Testing Performance

[luk]

I would like to get to know which specifc traffic is being checked by specific features of Palo-alto NGFW. To be more precise after enabling all the features on the device which traffic is being checked by URL filtering , IPS Anti- Spyware and other features. The traffic must be using specific ports?

[TranceforLife · Accepted solution]

Hi,

It is all depends on how do you configure your profiles. For the URL depends on of the category and the action,  for the file blocking depends on the file type/extension, etc.

https://www.paloaltonetworks.com/documentation/60/pan-os/pan-os/threat-prevention/about-security-pro...

Cheers,

Myky

[bmorris1 · Accepted solution]

Hi luk,

Here's what you'll need to do:

Access the monitor tab and select traffic logs from the left hand side.
Identify the traffic you're looking for either by scrolling through the logs or applying a filter. You can apply a filter easily by selecting the + button on the right hand side.
Once you've found the traffic note down the security policy that this traffic is matching.
Select the policies tab from the top and select security from the left hand side.
In the search bar type in the name of your policy.
Once you've found your policy you can find out what content-ID profiles are attached to it by looking in the action tab.
To find out more info about the profiles that are attached then select the objects tab from the top of the gui and you'll have the specific profiles on the left.

Hope this helps,
Ben

[luk]

So when I generate UPD traffic for example 64 bytes of random data with destination port for protocols like POP3 IMAP SMTP and others and correctly configured security profiles I should see performance degradation ?

[bmorris1]

Yes that is right in theory as the firewall throughput speeds are less when content inspection is applied.

Ben