Why do some firewalls feel like they are made of lead while others cut through traffic like a hot knife through butter? For the PCNSE exam, understanding hardware acceleration and form factors is key to knowing why a Palo Alto Networks firewall can inspect billions of packets per second without slowing down your internet. This chapter explains the physical and logical components that make these firewalls speed demons, and why choosing the right model matters for your network's security.
Jump to a section
A simple way to picture Core Concepts: Acceleration and Hardware Models
Have you ever wondered what happens to your online order after you click 'buy' and before it lands on your doorstep?
Imagine a massive package sorting facility. The facility has two main areas: a giant warehouse full of shelves and a super-fast conveyor belt system that moves packages to delivery trucks. The warehouse represents the computer's main memory (RAM) where all data is stored. The conveyor belt represents the accelerated data path, like a firewall's hardware acceleration.
Without the conveyor belt, a worker would have to carry each package from the shelf to the truck. That is like a standard firewall processing each data packet through its central processor. It is slow and bogs down when many packages arrive at once.
Now, with the conveyor belt (hardware acceleration), packages are automatically whisked from the sorting area to the correct truck chute. The firewall does not have to stop and think about what to do with each packet; specialised hardware chips make fast, predefined decisions. This facility can handle a rush of holiday orders (a cyberattack or high traffic) without getting jammed, because the conveyor belt handles the heavy lifting efficiently. The warehouse still exists for complex, unusual packages that need special handling, but the conveyor belt handles the common, everyday packages (standard network traffic) at lightning speed.
Firewalls are not just software; they are physical (or virtual) appliances that need to process every single piece of data (called a packet) that tries to enter or leave your network. To do this fast, Palo Alto Networks uses hardware acceleration.
First, let's define some terms. A packet is a small chunk of data sent over a network. Think of it like a postcard. Each postcard has a sender and receiver address (source and destination IP). A firewall inspects each postcard to decide if it is safe. A form factor is simply the physical size and shape of the firewall hardware. Common form factors include rack-mounted appliances (like a pizza box that slides into a server rack) or smaller desktop units.
Why does hardware exist instead of just software? Because software running on a generic computer would be too slow. When a packet arrives, the firewall's central processor (CPU) must check it against hundreds of rules. This is called flow-based processing. A standard CPU can handle this, but during a flood of traffic, it gets overwhelmed.
Hardware acceleration solves this by using specialised chips. The main one is a Content Processor (CP), sometimes called a Data Plane Processor. This chip is designed to do just one thing: look at packets at high speed. It does not run a general operating system; it runs a slim, fast piece of code. The CP checks packets against a table of known 'good' flows (called a session table). If a packet matches an existing session (like a continuation of a web page load), the CP processes it immediately without bothering the main CPU. This is called fast-path processing, or zero-copy forwarding.
What about packets that start a new connection? Those are sent to the general-purpose CPU (the management plane) for a deeper, first-time inspection. This is called slow-path processing. Once the connection is approved, a session is created in the session table, and all subsequent packets of that session take the fast path.
Palo Alto Networks also uses Parallel Processing. In a high-end model, there may be multiple Content Processors working side-by-side. Traffic is split across them using a technique called flow hashing. The firewall looks at the source and destination IP addresses and applies a mathematical formula to decide which CP gets the packet. This prevents one CP from being overloaded while others sit idle.
Now, why does the PCNSE exam care about form factors? Different hardware models offer different performance characteristics. Performance is measured in:
- Firewall Throughput: How much data can the firewall inspect per second (measured in Gbps - gigabits per second). This is for simple firewall rules. - Threat Prevention Throughput: How fast can it run full inspection (including antivirus, intrusion prevention) on traffic. This is usually lower than firewall throughput because it is more complex. - VPN Throughput: How fast can it handle encrypted traffic (IPSec), which requires a lot of cryptographic work. - Concurrent Sessions: How many active connections (like web pages, file transfers) can the firewall remember at once. - New Sessions Per Second: How fast can the firewall set up new connections. For example, a PA-220 (a small desktop form factor) might have a firewall throughput of 500 Mbps and only handle 8,000 concurrent sessions. A PA-7000 series (a large chassis that fits in a rack) can handle 160 Gbps throughput and over 100 million concurrent sessions. The correct model depends on your company's internet speed and number of users. Palo Alto also offers virtual form factors (VM-Series) that run on servers from companies like VMware or Amazon Web Services (AWS). These use the host server's CPU, which is less efficient than a dedicated CP, but offers flexibility in the cloud. Finally, there is High Availability (HA). You can pair two identical firewalls (active/passive or active/active) so if one fails, the other takes over instantly. This requires form factors that support the same throughput and synchronisation cables (called HA cables) between them.
Packet Arrival on Interface
A packet arrives at the firewall's physical or virtual interface. The network interface card (NIC) performs basic checks (like CRC) and hands the packet to the Content Processor (CP) or CPU depending on model.
Session Table Lookup
The firewall checks if the packet's source/destination IP and ports match an existing entry in the session table. If yes, the packet is forwarded using fast-path (hardware acceleration) without further CPU involvement.
