The PA-5000 Series Architecture

For many years, the goal of integrating threat prevention services into the firewall has been pursued as a means of alleviating the need for additional devices for functions such as IPS, network antivirus, and more. The pursuit of integrating threat prevention functions into the firewall makes perfect sense – the firewall is the cornerstone of the security infrastructure. Current integration iterations carry a variety of different labels – deep inspection, unified threat management (UTM), deep packet inspection, and others. Each of these iterations share a common problem, which is a lack of consistent and predictable performance when security services are enabled. Specifically, the firewall functions are capable of performing at high throughput and low latency, but when the added security functions are enabled, performance decreased while latency increased. The Palo Alto Networks Single-Pass Parallel Processing (SP3) architecture addresses the integration and performance challenges with a unique single-pass approach to packet processing that is tightly integrated with a purpose-built hardware platform.  Single-pass software: By performing operations once per packet, the single-pass software eliminates many redundant functions that plague previous integration attempts. As a packets are processed, networking, policy lookup, application identification and decoding, and signature matching for any and all threats and content is only performed once. This significantly reduces the amount of processing overhead required to perform multiple functions in one security device. The single-pass software uses a stream-based, uniform signature matching engine for content inspection. Instead of using separate engines and signature sets (requiring multi-pass scanning) and instead of using file proxies (requiring file download prior to scanning), the single-pass architecture scans traffic for all signatures once and in a stream-based fashion to avoid the introduction of latency.  Parallel processing hardware: The single-pass software is then integrated with a purpose-built platform that uses dedicated processors and memory for the four key areas of networking, security, content scanning and management. The computing power within each platform has been specifically chosen to perform the processing intensive task of full stack inspection at multi-Gbps throughput. The resulting combination delivers the horsepower required to achieve consistent and predictable performance at up to 20 Gbps of throughput, making the goal of integrated firewall and threat prevention a reality. It is important to point out that integrating key security functions into the firewall makes perfect sense, or put another way, this is not integration for the sake of integration. Integration will bring many …