1) You can see the various performance numbers (which depends on model) for throughput with threat preventation enabled in the datasheets: PA-5060 20 Gbps firewall throughput 10 Gbps threat prevention throughput PA-5050 10 Gbps firewall throughput 5 Gbps threat prevention throughput PA-5020 5 Gbps firewall throughput 2 Gbps threat prevention throughput PA-4060 10 Gbps firewall throughput 5 Gbps threat prevention throughput PA-4050 10 Gbps firewall throughput 5 Gbps threat prevention throughput PA-4020 2 Gbps firewall throughput 2 Gbps threat prevention throughput PA-2050 1 Gbps firewall throughput 500 Mbps threat prevention throughput PA-2020 500 Mbps firewall throughput 200 Mbps threat prevention throughput PA-500 250 Mbps firewall throughput 100 Mbps threat prevention throughput PA-200 100 Mbps firewall throughput 50 Mbps threat prevention throughput In order to monitor the throughput you can use snmp, here is some info on how to do this with cacti: 2) As I understand it the singlepass engine in PA will work no matter if you have a specific rule using threat protection or not. Some benchmarks published on the Internet even shows that throughput went down when you disabled threat preventation compared to a rule with everything enabled. Also the figures mentioned in PA's datasheets isnt max values (like most competitors) but rather low values (NSS Labs found that actual performance was 115% of stated in the datasheet - of course this might vary depending on what kind of traffic, packetsizes, segmentsizes etc). Edit: I guess these two docs might be of interrest:
... View more
