Performance Tuning for the VM-Series Firewall on AWS

Table of Contents

Optimize the performance of the VM-Series firewall on AWS.

Where Can I Use This?	What Do I Need?
AWS	AWS account Amazon Machine Image (AMI) ID VM-Series License (PAYG or BYOL) VM-Series plugin Panorama Panorama plugin for AWS

The following configurations affect performance:

PAN-OS versions 9.0.3 and earlier support AWS C5 and M5 instance types that have Elastic Network Adapter support for SR-IOV mode by default. For more details, see Elastic Network Adapter – High Performance Network Interface for Amazon EC2.
PAN-OS versions 9.0.4 and later provide DPDK support for C5 and M5 instance types by default. When the firewall is in DPDK mode, it uses DPDK drivers. For a list of supported drivers, see PacketMMAP and PDK Drivers on VM-Series Firewalls and the official DPDK release notes.
To benefit from IETF RFC 8926 (Geneve) encapsulation and improved throughput, upgrade to PAN-OS 10.0.2 or later and refer to VM-Series Integration with AWS Gateway Load Balancer.

Use the VM-Series CLI to view your DPDK settings or enable packed I/O.

View the DPDK Configuration on Your Firewall

View your DPDK configuration. If DPDK is enabled the output is as follows:

> show system setting dpdk-pkt-io on

Device current Packet IO mode:     DPDK 
Device DPDK Packet IO capable:     yes
Device default Packet IO mode:     DPDK

Log in to the VM-Series firewall CLI
Enable DPDK:
> set system setting dpdk-pkt-io on
Reboot the device.
On the firewall, select DeviceSetupOperations and select Reboot Device.