Focus

VM-Series Deployment Guide

Performance Tuning for the VM-Series Firewall on AWS

Table of Contents

Optimize the performance of the VM-Series firewall on AWS.

The following configurations affect performance:

PAN-OS versions 9.0.3 and earlier support AWS C5 and M5 instance types that have Elastic Network Adapter support for SR-IOV mode by default. For more details, see Elastic Network Adapter – High Performance Network Interface for Amazon EC2.
PAN-OS versions 9.0.4 and later provide DPDK support for C5 and M5 instance types by default. When the firewall is in DPDK mode, it uses DPDK drivers. For a list of supported drivers, see PacketMMAP and PDK Drivers on VM-Series Firewalls and the official DPDK release notes.
To benefit from IETF RFC 8926 (Geneve) encapsulation and improved throughput, upgrade to PAN-OS 10.0.2 or later and refer to VM-Series Integration with AWS Gateway Load Balancer.
PAN-OS version 10.2.x supports AWS M6 instance types. The AWS M6 instance provides improved performance, enhanced security and maximized resource, flexibility, and choice. For more information, see Amazon M6 instances.

Use the VM-Series CLI to view your DPDK settings or enable packed I/O.

View your DPDK configuration. If DPDK is enabled the output is as follows:

> show system setting dpdk-pkt-io on

Device current Packet IO mode:     DPDK 
Device DPDK Packet IO capable:     yes
Device default Packet IO mode:     DPDK

Log in to the VM-Series firewall CLI
Enable DPDK:
> set system setting dpdk-pkt-io on
Reboot the device.
On the firewall, select DeviceSetupOperations and select Reboot Device.