Slow Path Processing (for new sessions)
If no session match, the packet is sent to the CPU. The CPU runs through security policies, threat profiles, and SSL decryption (if applicable). This is the first-packet processing and is more resource-intensive.
Session Creation and Rule Match
The CPU creates a new session entry in the session table, associating it with the matching security rule. The session state (e.g., CLOSE, ESTABLISHED) is tracked.
Fast Path Activation for Subsequent Packets
Once the session is created, all subsequent packets of that flow are processed by the Content Processor (hardware acceleration) using the stored session information, achieving high speed and low latency.
A medium-sized company, 'BrightTech Solutions', has 500 employees. They are moving their main office to a new building with a 1 Gbps internet connection. The IT manager, Sarah, must choose a new firewall.
Step 1: Assessing Needs. Sarah knows the company uses cloud-based apps (Office 365, Salesforce) and has a lot of video conferencing. She calculates the actual needed throughput: 1 Gbps internet, but she needs headroom for growth (20% extra). Also, the company must run full Threat Prevention to scan all files for malware.
Step 2: Selecting the Form Factor. Sarah needs a rack-mounted unit for the server room. She looks at Palo Alto's data sheet. She compares the PA-800 Series (designed for mid-size enterprises) and the PA-5000 Series (for larger data centres). For 1 Gbps of traffic, the PA-820 model is sufficient. It offers:
- Firewall throughput: 2 Gbps (more than enough) - Threat Prevention throughput: 500 Mbps (enough for her 1 Gbps link, as not all traffic is full scan) - Max concurrent sessions: 256,000 (plenty for 500 users) Step 3: Considering Acceleration. The PA-820 uses a dedicated Content Processor for hardware acceleration. Sarah knows this will handle the daily traffic without lag. She plans to enable all security features, including SSL decryption (inspecting encrypted traffic). This is CPU-intensive, but the CP helps accelerate known sessions.
Step 4: Planning for Redundancy. Sarah buys two PA-820 units and configures them for Active/Passive High Availability. She connects the HA ports (dedicated cables) between them. If the primary firewall fails, the secondary takes over in seconds.
Step 5: Deployment and Tuning. The new firewalls are installed. Sarah monitors the throughput via the Palo Alto interface (Panorama). She sees the 'Session Table' fill up with connections. She notices that during peak hours, about 20% of traffic takes the 'slow path' (new connections), while 80% uses the fast path (hardware accelerated). This confirms the hardware is working \u2014 it is offloading work from the CPU.
An IT professional must also upgrade the firewall software (PanOS) and sometimes replace the hardware when the company grows. For example, if BrightTech later upgrades to 5 Gbps internet, Sarah would need to migrate to a PA-5250 or use multiple firewalls in a cluster.
The PCNSE exam specifically tests your ability to match hardware models to performance scenarios and understand when hardware acceleration kicks in. Expect at least 5-7 questions on these topics.
Here are the exact concepts they love to test:
The difference between fast-path and slow-path processing. Questions will ask: 'A new TCP connection is initiated. Which processing path does the first packet take?' Answer: Slow path (goes to CPU for session setup). They will trap you with: 'A packet matches an existing session. Which path?' Answer: Fast path (handled by Content Processor).
Session table lookups. They love to ask: 'What is stored in the session table?' Answer: Source/destination IP, port numbers, security rule match, VLAN ID. They might ask: 'When does a session become eligible for hardware acceleration?' Answer: After the first packet completes slow-path processing and a session is created.
Performance numbers. You must memorise approximate throughput tiers for major families (PA-200, PA-800, PA-3200, PA-5200, PA-7000). Not exact numbers, but relative hierarchy. For example: 'Which model series is designed for a large enterprise data centre with 40 Gbps throughput?' Answer: PA-7000 series. They will give you a scenario like 'A hotel with 200 rooms needs a firewall for 500 Mbps.' Correct answer is PA-400 series (or similar).
Form factor traps. They ask about physical vs virtual. 'A company wants to run the firewall on their existing VMware server in their private cloud. What should they use?' Answer: VM-Series. Do not pick a hardware model.
High Availability specifics. 'In an active/passive HA setup, what happens to existing sessions when the primary fails?' Answer: They are dropped (unless session state synchronisation is enabled). Many beginners think sessions survive a failover without config.
Acceleration features: TCP offload, hardware-based checksum validation, and jumbo frames. They might ask: 'Which feature allows the firewall to bypass computing checksums for faster processing?' Answer: Hardware checksum offload.
Trap pattern: They give you a scenario with high new connection rate (many short-lived connections, like Denial-of-Service attempts). They ask what suffers. Answer: The slow path (CPU) will be overloaded because each new connection requires deep inspection. Hardware acceleration does not help here because there are no existing sessions to fast-path.
Key definitions to memorise:
Content Processor (CP): Dedicated chip for packet forwarding and session lookups.
Session Table: Database of active connections.
Flow Hashing: Algorithm to distribute traffic across multiple CPs.
Zero-Copy Forwarding: Packet is forwarded without copying to main CPU memory.
