Performance Tuning for the VM-Series Firewall on AWS

Optimize the performance of the VM-Series firewall on AWS.

The following configurations affect performance:

PAN-OS versions 9.0.3 and earlier support AWS C5 and M5 instance types that have Elastic Network Adapter support for SR-IOV mode by default. For more details, see Elastic Network Adapter – High Performance Network Interface for Amazon EC2.

PAN-OS versions 9.0.4 and later provide DPDK support for C5 and M5 instance types by default. When the firewall is in DPDK mode, it uses DPDK drivers. For a list of supported drivers, see PacketMMAP and PDK Drivers on VM-Series Firewalls and the official DPDK release notes.

To benefit from IETF RFC 8926 (Geneve) encapsulation and improved throughput, upgrade to PAN-OS 10.0.2 or later and refer to VM-Series Integration with AWS Gateway Load Balancer.

Use the VM-Series CLI to view your DPDK settings or enable packed I/O.

View the DPDK Configuration on Your Firewall

View your DPDK configuration. If DPDK is enabled the output is as follows:

> show system setting dpdk-pkt-io on

Device current Packet IO mode:     DPDK
Device DPDK Packet IO capable:     yes
Device default Packet IO mode:     DPDK

Enable DPDK:

> set system setting dpdk-pkt-io on

Reboot the device.

On the firewall, select

Device

Setup

Operations

and select

Reboot Device