sizing firewall

[simsim]

Hi,

I am looking for a firewall  for 3000 users, 

and 500  vdi  access 

expecting approximately igb  internet traffic 

Please help to size,

Ho much throughput I needed 

Thanks 

[reaper]

if you're a partner you can use 'popsicle' from the NextWave portal https://www.paloaltonetworks.com/partners/nextwave-partner-portal/cyberforce/cyberforce-members-only

to get a decent sizing you'll need to estimate how much ipsec, app-id and ssl throughput you will expect, and then guesstimate how much l7 scanning you're going to apply

ie.

1gbps app-ID sizes to pa-820,

1gbps threat-ID sizes to pa-3220,

1gbps ssl decryption + threat-ID sizes to pa-5220

[simsim]

Hi @reaper 

Can you please  elaborate How I determine the app-id throughput 

Thanks

[OtakarKlier]

Hello,

Here is a link to the comparison sheet:

https://www.paloaltonetworks.com/products/product-selection

Then select the devices you think might work. In your case, start with the 3410 and 5410 as a comparison.

I always look a the smallest number and go from there, even if I'm not using it. This way if in the future you need that feature, you have it sized correctly, if nothing else changes. Also dont skimp on the licenses and features. They help you more than you know.

I'm only guessing but I bet a 3410 would work for you (but dont go by my advice only since I dont know your environment). Stay with the models that have the 4 as the second number, they are the newest architecture.

Cheers!

[BSnow]

What is the best way to size that for an existing customer, on an existing firewall?

[OtakarKlier]

Hello,

If the Palo Alto has already been deployed, check the CPU utilization. This is a good indicator (not the only one) of the performance of the existing system. If you are looking to replace another vendors firewall, What I do is take the amount of bandwidth that the traffic is going through and them spec the Palo Alto with that number using the most restrictive numbers, usually the 'Threat Prevent' numbers. Then make sure that its less than 50% of that. This give room for growth etc.

Regards,

[OtakarKlier]

Hello,

For those specs, I would go with a PA-5410 series.

Regards,