PAN-OS 11 interface counter descriptions

simonlaffan — Wed, 06 Sep 2023 00:39:34 GMT

We've recently deployed PAN-OS 11.0.1-h2 in production on some PA-1400's (terrifying, I know).

Practically, the firewalls seem to be functionally identical to the firewalls they're replacing. However, we've noticed that the "receive errors" counters are incrementing at a steady rate (3-5 per second). We believe the culprit to be the following global counter:

>show counter global filter severity drop delta yes

flow_ingress_ifp_lookup_ifmap_fail Description: Packets dropped: unable to lookup main interface

Does anyone have any knowledge for what this counter actually records? The counter name and description don't appear to have been documented anywhere (searching for either as a string returns zero results on Google). Our Premium support from PA have failed to acknowledge the existence of these counters, let alone provide any context as to what they record.

Re: PAN-OS 11 interface counter descriptions

ozheng — Mon, 11 Sep 2023 08:22:27 GMT

Hello Simonlaffan,

First of all, running on the 11.0.1-h2 for PA-1400 is almost the recommended action (the only difference between 11.0.1 and 11.0.1-h2 are the hotfixes, unless you affected by one of the 5 fixes, it is roughly the same as 11.0.1 - which is the preferred version).

https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-p/258304

Regarding the counter, I would suggest to run a pcap (no filter, only the dropped packets) to see what is actually dropped.
(it may be a noise counter).

Olivier

topic PAN-OS 11 interface counter descriptions in Next-Generation Firewall Discussions

PAN-OS 11 interface counter descriptions

Re: PAN-OS 11 interface counter descriptions