PA200 sizing

[errevisystem]

Hi all,

would a PA200 fit in such scenario?

lan users: 70-100

wan connectivity: 10Mbps

(so basically 2-zone traffic)

Threat prevention: yes (inbound and outbound traffic)

URL filtering: yes for all users

VPN tunneling: yes (remote access only for few users)

Though being the smallest of its breed, according to data sheets this unit is fairly sized for this conditions, my only concern is regarding 1.000/s limit for new sessions.

What if we have low traffic, in terms of bandwidth, but spread in many short sessions? Think about p2p and all that sort of things that sometimes you don't neither block nor can't predict in advance.

For such reasons, when having to face such scenarios, we often chose to cut short proposing the big brother PA500 to customers, but that's not always feasible.

Thank You

Manuel

[jvalentine]

You're correct, from a datasheet perspective the PA200 might be able to meet these requirements.  My general rule of thumb has been:

1-40 users = PA200

40-80 users = PA500

(Assuming the bandwidth, # of zones/rules/interfaces all meet the requirements as well). 

Keep in mind that the PA500 supports active/passive high-availability with session synchronization, where the PA200 does a/p HA without session sync. 

There's nothing in the PA200 that will prevent you from using it in a 70 user environment, but I would recommend having your customer evaluate a PA200 in their network before purchasing.  For me, 70-100 users with 10Mbps gets a solid PA500 recommendation.

[ukhapre]

PA-200 does not seem like a good fit.

http://media.paloaltonetworks.com/documents/Summary_Specsheet-Nov12.pdf

Here is another thread with similar discussion

https://live.paloaltonetworks.com/message/10952#10952

[panos]

I configured pa200 to similar places with 20mbit WAN no problem occured.

Traffic's packet transaction size is also important.This can change the behaviour.Also physical interface number and HA is limited with pa200.

[_slv_]

In my environment 150 AD users and some WiFi users with 10 security zones, 15 subinterfaces PA 200 is good enought.

Known limitation (from life - not technotes ):

- don't even think about SSL decryption - PA200 hasnt dedicated ASICs - its has everything virtualized

- P2P I have blocked on all zones

- upload from trust to untrust is limited to 50Mbit (when you use thread prevention - but who don't use it?) with QoS enabled.

But it depends how many session could generate users, one user could use 100 session, another one more than 1000 ...

Regards

SLawek