Replacing an Aging Branch Pair With Two Gbps of Inspected Traffic
Calder Precision operates two plants 400 meters apart, 1,400 employees and two 1 Gbps internet links. All outbound traffic is decrypted with SSL forward proxy and inspected with Threat Prevention and WildFire, and 200 IPsec tunnels terminate from branch offices. The six-year-old PA-850 HA pair sits at 60-80 percent dataplane utilization at peak and collapses to roughly 600 Mbps of inspected throughput during shift changes, with users reporting timeouts. Management has approved a replacement pair, a maintenance window of no more than 15 minutes, and no single point of failure between the two buildings. Shortlisted options are a PA-1420 pair, a PA-3410 pair, or VM-Series on the existing Nutanix cluster, which has 16 spare vCPUs and no SR-IOV support. The CFO asks why the current appliance's advertised throughput is far above what the site actually achieves.
1. Explain the throughput gap to the CFO and state the sizing method you would use to choose between the three options.
Read the worked answer
Datasheet headline numbers are App-ID-only figures measured with large packets and no threat inspection. Every added function multiplies the per-packet cost: TLS decryption terminates and re-originates sessions and is the single most expensive feature here, Threat Prevention adds stream-based scanning, and WildFire submission adds file handling. Add small packets from collaboration traffic and 200 tunnels, and sustained inspected throughput can land far below the App-ID figure. The PA-850 is behaving normally, not failing.
Sizing method:
- Take the published Threat Prevention throughput with TLS decryption as the planning number, not App-ID.
- Size for simultaneous peak across both ISP links, not the average: 2 Gbps of capacity, with the expectation that failover puts all load on one link.
- Apply headroom of 40-50 percent so the device is not operating in the region where latency climbs and session setup is delayed.
- Add the tunnel count and the shift-change burst profile (many short sessions, high session rate).
Applying that: the smaller appliance will sit above 70 percent at combined peak with decryption, which reproduces today's problem. The virtual option depends on per-vCPU inspection capacity without SR-IOV, and 16 vCPUs is unlikely to deliver predictable 2 Gbps-plus inspection. That leaves the mid-range appliance pair as the defensible choice, with the smaller chassis only if decryption were limited to specific categories.
2. Design the HA and migration approach that meets the 15-minute window and the no-single-point-of-failure constraint across two buildings.
Read the worked answer
Active/passive across the two buildings, with dedicated HA links over fiber: HA1 control and HA2 data on separate physical interfaces or an aggregate, no routing or user traffic on those links, and a measured round trip low enough that heartbeats and session synchronisation are not the bottleneck. Path monitoring on the upstream ISP gateways and on the inter-building fiber, with failover triggered by both; preempt disabled so a flapping link does not cause repeated failovers.
Migration:
- Build and license the new pair in parallel, staged on a maintenance network, with configuration imported and cleaned (unused rules, stale objects, duplicate NAT) so the new box starts tidy.
- Test decryption, the 200 tunnels, and user authentication before cutover, and verify HA failover in both directions while still off-net.
- Cutover: move transit links and tunnel endpoints during the window, then validate sessions, decryption and route convergence. Keep the old pair powered and configured as rollback for two weeks.
Key risk to flag: terminating 200 tunnels means the new device must hold all phase-2 associations and re-establish them, which is where 15 minutes can be lost. Pre-stage as many tunnels as possible and expect a burst of rekeying immediately after cutover.
On virtual: if chosen, HA across buildings requires the hypervisor layer to keep the two VMs on separate hosts with independent storage paths, or the HA guarantee is fictional.
3. The CFO asks whether virtual firewalls would save money. Give a balanced recommendation with the conditions under which VM-Series would win.
Read the worked answer
Virtual is not automatically cheaper. The licence model charges for the throughput tier and feature bundle, and the real cost lands in operations and capacity predictability.
Where VM-Series would win here:
- If the inspection requirement could be reduced, for example decryption limited to high-risk categories rather than all outbound traffic, the throughput tier drops sharply.
- If the Nutanix cluster had SR-IOV or comparable passthrough and could dedicate cores, giving predictable per-flow performance rather than sharing with other workloads.
- If agility mattered more than peak performance, for example rapid build of a test pair alongside production.
Where it loses for this site:
- No SR-IOV, 16 spare vCPUs, and 2 Gbps plus decryption is a demanding, latency-sensitive profile; noisy-neighbour effects on a shared cluster are exactly what causes shift-change timeouts.
- HA across two buildings depends on the platform's anti-affinity and storage design; if both VMs can land on one host, the availability claim fails audit.
- The appliance gives a fixed, supportable inspection ceiling and simpler HA cabling over the 400 m fiber.
Recommendation: mid-range appliance pair now, and revisit virtual for the branch aggregation tier or for a segmented inspection zone where the throughput requirement is lower.