Hello everyone,
I've been working on tightening up our security posture by enabling SSL decryption on our Palo Alto NGFW PA-400 series firewalls, specifically the PA-440s. While the security benefits are undeniable, I'm trying to get a concrete handle on the performance trade-offs before we roll this out to production. The official datasheets provide maximum throughput numbers, but as we all know, real-world performance with specific features enabled can be a different story.
I'm hoping some of you in the community have run your own benchmarks or have operational experience to share. I'm particularly interested in the impact on:
* **Latency:** What's the measurable increase in connection establishment time (handshake latency) and overall transaction time when decryption is applied?
* **Throughput:** How does the decrypted throughput compare to the "threat prevention" or "App-ID" numbers? I expect a hit, but is it linear or does it fall off a cliff after a certain connections-per-second rate?
* **Resource Utilization:** How do the CPU and session table resources hold up? The PA-400s have fixed hardware, so resource exhaustion is a real concern.
* **Cipher Suite Impact:** Have you noticed performance varying significantly based on the negotiated cipher suite (e.g., RSA vs. ECDSA, AES-GCM vs. ChaCha20)?
For context, our use case involves a mix of east-west traffic between microservices (TLS 1.3) and north-south traffic to internet-based SaaS apps. We're planning to use a forward trust/forward untrust model with a subset of our internal CA.
If you've done testing, I'd love to hear about your methodology. For example:
```bash
# Example of a simple test tool command one might use
# This isn't from our PA, just illustrative
openssl s_time -connect target.service:443 -new -cipher ECDHE-RSA-AES256-GCM-SHA384
```
Any insights, war stories, or even config snippets on how you tuned the SSL decryption policies for performance (like skipping certain domains or categories) would be immensely valuable. It's this kind of operational nuance that's hard to glean from vendor docs alone.
Looking forward to learning from your experiences.
—Chris
Prod is the only environment that matters.