Identify the components and operation of Single-Pass ParallelPalo Alto PCNSA Study Guide v10
Single-Pass Parallel Processing
The Palo Alto firewalls use a single-pass parallel processing architecture. It combines single-pass software with parallel processing hardware. The goal is to “scan it all, scan it once.” The software uses stream processing. These stream processors include antivirus, spyware, data filtering, and vulnerability protection. In addition to the stream processors, the software also includes App-ID, User-ID, and Wildfire information.
- App-ID: How Palo Alto defines applications such as Facebook, AWS, and Microsoft 365.
- User-ID: How Palo Alto associates end users with their traffic.
- Wildfire: Threat information to block known bad traffic.
The hardware architecture of the Palo Alto firewall uses two separate planes. Both the management and data planes have their own resources (CPU, RAM, and storage) dedicated to their use.
The management (control) plane consists of the following:
- Configuration of the firewall
- Logging (Panorama/Syslog)
The data plane provides the following features:
- Signature matching
- data filtering (SSN, Credit Card #s)
- Security processing
- Policy Enforcement
- Network processing