Sign in Subscribe

Palo Alto Networks NGFW Single-Pass Parallel Architecture

Palo Alto Networks NGFW Single-Pass Parallel Architecture
PCNSA 1.2 Blog Feature

The Single-Pass Parallel Processing (SP3) architecture is meant to compete with the traditional performance of firewalls. Traditionally, when additional features are activated, firewall performance decreases.

SP3 addresses these performance challenges with single-pass parallel architecture. The single-pass architecture allows a packet to pass through a processing chain once for all sub-processes or features.

Single-pass architecture from PCNSA Study Guide.

Latency is reduced with Single-Pass Parallel Processing (SP3) architecture. Components include:

  • Single-pass software
  • Parallel processing hardware

Compared to the multi-pass architecture, a packet goes through a processing chain, such as a feature, more than once. This process adds features in a sequence of separate engines but adds latency and negatively impacts performance.

Multi-pass architecture from Single-Pass Architecture Solution Brief

SP3 architecture of choice for Palo Alto networks NGFW. Stream-based components provide a way to classify and control traffic in a “single pass”.

Palo Alto Networks NGFWs take the “scan it all, scan it once” approach for physical and virtual NGFWs.

Join Network Junkies

Get the latest updates via email by joining the Network Junkies email list.

[convertkit form=2419164]

Management and Data Planes

Management and data plane functions are separate on physical and virtual firewalls. They each have dedicated resources such as CPU, RAM, and storage.

If load is applied to one plane, it doesn’t adversely impact the other plane’s performance.

Control plane features:

  • Firewall configuration
  • Logging
  • Reporting

Data plane features:

  • Signature matching
  • Security processing
  • Network processing

The Single-Pass Parallel Processing (SP3) architecture is meant to compete with the traditional performance of firewalls. Traditionally, when additional features are activated, firewall performance decreases.

SP3 addresses these performance challenges with single-pass parallel architecture. The single-pass architecture allows a packet to pass through a processing chain once for all sub-processes or features.

From the PCNSA Study Guide

Read next