PA-220 Throughput Explanation

[MarioMarquez]

Can someone please tell me the maximum Upload/Download speed in megabits per second for a PA-220 with app-id and all threat prevention/ips features enabled along with an ipsec tunnel? The data sheet is a little confusing and I understand that it bases the specs from 64k packets but I don't know if this had 150 up 150 down or 50 up 50 down. Can someone tell me the the throughput I should expect in my use case mentioned above and explain yourself?

[Chacko42]

Hi @MarioMarquez,

it means, that the firewall can process 150 Mbps in total, with all of the ips/app-id features enabled.

If you got this setup, A -> Palo -> B and you configured the policy set with App-ID/Content-ID and you fire as many 64KB sessions through that setup, you will achieve at lease 150 Mbps of throughput,

In real life, you will have a higher troughput, because youre policy set is more differentiated and the less "any" statements you have there, the better the firewall will perform. E.G. opening a normal website results in lots of sessions to donwload pictures, css files and so on.

You can calculate with that values but can expect better performance in real life.

Best Regards

Chacko

[MarioMarquez]

thanks for the details.  I'm up in the air about getting a 100 down 100 up internet circuit for a site with a PA-220.  if 150 Mbps is the least i will achive that means the same thing as saying 75 down 75 up is the least the PA-220 will be able to handle.  Is that correct?  Do you think a 100 down 100 up circuit is too much for this PA-220?

[Chacko42 · Accepted solution]

Hi @MarioMarquez,

yes that's right.

Typically the existing capacities are never used to 100%.

Even a whole building with a few hundred people may be connected with 10G fibres, but the real consumption will be around I guess 20-50 mbit.

So having a PA-220 for a small site with 200mbit is fine, we have PA-220s installed with complete network segmentation between servers and clients and so on (with smaller sites of course) - never had a problem with throughput.

Best Regards

Chacko

[fjwcash]

---

@MarioMarquez wrote:

thanks for the details.  I'm up in the air about getting a 100 down 100 up internet circuit for a site with a PA-220.  if 150 Mbps is the least i will achive that means the same thing as saying 75 down 75 up is the least the PA-220 will be able to handle.  Is that correct?  Do you think a 100 down 100 up circuit is too much for this PA-220?

---

No, that is not correct.

The 150 Mbps is per direction.  Meaning it can handle 150 Mbps of downloads along with 150 Mbps of uploads simultaneously.  So a 100/100 connection will be fine for a PA-220.  Even a lowly PA-200 could handle a 100/100 connection.