Throughput vs. New Sessions Per Second: Distinct metrics; a firewall can have high throughput but low session setup rate.
Hardware acceleration uses a dedicated Content Processor to handle packets of existing sessions without involving the main CPU.
The first packet of any new connection takes the 'slow path' through the CPU to create a session entry.
Performance is measured in firewall throughput, threat prevention throughput, VPN throughput, concurrent sessions, and new sessions per second.
Different form factors (desktop, rack-mounted, virtual) serve different scale requirements from small office to data centre.
High Availability pairs do not automatically preserve existing sessions unless session synchronisation is explicitly configured.
Virtual firewalls (VM-Series) lack dedicated hardware acceleration and are suited for cloud environments with lower throughput needs.
These come up on the exam all the time. Here's how to tell them apart.
Fast Path (Hardware Acceleration)
Handled by Content Processor (dedicated chip)
Uses zero-copy forwarding for minimal latency
Only processes packets matching existing session entries
Slow Path (CPU Processing)
Handled by general-purpose CPU
Requires full security policy and threat inspection
Processes the first packet of every new connection
Physical Firewall (e.g., PA-800)
Contains dedicated Content Processors for acceleration
Higher throughput and new session capacity
Form factor is a physical appliance (rack or desktop)
Virtual Firewall (VM-Series)
Runs on generic server CPU (no dedicated chips)
Lower throughput, especially for threat prevention
Deployed as a virtual machine on hypervisors or cloud
Firewall Throughput
Measures speed for simple packet filtering (no deep inspection)
Usually the highest throughput number on the datasheet
Achieved via hardware acceleration from the start
Threat Prevention Throughput
Measures speed with full security features enabled (IPS, antivirus)
Usually lower than firewall throughput due to CPU load
May require more frequent slow-path processing for new threats
Active/Passive HA
One firewall handles all traffic, the other is standby
Easier to configure and manage
Existing sessions are lost unless sync is configured
Active/Active HA
Both firewalls actively handle traffic (load balanced)
More complex setup with floating IPs
Sessions can be lost on failover unless stateful sync is enabled
Mistake
Hardware acceleration means the firewall never uses the CPU.
Correct
The CPU still handles the first packet of every new connection (slow path). Acceleration only applies to subsequent packets in an existing session.
Beginners think 'acceleration' means the chip does everything, but the CPU is still essential for rule checking and complex decryption.
Mistake
A virtual firewall (VM-Series) has the same performance as a physical model.
Correct
VM-Series relies on the host server's CPU and does not have dedicated Content Processors, so it performs slower, especially in threat prevention throughput.
The name 'firewall' seems abstract, but hardware matters. Virtual models are convenient but not matched for high throughput.
Mistake
If I have a 1 Gbps internet link, I need a firewall with 1 Gbps threat prevention throughput.
Correct
You typically only run full threat prevention on a portion of traffic (e.g., incoming email and web). Many apps like VoIP or Microsoft Teams don't need full scanning. You can oversubscribe slightly.
Beginners think all traffic gets the same inspection, but in reality, you can apply different security profiles to different traffic types.
Mistake
Higher concurrent session count always means a better firewall.
Correct
A firewall with 10 million concurrent sessions but only 100 new sessions per second is useless for bursty traffic. New sessions per second is equally important for real-world usage.
People focus on the largest number, but the exam tests balance between the two metrics.
Mistake
All models in a series (e.g., PA-800) support the same features.
Correct
Within a series, higher model numbers (e.g., PA-850 vs PA-820) offer more throughput, more memory, and sometimes additional interfaces. Features are similar but performance scales.
Beginners assume one model fits all, but the exam expects you to differentiate based on performance specs.
Mistake
SSL decryption does not affect hardware acceleration.
Correct
SSL decryption requires the firewall to break open encrypted traffic, which is CPU-intensive. Even with acceleration, decrypted traffic must be inspected in the slow path temporarily until a session is established.
Encryption is a common misunderstanding; people think acceleration bypasses all CPU work, but decryption is a heavy task.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Yes, hardware acceleration enables the 'fast path' for packets matching existing sessions, bypassing the CPU. The 'slow path' is for new sessions.
Yes, but the PA-220 is a desktop form factor. It can be placed on a shelf or mounted using optional rack-mount kits, but it is not designed for standard 19-inch racks like the PA-800 series.
By default, sessions are dropped. If session state synchronisation is enabled, the standby firewall has a copy and can resume connections without interruption.
No. Only packets that are part of an already-established session benefit. The first packet of every new connection is processed by the CPU (slow path).
Throughput measures how much data can be moved (like Gbps), while new sessions per second measures how fast the firewall can set up new connections. A firewall can have high throughput but low session setup rate.
Yes, VM-Series can run on VMware, Hyper-V, or KVM at your own site. But it will not have dedicated hardware acceleration, so performance will be lower than an equivalent physical model.
You've finished Core Concepts: Acceleration and Hardware Models. Continue through the PCNSE study guide to build a complete picture of the exam.
Done with this chapter?