Performance issues over internet speed from firewall

[CredAvenue]

We have PA-220 box installed fresh, at from the start itself the box reaching 30 to 40K session and the MP/DP plane hitting above 40-60%. the users are facing drops in network over g meet (especially the most) and other video conference applications saying poor network inbetween calls and when checking the firewall with any rule still the issue appears and when some user the using full bandwidth of isp i also face a slow or random packet drop in between. anybody suggest where to look and what to do???

Regards

SM

[TomYoung]

Hi @CredAvenue ,

What PAN-OS version are you running?  There is a known bug that PA-220 firewalls experience slower web interface and CLI performance times with 10.0 and 10.1.

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-release-notes/pan-os-10-0-release-information/k...

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-release-notes/pan-os-10-1-6-known-and-addressed...

I have never seen it impact the data plane on my PA-220.  My PA-220 runs hot (sometimes 100%) on the MP but cool on the DP, but I don't have 30-40K sessions.  The max sessions for the PA-220 is 64K.  Strange that I don't see the bug for 10.2.  Does that mean that it is fixed?

Here are some good articles for troubleshooting high CPU.  I would fix the DP 1st.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRTCA0

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSvCAK

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CleLCAS

Finally, Monitor > App Scope > Network Monitor can be very useful for viewing traffic load and quickly identifying excessive applications.  Removing Security Profiles from the rule or using Application Override may decrease load for heavy but "safe" applications such as backups to/from your backup server.

Thanks,

Tom

Edit:  I upgraded my PA-220 to 10.2 and it was slower.  I downgraded it back to 10.1.

[CredAvenue]

Hi Tom

PAN OS version we are using 10.0.10 and the packets dropping issue is still persists...

Regards

Sridhar Mohan

[OtakarKlier]

Hello,

I hate to say it but you might be exceeding the hardware on that little device :(. 

https://www.paloaltonetworks.com/products/product-comparison?chosen=pa-220,pa-820,pa-450

You could try tuning it and or turning off features.

Netflow is one that eats up a lot so does decryption. However you are losing visibility when you do :(.

Regards,

[CredAvenue]

Yes team

The PA-220 does not match our performance needs...