I have this really weird issue and I don't know how to solve it. I noticed it when I first migrating from Checkpoint over to PaloAlto while doing verification in my Development environment.
- A PAN 5050 running 8.1.15 hotfix 3. I have a CentOS host (LinuxB) behind the PAN and another CentOS host (LinuxA) outside the PAN. FW rule is any any allow between these two host and the rule is at the top of the rulebase and nothing else. The PAN firewall is managed by Panorama, The interface on the PAN is VLAN tagging on a single physical interface,
- I do a 100 ping from LinuxA to LinuxB, the average RTT is 1.4ms. The Linux machines and PAN are connected to the same L2 Cisco 3750 switch. My background prior to PAN is Cisco so I am very familiar with Cisco products.
- I took out the PAN firewall and put in either a Cisco ASA or IOS router, using the same cable and switchport that I use on the PAN firewall. When I do 100 ping from LinuxA to LinuxB, the average RTT is 0.9ms, almost a 50% improvement in latency.
I go back and check the latency in my production environment regarding ping (we use open source smokeping tool to monitor our network/firewall devices) before the cutover from Checkpoint to PAN and I also notice the same thing.
I want to upgrade the PAN 5050 to 8.1.17 and test again; unfortunately, we ran out of support on the device so I could no longer download 8.1.17 for the 5050 but I don't think it would have made any differences.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!