PA-5020 to 5220

Reply
L4 Transporter

PA-5020 to 5220

we are planning to upgrade ur existing PA-5020 to bigger boxes. our current 5020s are struggling to handle the ssl decryption and it sometimes give ''Dataplane CPU under severe load'' logs on busy days. I heard 5200 series are specfically designed for decryption . However I have 2 questions here:

1.What can be my best options? PA-5050,506,5220 or any other for atleast 8Gbps threat throughput and 40,000 SSL sessions?

2.PA-5220 seems to be so different from 5000 series and it makes me nervous about migration. People talk about HA3,AUX ports etc which I never dealt with on 5000 series.I have dedicated HA1 and HA2 and backup pair on dataplane,how is this going to change for 5220? and can I just use the 10G ethernet ports for my neighbouring 1G switches/routers with no issues?

 

thanks.

L7 Applicator

Re: PA-5020 to 5220

@SThatipelly,

1) I wouldn't recommend anyone go with a 5000 series device at this point, go with the 5200 series as they are all around better and cheaper boxes than the 5000 series ever was. 

2) Really not that massively different and the HA link changes are easy to work around. You can still mimic your setup as you have it currently, you'll just be using different named interfaces is all. 

3) The available ethernet ports can be used for 1G without issue. 

L4 Transporter

Re: PA-5020 to 5220

@BPry thank you so much for your response.

I see there are couple of HA ports, can I use them as HA1 and HA2? or If I understand it correctly, they are both HA1 and HA1 backup and I need to configure 2 data plane ports as HA2 and HA2 backup. am i correct?

Highlighted
L7 Applicator

Re: PA-5020 to 5220

@SThatipelly,

The two HA ports are dedicated to HA1 as you understood, or you could utilize the 2 AUX ports for HA1 but they are non-dedicated interfaces. The HA2 ports will utilize the HSCI port if you want to utilize the dedicated interface, or you could utilize any of the other ports when configured as an HA port as a non-dedicated solution as well. 

 

It sounds drastically more complicated then it really is. 

L6 Presenter

Re: PA-5020 to 5220

Not only are the 5200 series cheaper, their hardware internals is completely different from the 5000 series (in a good way.)  Especially in the area of SSL decryption you'll see less of a performance hit on the 5200 series than the 5000k.

L4 Transporter

Re: PA-5020 to 5220

@Brandon_Wertz@BPry thank you both for your valuable responses. I think I'm going with either 5220 or 5250 at this point.

L4 Transporter

Re: PA-5020 to 5220

@Brandon_Wertz@BPry by any chance, ddo you guys know if the default 240GB disk space that palo gives on PA-5220 is expandable? I mean I see back panel description saying we can expand traffic logs for 2TB using hdds. My organisation wants to have extra storage. can I go ahead with buying those hdds? if so, is there any subscription fee for that?

https://docs.paloaltonetworks.com/hardware/pa-5200-hardware-reference/pa-5200-series-firewall-overvi...

 

thanks.

L7 Applicator

Re: PA-5020 to 5220

@SThatipelly,

I believe that the hardware/software actually only supports up-to  2 TB drives, so you are already getting the biggest drives that the system will likely actually accept. If you look at the M-500 or M-100 appliances (something where changing drives is actually supported) it only supports drive capacity of 1 TB or 2 TB drives. I'm fairly certain however that switching the drives in the PA-5220 isn't actually supported?

The 'official' recommendation would be deploying a Panorama appliance or VM and putting it in log collector mode; or you could simply setup log forwarding and send the logs to a syslog server and up to storage on that when needed/wanted. 

 

L4 Transporter

Re: PA-5020 to 5220

@BPry I have log forwarding to syslog servers. But we are very impressed with palo alto reports and would like to expand the retention periods of logs on the firewall. we donot have panorama yet. If I understand it correctly, I can't upgrade the log storage on the firewall beyond the default memeory that palo gives us. am I correct?

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!