Performance capabilities of Palo Alto 3000 Series Firewalls

Reply
Highlighted
L2 Linker

Performance capabilities of Palo Alto 3000 Series Firewalls

Hello,

We are currently building out our network infrastructure for a new office and have a question regarding the capabilities of the PA 3000 series firewalls. We want to use to be able to use two PA in high availability mode (active-passive) to do our routing, DHCP for different vlans, antivirus filtering, web filtering, vpn, potentially vlans, and active directory integration for the entire office. We will be implementing about 7 vlans (4 of them requiring DHCP); routing for an office of about 100 employees; internet connectivity for PCs, projectors, smart tvs, etc.; antivirus and other security features of the palo alto; ssl vpn; active directory integration for captive portal; and other items. Can anyone provide some insight on whether two PA 3000 firewalls will be able to handle this load?

Also, if anyone has any ideas on the proper method to perform DHCP on 4 vlans via subinterfaces, that would be great. I assume that I define the layer 3 interface, create the subinterfaces with the proper tagged vlan, and then set up the DHCP pool tied to that specific subinterface?

Thanks,

Mark

Tags (3)
Highlighted
L3 Networker

Re: Performance capabilities of Palo Alto 3000 Series Firewalls

Mark,

The PA-3000 firewalls will efficiently handle your described office requirements.

I can unicast you information on the capacities of the PA 3000 if you like, but your SE would be a great resource for this information as well.

Also for DHCP, your method will work just fine, having DHCP pools on each configured sub-interface.

Regards,

tasonibare

Highlighted
L6 Presenter

Re: Performance capabilities of Palo Alto 3000 Series Firewalls

Does the builtin DHCP in PA support logging of option82 information?

Because then the log in PA would be complete with information on where the client is physically connected to the network (given that you in your access-switches also use ip-source verify and such to block spoofing clients).

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!