Understanding Throughput

[ahmedessam]

i need help with understading how threat prvention throughput works ,i mean for all integrated features(ips,antivrus,..) what is the throughput of each alone ,as in specsheet only total throughput is mentioned 

[reaper]

lease take a look at this information : Platform Specifications and Features Summary

as a rule of thumb, we estimate total throughput is halved if all bells and whistles are enabled. depending on your actual traffic mox, results may vary slightly

[ahmedessam]

ok if customer as example asks for 1Gb antivrius throughput , ips 2Gb,file block 1Gb, throughput ,a threat prevention with total 5gb comply  ?how will i specify antivrus with 1gb and ips with 2?

[reaper · Accepted solution]

we use single pass parallel processing to process traffic, so that means for a platform that has 4gbps App-ID throughput, an estimated 2gbps will be achieved if all threat prevention (av + ips + fileblocking, ...) is enabled

so if the customer requires 2 gbps ips throughput, you would need the PA-3050 to comply with this requirement (the 1gbps AV is included in the 2 gbps throughput)

[Sly_Cooper]

@reaperIs it possible to track throughput? I came across 'show session info' and 'show session statistic' commands to check for throughput. While 'show session statistics' commands shows aggregated values, it is real time and I have not seen a way to retrieve it programatically.

[BPry]

@Sly_Cooper,

Check out Pan(w)achrome. It can give you the Bitrate and Packet rate for the logical and hardware interfaces in a semi-realtime view. Otherwise you could utilize the API to get this information and essentially rebuild it for yourself, but this is a pre-packaged solution at least. +

[Remo]

@Sly_Cooper

For continuous monitoring including storing these values to get also a historical view you should take a look at snmp and a monitoring software.

Examples are:

• (Commercial software with also a free version) PRTG Traffic Monitor https://www.paessler.com
• (Opensource software) NetData https://github.com/firehol/netdata
• ...
• ...

[Sly_Cooper]

@RemoAre you monitoring these values using the software mentioned? Do you know if these are out of the box options or need specific snmp MIB compilation?

[Remo]

@Sly_Cooper

Things like throughput, processorload and used diskspace can be monitored (I assume) with most software out of the box - in other words everything that could be monitored with standard mibs. Values where you need the Paloalto mib (like sessioncount) need at least an import of the mib (in most cases) and in case of PRTG they offer a little tool to convert mibs into the format used by PRTG.