About reaper

Any guarantees can be surpassed whenever 'excess' is available from other sites not using their capacity The RN-SPN "internet speed" is physically much higher than the capacity you assign to the node, and will generally be able to surpass your allocation by 10% according to the documentation but in reality i've also seen higher results. I'd not 'trust' on the bonus to go unnoticed if you start bursting all the time, a sales person might come knocking to sell you more capacity 😉   QoS is applied on egress ('from' the RN), but you need to create a QoS profile to define classes and then define what those classes include via policy https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/configure-quality-of-service-in-prisma-access/configure-quality-of-service-for-mobile-users-and-remote-networks#id3dbc4e78-ad07-4063-a552-09131e7d7b42   ... View more

the PA-3400 has a switch fabric instead of the fpga based network processor in the PA-3200, hence the relabelling there's no FPGA's in the PA-3400 so no signature lookups on dedicated hardware the PA-3200 slide is slightly misleading as the 3220 also doesn't have signature lookups on dedicated hardware   ... View more

That's expected behavior   the orange line would only come into play on 'returning' packets where a session's packets are returned to a session owner rather than a routing option. For the A/A to allow full routing you'd need a (functional) tunnel on each member so packets can be sent out organically and then have A/A packet ownership use HA3 to 'fix' sessions on the session owner firewall for packet inspection   i.e. have 2 fully functional tunnels, syn goes out of B, ACK comes back through A, HA3 is used to pass ACK packet to B for session creation/inspection ... View more