High Packet Rate / Throughput

[nickcx1]

PA2020 4.1.14, 500 users. Recently we have added ~100 more users to our PA2020 and are seeing huge slow-downs for internet. Session stats show our device has a high packet rate and through put. We have been advised that~20,000 packet rate / 120 mb throughput are the limits and anything encroaching 80% of the limit will result in a slow down.

Device is up          : 1 day 14 hours 3 mins 38 sec

Packet rate           : 34580/s

Throughput            : 115023 Kbps

Total active sessions : 8801

Active TCP sessions   : 8644

Active UDP sessions   : 33

Active ICMP sessions  : 0

Any suggestions on how to further troubleshoot whether a specific user/rule is responsible or - grabs straws - ANYTHING else I can work through?

[JimS2]

Some things you can do to reduce the load on the Palo Alto and improve performance.

1) Reduce logging on certain security policies which pass trusted traffic (i.e. internal DNS, internal web server).  If you don't have rules specifically for that traffic create them and turn off the logging.

2) Create application overrides for trusted traffic (i.e. internal DNS, internal web server).  This will reduce the load on the content inspection engine.

3) Look for large amounts of small packets such as high ping rates from monitoring devices.

[stewart]

Also check to make sure log at session start is not checked.

Check the ACC tab and see what app has the most sessions then follow step 1 from JimS2.

[nickcx1]

Delayed reply..

Thanks for the suggestions. After having a PA engineer look at the device they concluded that the device was just not up to the job for us. The logging was minimal on policies but the sessions were just too high. We swapped out for the (much better) 3020s and the problem has gone.

Thanks again.

[MydisplayNameis3]

What CLI commands should we be using to manage/monitor the effect as we make these changes?