Hey everyone, I hope this is the right place for this. I'm pretty new to the networking side of things, mostly coming from a project management background where I help teams pick their SaaS tools. But we're having this big issue with our Palo Alto 5200 series firewall, and I'm trying to wrap my head around it.
Our NOC team is seeing sustained high CPU (like, 80-90%) during business hours. It's causing some noticeable lag. We opened a case with Palo Alto support, and after looking at some diagnostics, they said the problem is our rulebase. They basically told us it's too big and messy.
I get the principle that a messy rulebase can be slow, but I'm struggling with the specifics. What exactly makes a rule "expensive" for the CPU? Is it the number of security policies total, or something about the specific types of rules? We have a lot of rules for different departments and applications, probably a few thousand.
Has anyone else dealt with this on the 5200 series? What did you do to fix it? Are there best practices for organizing the rules to be more efficient, or is it just about cutting the total number down? Any insight would be super helpful.
Thx!
It's the rule processing logic, not just the count. Your firewall evaluates each packet against your rule list from top to bottom until it finds a match. A few thousand rules means a ton of sequential checks per packet.
The expensive rules are usually the ones with:
- Many source/destination objects (big groups)
- Application filters instead of ports
- 'Any' in service or port fields
- SSL decryption rules
Get the rule hit count report from the CLI. You'll probably find 80% of your traffic is hitting 20% of your rules. Move those high-hit rules to the top. Delete the ones with zero hits.
Benchmarks don't lie.