one firewall can handle 100 users), if we have two firewalls, will 200 users will be able to work?

2) Will the VPN users connecting to the firewall will also increase after adding the second firewall?

Re: Does Active-Active HA supports more users?

BPry — Fri, 16 Jul 2021 02:27:12 GMT

@Satyam,

That's not the purpose of an active-active deployment with PAN at all, unlike say old Cisco ASA deployments. While Active-Active deployments do allow you to process more traffic it's like a 20-30% increase. Active-Active is really designed around asymmetric routing deployments and not clustering.

Secondly, did your company already install the new firewall or not? It's not entirely clear from your post if the new firewall is even installed or not, but if it is is it showing any signs of stress as-is? It's pretty easy to tell firewall utilization if it's already installed and processing the traffic, and I would recommend going off of the firewall and not some arbitrary user number that doesn't actually mean anything.

Third, sizing of a firewall isn't user dependent it's traffic dependent. A PA-220 could support thousands of users if they weren't processing much traffic. Sounds like whoever sized the original firewall really didn't leave any room for company growth if they were estimating you were already that close to maxing the selected models performance capabilities which was a pretty big mistake.

Re: Does Active-Active HA supports more users?

jdelio — Fri, 16 Jul 2021 14:17:51 GMT

I agree with @BPry , HA doesn't really increase capability.

Also, what hardware are we dealing with right now? and how much traffic are you having to handle?

Are you decrypting? using GlobalProtect for remote access? etc? All of these things can matter in a deployment, and the number of users you are trying to support.