Throughput of an Active/Active HA pair

Showing results for 
Search instead for 
Did you mean: 

Throughput of an Active/Active HA pair

L0 Member

I believe that in an active/active HA pair the total throughput is equal to the performance of a single box, not the sum of both boxes.

For the PA-5050, the throughput for an Active/Active HA pair is 5Gbps with threat prevention.

Where is this documented?

I need to show it to management



L7 Applicator

Hello Dave,

In Active/Active mode, Both devices in the cluster are active processing and passing traffic:

   > Devices back each other, taking over primary ownership if either one fails

   > Both devices load share the traffic

   > w/o external load balancers, traffic is “shared” between devices based on routes on up/downstream devices, or  manipulating default gateways


> No increase in session capacity

> Not designed to increase throughput

I would recomend you to contact with your Palo Alto SE to get a proper documentation for the same.


L7 Applicator

In Palo Alto Active/Active is not at all about capacity, so you won't find it mentioned in the documentation.  The use cases are just two:

  • Asymmetrical routing - there are two active paths and source and reply traffic can appear on different links.  The A/A setup allows the sessions to still be matched and processed by the original firewall.
  • Dynamic routing protocol load balancing - There are two paths that traffic could take through the firewalls and that path is selected by routing preferences in dynamic routing protocols outside the PA firewall.  The inactive path interfaces must remain up for the dynamic peers to maintain their routing tables.  In an active/passive design the passive firewall links are down and the peers on the secondary path cannot remain up.

See the discussion in the Active/Active Tech note for more details.

Configuring Active/Active HA PAN-OS 4.0

Steve Puluka BSEET - IP Architect - DQE Communications (Metro Ethernet/ISP)
ACE PanOS 6; ACE PanOS 7; ASE 3.0; PSE 7.0 Foundations & Associate in Platform; Cyber Security; Data Center
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!