Can we use 10GbE SFP+ on PA-3220 to connect directly to NetApp SAN over optical connection

[marcusserrao]

Hey all. We're kind of in a bind. We procured a NetApp AFF A220 SAN that only have 10GbE optical transceivers for data access. We have no network hardware (no fabric or network switch) that support 10 gigabit except potentially our PA-3220 that have 4 x SFP+ ports capable of 10GbE.

Is it possible to connect the SAN directly to the SFP+ ports on the PA-3220 for access by our ESXi nodes? The ESXi nodes are connected via RJ-45 1GbE connections from Cisco switches connected to the PA-3220. 

thanks in advance!

[murali438 · Accepted solution]

Hello,

Please check this How to make unused ports of Palo Alto Networks firewall into a ... - Knowledge Base - Palo Alto Netw...

[TomYoung · Accepted solution]

Hi @marcusserrao ,

Yes, you can connect the NetApp directly to the PA.  There are a number of things to consider:

1. Using L2 interfaces as @murali438 suggested is probably the best way to go, but you could also use L3 interfaces.
2. Most SFP+ transceivers will work, but TAC only supports PA transceivers.
3. The max throughput of the PA-3220 is 4.2 Gbps or 2.3 Gbps with threat prevention.  https://www.paloaltonetworks.com/products/product-comparison?chosen=pa-3220,pa-3250
4. If you create a separate rule for the traffic without a security profile, you should get 4.2 Gbps.
5. If the backup traffic is still slow, consider an application override rule to bypass Content-ID completely.  https://live.paloaltonetworks.com/t5/blogs/tips-amp-tricks-how-to-create-an-application-override/ba-...  A custom App-ID is required.
6. Configure QoS on the NetApp if possible to shape the traffic at 4 Gbps.  Otherwise, the NetApp will send 10 Gbps and may overrun the buffers on the NGFW.

Thanks,

Tom

[marcusserrao]

Thank you both!