About axposecurity

I'm currently making a log concept for our new PaloAlto firewall environment for our new internet perimeter. I have a few questions about that. Here is what we want to build: - a two stage firewall concept - outer firewall is a PA-5050 cluster with Threat and URL - inner firewall is a PA-5020 cluster with just firewalling - inbetween of the two clusters is the DMZ with about 70 servers - 150 Mbit/s internet bandwidth - 5'000 users who will do webbrowsing over these two firewall clusters Currently we have one Check Point cluster which will be replaced by the mentioned PA firewalls. We have about 12 million (12x10^6) sessions per day and log files of 1.2 GB each day. Every session is logged. I analyzed the log DB of our PA-500 we already have and found that the PA will need about 6 times more log space per session than a Check Point firewall (correct me if I'm wrong). So I expect to have about 6 GB log data per day per firewall. 12 GB with both firewall stages involved. Half a year of log will need about 2.1TB storage. With future growth even more. My questions: - are these calculations realistic? - With vdisk: can Panorama use more than 2 TB disk space with the new VMFS5 on vSphere 5.x (which can 64 TB with physical compatibility!!)? - With NFS: What's the bandwith need from the firewall to Panorama and from Panorama to the NFSv3 Storage for 12 million sessions per day? How does the log flow look like? - How will log querys perform on a Panorama log database of over 2 TB? - What are your experiences with NFS log db storage? - How does your log concept look in case you have such an environment? Thanks in advance for your answers ... View more