PA-200 configuration for low bandwidth site

[rmilman]

Hi there,

We have a PA-200 recently deployed at a low bandwidth field site. Monitoring the traffic shows the majority of traffic is from the PA-200 itself, checking for updates, Panorama, Wildfire, etc. Is there a way to configure a PA-200 to only perform this on a scheduled basis? Right now it's transferring about 400Mb per day, which puts it way out at the top of all the traffic reports. I'd really like to quieten it down a lot.

Thanks,

Rob

[bat]

Hi rmilman

You can schedule Dynamic updates through WebGUI by going to Device > Dynamic Updates.

Also the following documents can be helpful:

How to Determine the Update Schedule for Licensed Features

Tips for Managing Content Updates

Thanks

[HULK]

Hello rmilman,

Could you please let us know if you have configured any schedule for Wildfire and antivirus. Because, these 2 feature are having the option to get updates every 1 Hr.

First, if you have configured a file blocking profile with action "forward" ( send to wildfire), the suspicious file will be sent to the cloud for analysis, it will take enough bandwidth on your PAN firewall. Secondly, if you are using URL filtering profiles on a security policy and the destination URL's are not available on the Local-DB, the PAN firewall will send the query every time to the Cloud-DB.

Hope this will helps.

Thnaks

[hshah]

Hi Rmilman,

PANW firewall will contact wildfire whenever you exchange file across firewall. If file is unknown to wildfire than communication is bigger, if its known than small. You shouldnt disable this behavior else its a security hole.

Now, You can schedule other content updates like antivirus, threat and application. You can schedule them weekly or daily basis depending upon requirement. Do it for night 3:00 AM when traffic is minimum. Follow bellow instructions for the same.

Regards,

Hardik Shah

[HULK]

Since your primary requirement is to reduce the bandwidth utilization, i would suggest you to schedule it once in a week (preferably on Sunday/ non-business hours)

Thanks

[mivaldi]

Mind that the firewall updates are protecting your network, so I would think that is actually... a good thing.

If you are concerned about saturation, you should explore QoS, and give the Palo Alto Networks firewall updates traffic lesser priority.

See QoS in PAN-OS 4.1

Having that said, I would advise against expanding the update schedule, and in favor of correctly prioritizing your traffic.

Best regards,

Mariano Ivaldi