Palo Alto Firewalls causing high FPS on NTA Collectors

Hello All,

I am facing an issue with NTA charts, while going through top conversations during troubleshooting if I am selecting duration for more than 3 days, charts take a long time to load. Sometimes it gives timeout error as well.

I identified two Palo Alto firewalls which are sending huge FPS to NTA collectors.

FlowsPerSecondForLast5min	FlowsPerSecondForLast24Hours	FlowsPerSecondForLast3Days
357257	322516	328034
101063	92305	92087

I am starting to think this is a root cause of issue which I'm facing with charts currently. As per SolarWinds KB article each collector can process up to 50k FPS.

Any suggestions on how to retain the performance of NTA?

Find more posts tagged with

palo alto firewall

nta - network traffic analizer

netflow

nta

Accepted answers

All comments

GoldTipu

Check if the device sending duplicate flows .

documentation.solarwinds.com/.../nta-duplicate-flows-sw1681.htm

stibi

Hi @rahulkudesia ,

I believe that this will be same problem as described here: Request for guidance to reduce FPS in our SW environment

rahulkudesia

Thank you for sharing the article @stibi . Agreed, both seems to be the same issue.

You mentioned that Palo Alto started to report incorrect PDU/flow record count. Kindly let me know what steps have you taken to reduce this count?

stibi

Hi @rahulkudesia ,

There are no steps. Right now the number you are seeing is not real FPS count. I would recommend to confirm this first in the WireShark. If you want to know how much FPS you are receiving I would recommend to look on performance counters: run perfmon through start menu -> add new counters -> under "SolarWinds NetFlow" find and add counter "PDUs Processed Per Second"