Performance capabilities of Palo Alto 3000 Series Firewalls

[MarkTan]

Hello,

We are currently building out our network infrastructure for a new office and have a question regarding the capabilities of the PA 3000 series firewalls. We want to use to be able to use two PA in high availability mode (active-passive) to do our routing, DHCP for different vlans, antivirus filtering, web filtering, vpn, potentially vlans, and active directory integration for the entire office. We will be implementing about 7 vlans (4 of them requiring DHCP); routing for an office of about 100 employees; internet connectivity for PCs, projectors, smart tvs, etc.; antivirus and other security features of the palo alto; ssl vpn; active directory integration for captive portal; and other items. Can anyone provide some insight on whether two PA 3000 firewalls will be able to handle this load?

Also, if anyone has any ideas on the proper method to perform DHCP on 4 vlans via subinterfaces, that would be great. I assume that I define the layer 3 interface, create the subinterfaces with the proper tagged vlan, and then set up the DHCP pool tied to that specific subinterface?

Thanks,

Mark

[tasonibare]

Mark,

The PA-3000 firewalls will efficiently handle your described office requirements.

I can unicast you information on the capacities of the PA 3000 if you like, but your SE would be a great resource for this information as well.

Also for DHCP, your method will work just fine, having DHCP pools on each configured sub-interface.

Regards,

tasonibare

[mikand]

Does the builtin DHCP in PA support logging of option82 information?

Because then the log in PA would be complete with information on where the client is physically connected to the network (given that you in your access-switches also use ip-source verify and such to block spoofing clients).