Palo Alto Networks Enterprise Firewall PA-7080

The PA-7000 Series Architecture :

The PA-7000 Series is powered by a scalable architecture for the express purpose of applying the appropriate type and volume of processing power to the key functional tasks of networking, security, content inspection and management. The PA-7000 Series chassis intelligently distributes the computational processing demands of networking, security, threat prevention and management across three subsystems, each with massive amounts of computing power and dedicated memory

• Network Processing Card (NPC): The NPC is dedicated to executing all packet-processing tasks including networking, traffic classification and threat prevention. Each NPC has up to 67 processing cores, all focused on the singular task of protecting your network at up to 20 Gbps per NPC. Scaling the throughput and capacity to the maximum 200 Gbps on the PA-7080 or 120 Gbps on the PA-7050 is as easy as adding a new NPC and allowing the system to determine the best use of the newly added processing power. Addressing the increasing demand for higher density 10 Gig and 40 Gig connectivity, as well as the more common 10 Gbps and 1 Gbps interface alternatives, four NPC options are available and can be used interchangeably.
• Switch Management Card (SMC): Acting as the control center of the PA-7000 Series, the SMC intelligently oversees all traffic and executes all management functions, using a combination of three elements: the First Packet Processor, a high-speed backplane, and the management subsystem.
  • First Packet Processor (FPP) is the key to maximizing performance and delivering linear scalability to the PA- 7000 Series. The FPP constantly tracks the shared pool of available processing and I/O resources across all NPCs, intelligently directing inbound traffic to any underutilized processing. This means that, as NPCs are added to increase performance and capacity, no traffic management changes are required, nor is it necessary to re-cable or reconfigure your PA-7000 Series.
  • High-speed backplane operates at 1.2 Tbps, which means each of the network processing cards has access to approximately 100 Gbps of traffic capacity, ensuring that performance will scale in a linear manner as your requirements increase
  • Management subsystem acts as a dedicated point of contact for controlling all aspects of the PA-7000 Series.
• Log Processing Card (LPC): The LPC is a dedicated subsystem designed to perform the critical task of managing the high volume of logs generated by the PA-7000 Series. The LPC is unique to the PA-7000 Series and uses two high-speed, multi-core processors and 2 TB of RAID 1 storage to offload the logging-related activities without impacting the processing required for other management or traffic processing-related tasks. The LPC enables you to generate on-system queries and reports from the most recent logs collected or forward them to a syslog server for archiving or additional analysis.

The PA-7000 Series is managed as a single, unified system, which enables you to easily direct all of the available resources to the singular task of protecting your data. The controlling element of the PA-7000 Series is an ultra-efficient, single-pass classification engine that analyzes all traffic traversing the appliance to immediately determine three critical elements that become the heart of your security policy: the application identity, regardless of port; the content, malicious or otherwise; and the user identity. The benefits of determining the application, content and user in a single pass, and basing your security policy on those business relevant elements, are threefold. The first is an improvement in your security posture introduced by more directly mapping your security policies to key business initiatives. The second is a reduction in the administrative overhead associated with keeping security policies current in a highly dynamic environment. The third benefit is a reduction in latency brought on by the elimination of the redundant scanning and look-up tasks commonly found in alternative offerings. To help further simplify administrative effort, annual support and subscription fees for the PA-7000 Series are system-wide, which means that, no matter how many NPCs are installed, the annual fees are constant, providing you with a predictable, annual cost structure.