topic Re: PANOS 10.2.4 VPC endpoint to interface mapping issue in VM-Series in the Public Cloud

PANOS 10.2.4 VPC endpoint to interface mapping issue

KimSiah — Mon, 25 Sep 2023 08:54:46 GMT

Just installed a new VM-Series Virtual NextGen Firewall w/ Threat Prevention - Bundle1 AWS.

Used the "request plugins vm_series aws gwlb associate .." command to link up some Gateway load balancer endpoints with the subinterfaces.

When I used the show plugins vm_series aws gwlb to check the mapping, I realized that the output randomly switch some interfaces and endpoints around. the follow diagram shown 2 consecutives run of the cmd.

I have an older version running on PANOS 8.0, which has no such problem. Also notice a higher CPU usage in this new FW compared to the old one even without any traffic. They are running on same machine type of m4.large.

Is this a problem with this new version or need some setup which I have missed ?

Re: PANOS 10.2.4 VPC endpoint to interface mapping issue

KimSiah — Thu, 28 Sep 2023 06:49:01 GMT

Seem like it does not affect the functionality, hopefully it is only a display problem.

Re: PANOS 10.2.4 VPC endpoint to interface mapping issue

AsiaPac-Peter — Fri, 08 Dec 2023 16:37:45 GMT

it will impact traffic.

Software Version

10.2.4-h4

AP_Peter@EC2_IHHGRP_UAT_FW_PA-1> show plugins vm_series aws gwlb

GWLB enabled : True
Overlay Routing : True
================================================
VPC endpoint Interface
================================================
vpce-0aa6a6d27cac9ed07 ethernet1/2.20
ethernet1/2.20 vpce-04c255eeaee79a9d6
vpce-0bae20a5580c5b6d8 ethernet1/2.10
ethernet1/2.10 vpce-0c7099d53c2542fd2
vpce-0c8390a7e31bae12 ethernet1/2.1

AP_Peter@EC2_IHHGRP_UAT_FW_PA-1>

Re: PANOS 10.2.4 VPC endpoint to interface mapping issue

AsiaPac-Peter — Fri, 08 Dec 2023 17:22:57 GMT

Software Version

11.0.0

it has same issue.