How do you verify the threat prevention throughput?

[HartkentlyNua]

hello,

I would like to seek your help in determining the exact threat prevention through of a specific deployed PA machine.

I've been going around the forum and checking tech guides but i couldn't find one.

This for the reason of right sizing and to verify if a machine deployed could still be able to handle the network traffic.

Or if you have any suggestion on this, that would help us a lot.

Thank you very much!

Regards,

Hartkently

[HULK]

You may get related information from mentioned link: Product Selection

Thanks

[HartkentlyNua]

Hi,

Thank you for that information. but that is not exactly what we're looking for, but thank you for giving this info.

What i meant is the actual running threat prevention that is being consumed by a network on a PA device.

Is there a CLI Command for this? or a way to somehow verify its data.

Sorry for the misleading information.

Thank you.

regards,

Hartkently

[HULK]

Hello Hartkently,

You could check the current throughput of the PAN firewall with below mentioned CLI command:

> show system statistics session   >>>>>>>>>>>>>>>>>>>> It will show you the current session statistics ( throughput)

Device is up          : 6 days 5 hours 5 mins 25 sec

Packet rate           : 52/s

Throughput            : 302 Kbps >>>>>>>>>>>> Runtime value

Total active sessions : 5

Active TCP sessions   : 0

Active UDP sessions   : 5

Active ICMP sessions  : 0

Let me know,if  this is what you are looking for.

Thanks

[dreputi]

Hello Hartkently,

There is no direct command to show the threat prevention throughput because it is basically just throughput of the device with some default profiles like AV, anti-spyware, vulnerability protection etc. This value has already been calculated and published at Product Selection

It is best to see the throughput of the device itself with the command "show system statistics session" which tells the current throughput value under operating conditions with your configuration subject to the amount of traffic going through firewall at that moment.

To improve performance you may disable DSRI or Disable Server Response Inspection. With DSRI turned on, server response traffic is not inspected, which will increase the throughput capacity. Obviously, enabling this feature is only recommended for trusted servers. References:

Threat Prevention Deployment Tech Note

Threat Prevention Throughput

Let us know if you have any questions.

Regards,

Dileep