04-03-2012 07:37 AM
We recently upgraded our PA-4020s from 4.0.9 to 4.1.4 a few weeks ago. However, since the upgrade, we have noticed a 20-25% increase in our data plane CPU. We usually averaged around 40% during business hours, but lately it has increased to 60-65%. We have not made any major changes to the configuration. Palo Alto support has informed us that this is normal due to the large increase of code in 4.1 and that other customers have reported the same. Has anyone else experienced or noticed this increase? Thanks in advance.
04-03-2012 11:54 AM
I cant answer your question but an increase in dataplane as long as it doesnt hit 100% is no problem since the dataplane is asic/fpga based (depending on model).
But on the other hand I understand your worry regarding how much traffic the box can deal with. Another thread in here, approx 3 months old, did some tests regarding performance and noticed that the dataplane utilization isnt really 1:1 to performance - it seems that the more traffic you push to it the more it will be able to handle. For example if 50% was with 50.000 sessions then 75% was with 150.000 sessions or something like that (not exact figures, just an example).
Edit: Here is the thread I was thinking of:
Perfomance on PA 4060 - Huge Disappointment
https://live.paloaltonetworks.com/message/11714#11714
And the figures were 38% dataplane with 149.000 concurrent sessions, 50% dataplane with 220.000 concurrent sessions.
One might then think that "Ohh crap... this box isnt near the 2M concurrent sessions that the datasheet claims - more like 0.5M top".
However the user returned and observed 78% dataplane with 600.000 concurrent sessions.
04-03-2012 12:03 PM
Thank you for the additional information. Do you know if the utilization correlation not being 1:1 was something that was introduced with the 4.1 code? I believe it used to be a 1:1 correlation in past versions.
04-05-2012 03:01 AM
Hi
Just to add to this we've got a 2050 running 4.1.4 and over the last couple of weeks the dataplane has been hitting 100% and recently we've had about 4 outages over the last week with the dataplane resetting itself.
I've reverted back to 4.1 which seems stable.
Rod
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
