PA-5020 to 5220

[SThatipelly]

we are planning to upgrade ur existing PA-5020 to bigger boxes. our current 5020s are struggling to handle the ssl decryption and it sometimes give ''Dataplane CPU under severe load'' logs on busy days. I heard 5200 series are specfically designed for decryption . However I have 2 questions here:

1.What can be my best options? PA-5050,506,5220 or any other for atleast 8Gbps threat throughput and 40,000 SSL sessions?

2.PA-5220 seems to be so different from 5000 series and it makes me nervous about migration. People talk about HA3,AUX ports etc which I never dealt with on 5000 series.I have dedicated HA1 and HA2 and backup pair on dataplane,how is this going to change for 5220? and can I just use the 10G ethernet ports for my neighbouring 1G switches/routers with no issues?

thanks.

[BPry · Accepted solution]

@SThatipelly,

1) I wouldn't recommend anyone go with a 5000 series device at this point, go with the 5200 series as they are all around better and cheaper boxes than the 5000 series ever was. 

2) Really not that massively different and the HA link changes are easy to work around. You can still mimic your setup as you have it currently, you'll just be using different named interfaces is all. 

3) The available ethernet ports can be used for 1G without issue. 

[SThatipelly]

@BPry thank you so much for your response.

I see there are couple of HA ports, can I use them as HA1 and HA2? or If I understand it correctly, they are both HA1 and HA1 backup and I need to configure 2 data plane ports as HA2 and HA2 backup. am i correct?

[BPry]

@SThatipelly,

The two HA ports are dedicated to HA1 as you understood, or you could utilize the 2 AUX ports for HA1 but they are non-dedicated interfaces. The HA2 ports will utilize the HSCI port if you want to utilize the dedicated interface, or you could utilize any of the other ports when configured as an HA port as a non-dedicated solution as well. 

It sounds drastically more complicated then it really is. 

[Brandon_Wertz]

Not only are the 5200 series cheaper, their hardware internals is completely different from the 5000 series (in a good way.)  Especially in the area of SSL decryption you'll see less of a performance hit on the 5200 series than the 5000k.

[SThatipelly]

@Brandon_Wertz@BPry thank you both for your valuable responses. I think I'm going with either 5220 or 5250 at this point.

[SThatipelly]

@Brandon_Wertz@BPry by any chance, ddo you guys know if the default 240GB disk space that palo gives on PA-5220 is expandable? I mean I see back panel description saying we can expand traffic logs for 2TB using hdds. My organisation wants to have extra storage. can I go ahead with buying those hdds? if so, is there any subscription fee for that?

https://docs.paloaltonetworks.com/hardware/pa-5200-hardware-reference/pa-5200-series-firewall-overvi...

thanks.

[BPry]

@SThatipelly,

I believe that the hardware/software actually only supports up-to  2 TB drives, so you are already getting the biggest drives that the system will likely actually accept. If you look at the M-500 or M-100 appliances (something where changing drives is actually supported) it only supports drive capacity of 1 TB or 2 TB drives. I'm fairly certain however that switching the drives in the PA-5220 isn't actually supported?

The 'official' recommendation would be deploying a Panorama appliance or VM and putting it in log collector mode; or you could simply setup log forwarding and send the logs to a syslog server and up to storage on that when needed/wanted. 

[SThatipelly]

@BPry I have log forwarding to syslog servers. But we are very impressed with palo alto reports and would like to expand the retention periods of logs on the firewall. we donot have panorama yet. If I understand it correctly, I can't upgrade the log storage on the firewall beyond the default memeory that palo gives us. am I correct?

[YazarArafath]

Hi Brother, I have to Migrate PA from 5050 to 5220 for data center firewall. We are using ASA for Internet.In PA data center firewall we have 2 vsys 1 for internal another for DMZ. Now the planis DC firewall we are migrating to 5220 afterthat ASA replaced by old 5050 Firewalls. Task is we have to add 1 vsys in DC Firewall DMZ vsys in Internet firewall. My plan is first migrte DC to New firewalls which is integrated with Panorama later old firewall make it factory reset then migrate as per asa configuration then delete DMZ VSYS and configure to Internet firewalls. Kindly suggest best practice as per this requirement.