The new Palo Alto Networks PA-400 ML Powered Next Generation Firewall (NGFW) product family comes in a compact form factor and is designed for branch offices, small businesses, or retail locations.
The product aims for the next generation firewall market, and it features natively integrated security features, such as threat prevention, advanced URL filtering, DNS Security and malware analysis.
The PA-400 Series is available as four models: PA-410, PA-440, PA-450, and PA-460. These four models offer flexibility for a range of performance requirements. Most significant, the company claims, is the product’s single pass architecture.
Also see: Top Next Generation Firewall Vendors
Single Pass Architecture Improves Security Performance
Palo Alto Networks commissioned independent testing firm Miercom to performance test the product, as it believes its single pass architecture provides superior price performance compared to a traditional NGFW with add-on services.
A single pass parallel processing system applies all elements of threat protection with a single scan. It eliminates many of the redundant functions that bog down a traditional system with add-on capabilities.
All packets are processed and routed, and policies are applied, decoded and signature matched. As packets are processed, networking, policy lookup, application and decoding, and signature matching for all threats and content are performed only once. This reduces the processing load required to perform multiple functions in a single device.
Miercom tested four Palo Alto Networks products against another leading firewall vendor that had similar pricing and positioning.
Miercom used the Ixia BreakingPoint PerfectStorm test tool to push a real-world load on each platform using an 8 x 10 Gig-E line card. This created life-like scenarios commonly seen in small businesses and branch office environments.
Also see: Best Secure Web Gateway Vendors
Key findings from the Miercom report
- Consistent throughput with security services enabled. One of the benefits of single pass is that performance remains high when multiple services are enabled, and the Miercom test validated that. Across the various products, the Palo Alto Networks PA-400 series showed consistently superior throughput ranging from 1.8x better to 6.6x. This ensures that application performance remains high instead of being bogged down by security. An interesting factoid from my research is that 63% of networking and security professionals admit to turning security off in favor of application performance. The single pass design eliminates this trade-off.
- Superior application traffic performance. Miercom tested both vendor products on a range of applications such as MySQL, SIP and FIX. According to the report, Palo Alto Network appliances were observed having an average 24% decline in TCP sessions with services enabled. The competitive products saw over 3x the loss, or 82% average degradation. For connection rate, PA-400 series experienced a decline of only 11% compared to the competitive vendor, which saw a 92% drop.
- Outstanding price performance. Miercom used the throughput data and calculated a total cost of ownership (TCO) comparison. The testing company calculated the throughput with services enabled, and from that derived a TCO per protected Mbps. Palo Alto’s TCO ranged from $4.09 to $10.02 per protected Mbps where the competitive vendor’s range was $20.60 to a whopping $83.65. This gave the PA-400 series a TCO advantage of 2.1x to 9.4x better.
Performance at Scale is Critical with Security
The results of the Miercom independent validation testing provide a valuable lesson that network and security professionals should heed: performance with security services enabled is what matters.
A product that performs well with just raw TCP/UDP traffic with no security services enabled may not perform in real-world deployments. The true measure of NGFW’s performance must include testing performance of application traffic with security inspection enabled.
Shannon McWilliams, VP of Supplier Alliances, Arrow ECS North America, said that “Arrow’s partnership with Palo Alto Networks enables us to offer our channel partners and their customers a great return on investment. The Miercom PA-400 report shows the architectural advantages of the PA-400 series. This platform allows our channel partners’ customers to easily leverage all of the security services that they have purchased without worrying about the impact on firewall performance.”
It’s critical that as companies evaluate security products, they are tested at maximum load with all security features enabled as this simulates real world scenarios. Businesses should not have to knowingly degrade their threat posture to maintain application performance.
With that caution in mind, Palo Alto’s PA-400 series’ single pass architecture is ideally suited for today’s network-centric world. As traffic volumes continue to increase, the difference between the product and legacy products will become more apparent.
Also see: Top Cybersecurity Companies