Branch Sizing and Placement Under a Hardware Freeze
A retail company has 40 branch offices, each with a 300 Mbps ISP circuit and 60 to 120 users, plus a data center that peaks at 6 Gbps of aggregate traffic. Mobile sales staff (5,000 users) need consistent policy whether they are in a branch, at home, or on cellular. Security requires TLS decryption for 35% of branch traffic and threat inspection on all allowed traffic. The data center currently runs a PA-3220 in an active/passive pair. The architecture team proposes putting a VM-Series firewall in each branch on the existing VMware cluster, managed by Panorama, and sending all branch internet traffic back to the data center. The CFO has frozen new hardware purchases for six months.
1. Should the branch firewalls be VM-Series on the existing VMware cluster or PA-440 appliances? Give a sizing and placement recommendation.
Read the worked answer
Neither blind VM deployment nor full backhaul is safe. VM-Series throughput is licensed by model and depends heavily on hypervisor CPU; TLS decryption is CPU-intensive. At 300 Mbps per branch with 35% decrypted plus threat inspection, a small VM-50/VM-100 class is likely undersized. A larger VM model may work, but only with dedicated cores and no CPU oversubscription. PA-440 is purpose-built; size it on published App-ID plus Threat plus SSL-decryption throughput, not raw firewall throughput. Backhauling all 40 branches to the data center adds latency for SaaS and overloads the DC pair. Recommendation: local internet breakout at each branch with an adequately sized appliance or VM, managed by Panorama template stacks for consistent policy. If the hardware freeze blocks appliances, use VM-Series only where hypervisor capacity and licensing exist, and narrow decryption to sensitive categories.
2. The data center PA-3220 active/passive pair peaks at 6 Gbps. Is it adequate if decryption is extended to the data center? What would you do?
Read the worked answer
No. Active/passive provides resiliency, not aggregate throughput; the passive unit does not carry traffic. The PA-3220 App-ID, Threat Prevention, and SSL-decryption throughput is a fraction of its raw firewall throughput, and 6 Gbps of inspected traffic with decryption is well beyond a single PA-3220. Adding decryption would cause drops, high latency, and possibly HA instability. Options: deploy a higher-capacity pair sized on combined App-ID plus Threat plus decryption; distribute inspection to the branches and keep the DC pair for data-center traffic; scope decryption and use exclusions; or use Prisma Access for branch and mobile internet if licensed. Validate with peak session counts and decryption session counts, not just bandwidth.
3. For mobile users, should the company use GlobalProtect full tunnel to the data center or Prisma Access? What factors decide?
Read the worked answer
5,000 mobile users full-tunneling to the data center will hairpin traffic, add latency, and consume DC firewall capacity already at 6 Gbps. Prisma Access gives local breakout and consistent policy, but it is a subscription rather than hardware, so the hardware freeze may not block it. If Prisma Access is available, use it for mobile users and keep GlobalProtect for internal access. If not, GlobalProtect with split tunneling for trusted SaaS can reduce load but weakens inspection. Decision drivers: licensing, latency to SaaS, decryption policy, log retention (Cortex Data Lake versus Panorama), and whether the DC pair can absorb the added tunnels. Do not assume the existing PA-3220 can absorb 5,000 tunnels plus 6 Gbps of inspected traffic.