Can we use 10GbE SFP+ on PA-3220 to connect directly to NetApp SAN over optical connection

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Can we use 10GbE SFP+ on PA-3220 to connect directly to NetApp SAN over optical connection

L0 Member

Hey all. We're kind of in a bind. We procured a NetApp AFF A220 SAN that only have 10GbE optical transceivers for data access. We have no network hardware (no fabric or network switch) that support 10 gigabit except potentially our PA-3220 that have 4 x SFP+ ports capable of 10GbE.

 

Is it possible to connect the SAN directly to the SFP+ ports on the PA-3220 for access by our ESXi nodes? The ESXi nodes are connected via RJ-45 1GbE connections from Cisco switches connected to the PA-3220. 

 

thanks in advance!

2 accepted solutions

Accepted Solutions

Cyber Elite
Cyber Elite

Hi @marcusserrao ,

 

Yes, you can connect the NetApp directly to the PA.  There are a number of things to consider:

 

  1. Using L2 interfaces as @murali438 suggested is probably the best way to go, but you could also use L3 interfaces.
  2. Most SFP+ transceivers will work, but TAC only supports PA transceivers.
  3. The max throughput of the PA-3220 is 4.2 Gbps or 2.3 Gbps with threat prevention.  https://www.paloaltonetworks.com/products/product-comparison?chosen=pa-3220,pa-3250
  4. If you create a separate rule for the traffic without a security profile, you should get 4.2 Gbps.
  5. If the backup traffic is still slow, consider an application override rule to bypass Content-ID completely.  https://live.paloaltonetworks.com/t5/blogs/tips-amp-tricks-how-to-create-an-application-override/ba-...  A custom App-ID is required.
  6. Configure QoS on the NetApp if possible to shape the traffic at 4 Gbps.  Otherwise, the NetApp will send 10 Gbps and may overrun the buffers on the NGFW.

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

View solution in original post

3 REPLIES 3

Cyber Elite
Cyber Elite

Hi @marcusserrao ,

 

Yes, you can connect the NetApp directly to the PA.  There are a number of things to consider:

 

  1. Using L2 interfaces as @murali438 suggested is probably the best way to go, but you could also use L3 interfaces.
  2. Most SFP+ transceivers will work, but TAC only supports PA transceivers.
  3. The max throughput of the PA-3220 is 4.2 Gbps or 2.3 Gbps with threat prevention.  https://www.paloaltonetworks.com/products/product-comparison?chosen=pa-3220,pa-3250
  4. If you create a separate rule for the traffic without a security profile, you should get 4.2 Gbps.
  5. If the backup traffic is still slow, consider an application override rule to bypass Content-ID completely.  https://live.paloaltonetworks.com/t5/blogs/tips-amp-tricks-how-to-create-an-application-override/ba-...  A custom App-ID is required.
  6. Configure QoS on the NetApp if possible to shape the traffic at 4 Gbps.  Otherwise, the NetApp will send 10 Gbps and may overrun the buffers on the NGFW.

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

L0 Member

Thank you both!

  • 2 accepted solutions
  • 1366 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!