Firewall sessions

[wasan.altalhouni]

Spoiler

I'm in a competition against a vendor who is claiming that two small firewalls sessions (not bandwidth ) can be added to give higher number of sessions and the customer seems to be buying it, although the.firewall doesn't work that way as its a statedul device and sessions can't be added to maximise the number of sessions I've seen in in the Firewall RFC but wanted to verify this from paloalto as well

[kiwi]

Hi @wasan.altalhouni ,

It sounds like the vendor is trying to sell 'Aggregate Session Limits' by load-balancing across two boxes ? While you can technically spread the load, you aren't 'adding' the capacity of the hardware. You are just splitting the risk. If a single session exceeds the limit of one box, or if one box fails, the whole 'added' math falls apart because the session state can't be seamlessly shared at that scale.

You should size firewalls based on the single-appliance limit and should avoid playing "math games" with HA pairs because security is about reliability. If you need 200k sessions, you buy a box rated for 200k sessions.

Think about what happens during a failover — If they are truly 'combining' sessions to reach a higher number, what happens to the traffic when one firewall needs a reboot or a cable gets pulled? The risk is that one firewall can't handle the load of both and there's a risk that the network goes down.  At that point they've bought a single point of failure split into two boxes.

Kind regards,