Fast Path vs Slow Path with Content ID

[M.Gannon]

Hi,

newish to Palo Alto so trying to understand the demarcation between Fast-Path and Slow path when using Content ID.

My understanding is that when a new traffic flow starts App-ID is used to determine the application and once the flow is established traffic moves to Fast path.

Am I right though that if Content-ID is used that the traffic must stay in Slow Path because the traffic would need continuous inspection to verify that content isn't being modifed mid-flow to circumvent the policy. eg a malicious actor could initiate a connection with junk PDF file downloads before switching to sensitive PDF file downloads

[TomYoung · Accepted solution]

Hi @M.Gannon ,

"A packet that matches an existing session will enter the fast path."  This information is found under Section 4 of this page -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVHCA0.

"On a Palo Alto Networks firewall, a session is defined by two uni-directional flows each uniquely identified by a 6-tuple key: source-address, destination-address, source-port, destination-port, protocol, and security-zone."  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVECA0

Therefore, App-ID and Content-ID are not used to define a session and have no impact on fast or slow path.  The best diagram that I have found to illustrate this process is as follows, where slow path is session setup.

Both fast and slow path traffic go through App-ID and Content-ID inspection if determined by the security policy rule.

With that said, Content-ID (defined as threat prevention) does impact performance as shown in the Compare Firewalls and spec sheets.

https://www.paloaltonetworks.com/products/product-comparison

https://www.paloaltonetworks.com/resources/datasheets/product-summary-specsheet

Thanks,

Tom

[M.Gannon]

Thanks Tom,

That makes sense. So Contect-ID, if selected as part of the policy continues via slow path because of the continuing analysis

[TomYoung]

Hi @M.Gannon ,

Yes, Content-ID is slower, but technically it is not called slow path.

Thanks,

Tom