Using a VM100 at the perimeter

[Jason_Mills]

Hi,

We are looking at deploying a VM-100 at the perimeter of our network. We currently have a PA-500 doing that job.  It is incredibly slow on the management side of things and quite frankly, expensive when it comes to support renewals.  Hence the thought of going to a VM-100.  Our supplier has told us that Palo Alto does not recommend a Virtual Firewall (hosted on VMWARE) at the perimeter however I can't find, any documentation to support this. 

Can anyone point me at the documentation supports the statement that PA don't recommend this deployment model?  Or can someone at PA confirm this?

Thanks in advance.

[BobW]

Thank you for the reply.

In my case, we are looking at going from 100 Mbps to 200 Mbps.  We are a K-12 school with 100+ boarding students. We have 800+ devices with lots of media streaming after hours.  The PA-500 handles 100Mbps very well with it's QOS, but I am concerned about the possibility of it handling 200Mbps with all of the options enabled AND it is roughly three years old.

There is also something to be said about having the VM run on box  which is more redundant than a PA-500 (raid and dual power supply for example) and being able to restore a VM in case of hardware failure.  Not to mention,  I have a dual Xeon 2.9, quad core with 24 GB sitting around collecting dust.

Bob

[DavePalo]

Hi HDC,

We have upgraded the memory in all of our PA-500 devices and this does make a noticeable difference to the management interface speed, commit times etc.

We have also been trialling a VM-100.  We've had a few reliability issues and I understand that the cause of these is being addressed in 6.1.3.  Other than that though, we've been impressed by the general performance of the VM-100 and delighted by the boost in management interface speed / commit times.

Regards,

Dave