Performance impact of using higher DH group for site-to-site VPNs

[M.Pahlavanzadeh]

“Clarification on the meaning and performance implications of ‘Integrated Crypto Assistant’ for PA-1420 IPSec VPNs”

Hi all,

I’m working with a PA-1420 appliance in a site-to-site VPN deployment and I’d like to better understand the hardware/crypto architecture. Specifically:

• The PA-1420 architecture diagram lists “Integrated Crypto Assistant” as part of the data-plane.

• My question: What exactly does “Integrated Crypto Assistant” mean in terms of dedicated crypto processors, offload capabilities, IPSec throughput (especially for strong DH groups like DH 14 or higher)?

• From what I can tell: It seems the PA-1420 has enhanced crypto support compared to a purely generic CPU-only model, but it may not have full hardware-offload ASICs akin to the higher-end series.

• I’d appreciate any TAC/field-experience details on:

  • Per-flow throughput/limitation when using strong DH groups (DH 14/19/20/21) on PA-1420.

  • Whether IPSec sessions on this model are fully offloaded or still largely handled by dataplane CPU cores.

  • Practical monitoring tips for checking crypto/CPU bottlenecks on the PA-1420.

https://www.paloaltonetworks.com/resources/pa-series-next-generation-firewalls-hardware-architecture...