Does Policy blocking/deny huge traffic cause High CPU utilization

[sandeep.paul]

I have a PAN 200 at sales office, I have temp deny policy in place as I saw huge traffic (Genetec Traffic) from/to a specific destination/source.

But I still see High CPU causing the Firewall to Reboot and which triggered Site Down Alerts( Downstream device lost connection).

Does the Deny Policy for huge traffic (Number of Packets or Size of traffic) cause CPU Utilization by any means?

[kiwi]

Hi @sandeep.paul,

In short, yes it does.

It's far less CPU consuming to block the traffic before checking policy. 

For example with zone-protection or dos-protection.

Cheers,

-Kiwi.

[sandeep.paul]

Thanks Kiwi, is it documented anywhere. Please let me know if you have any link.

[sandeep.paul]

You mean zone protection will not have traffic going through the policy?

[BPry]

@sandeep.paul,

I'm not sure if it's directly documented everywhere. Just from a get go through the processing goes in different steps, so zone protection and DOS policies are monitored prior to the secuirty policies when you look at how the traffic is actually processed. The quicker you can have your firewall drop any traffic that would get denied the better from a processing standpoint. 

If you have a large amount of traffic (lets say a DoS attack) that sits there and hammers a deny rule within your security policies, it would be much better from a processing standpoint to have that traffic get blocked by a DoS profile or a zone protection profile then actually making it to the security policy, as it has to process far fewer things in that scenario. 

[Raido_Rattameister]

FYI DoS mitigation in Zone Protection uses less resources than DoS Protection policy.

[sandeep.paul]

Thanks Raido,

Let's say specific IP traffic to be mitigated through Zone protection, can we do it on PA?

[BPry · Accepted solution]

@sandeep.paul,

You can not specify IPs in Zone Protection, that would be a DoS policy configuration instead of Zone Protection policy.