Packets loss but no drops - VM Series, AWS, GWLB

DaveHillElavon — Wed, 26 Oct 2022 09:32:38 GMT

i have a server sending traffic on 443 through GWLB to my Palos and out to the internet

The logs all say 'aged out'

Packet capture reveals the SYN arriving wearing GENEVE, being de-encapsulated, source NATed and forwarded out Untrust

The SYN/ACK arrives on Untrust, but there is no record of the firewall forwarding these packets to GWLB and client - they just vanish

The drops packet capture is empty

This worked previously, but we had to rebuild Panorama after a disaster and a colleague has been 'hardening' the appliances

I suspect an error has been introduced but for the life of me I can't work out what it might be

Re: Packets loss but no drops - VM Series, AWS, GWLB

MIST3R_VIRTS3C — Fri, 11 Nov 2022 20:59:23 GMT

Hi Dave!

Hope all is well. I would recommend setting up packet filters and collecting the global counters if you have not done so yet...

How to check global counters for a specific source and destinat... - Knowledge Base - Palo Alto Networks

Feel free to provide the output for the global counters once you have them.