topic Re: Interface Errors after upgrade - VM Series in Next-Generation Firewall Discussions

Interface Errors after upgrade - VM Series

ftrabalsini — Fri, 14 Mar 2025 10:21:55 GMT

Hello,

we upgraded our Palo Alto VM to 11.1.6-h1, after the upgrade the monitoring system gave us warning about the errors increasing on the Firewall interfaces but the clients did not report any issues, so it's not affecting them at all,

this is what i see on one of them:

 admin@paloaltoVM(active)> show interface ethernet1/5

--------------------------------------------------------------------------------
Name: ethernet1/5, ID: 20
Link status:
Runtime link speed/duplex/state: 10000/full/up
Configured link speed/duplex/state: auto/auto/auto 
MAC address:
Port MAC address 00:50:56:bb:70:46
Interface Type :
Port Type: RJ45
Capability : auto, 10Mb/s-half, 10Mb/s-full, 100Mb/s-half, 100Mb/s-full, 1Gb/s-half, 1Gb/s-full, 10Gb/s-half, 10Gb/s-full, 25Gb/s-half, 25Gb/s-full, 40Gb/s-half, 40Gb/s-full, 100Gb/s-half, 100Gb/s-full
Operation mode: layer3
Untagged sub-interface support: no
--------------------------------------------------------------------------------
Name: ethernet1/5, ID: 20
Operation mode: layer3
Interface management profile: N/A
Service configured: 
Zone: N/A, virtual system: vsys1
Adjust TCP MSS: no
Policing: no
Proxy protocol: no
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
Physical port counters read from MAC:
--------------------------------------------------------------------------------
rx-broadcast 0
rx-bytes 99002301342
rx-multicast 0
rx-unicast 296263734
tx-broadcast 0
tx-bytes 73349693608
tx-multicast 0
tx-unicast 179267739 
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
Detailed physical port counters read from MAC:
-------------------------------------------------------------------------------- 
mac receive error 55574672 
--------------------------------------------------------------------------------

Hardware interface counters read from CPU:
--------------------------------------------------------------------------------
bytes received 99002321016
bytes transmitted 73341214170
packets received 296263835
packets transmitted 179267891
receive incoming errors 55574672
receive discarded 0
receive errors 55574672
packets dropped 0
--------------------------------------------------------------------------------

Logical interface counters read from CPU:
--------------------------------------------------------------------------------
bytes received 35020249
bytes transmitted 0
packets received 97009
packets transmitted 0
receive errors 0
packets dropped 97009
packets dropped by flow state check 0
forwarding errors 0
no route 0
arp not found 0
neighbor not found 0
neighbor info pending 0
mac not found 0
packets routed to different zone 0
land attacks 0
teardrop attacks 0
ip spoof attacks 0
mac spoof attacks 0
ICMP fragment 0
layer2 encapsulated packets 0
layer2 decapsulated packets 0
tcp cps 0
udp cps 0
sctp cps 0
other cps 0
--------------------------------------------------------------------------------

where should i start to troubleshoot this ?

I didn't found any known issue in PANOS 11.1.0 related to this behavior,

regards,

Francesco

Re: Interface Errors after upgrade - VM Series

Justin_Steil — Sat, 22 Mar 2025 09:00:00 GMT

I has a similar issue and my issue was resolved by adjusting the mtu and mss values of the interface reporting the issue.
Use the cli command to work out the mtu value..
ping do-not-fragment no size 1350 source x.x.x.x host 1.1.1.1
---------------------------------------
mtu size to large
ping do-not-fragment no size 1360 source x.x.x.x host 1.1.1.1
PING 1.1.1.1 (1.1.1.1) from x.x.x.x : 1360(1388) bytes of data.
From 127.130.1.254 icmp_seq=1 Frag needed and DF set (mtu = 1360)
1368 bytes from 1.1.1.1: icmp_seq=2 ttl=56 time=3.99 ms
-----------------------------------------
mtu size ok
ping do-not-fragment no size 1350 source x.x.x.x host 1.1.1.1
PING 1.1.1.1 (1.1.1.1) from x.x.x.x : 1350(1378) bytes of data.
1358 bytes from 1.1.1.1: icmp_seq=1 ttl=56 time=2.60 ms
1358 bytes from 1.1.1.1: icmp_seq=2 ttl=56 time=2.96 ms

Re: Interface Errors after upgrade - VM Series

ftrabalsini — Mon, 24 Mar 2025 08:07:20 GMT

Hi Justin,

i'll try this workaround, but i can't do it anytime since this VM is in production,

i even have opened a case with the support,

regards

Re: Interface Errors after upgrade - VM Series

SergioSegovia — Tue, 15 Apr 2025 08:46:06 GMT

Hi @ftrabalsini

Did you get a response from the PaloAlto TAC to the open case?

Greetings.

Thank you.

Re: Interface Errors after upgrade - VM Series

ftrabalsini — Wed, 23 Apr 2025 07:31:20 GMT

Hi @SergioSegovia,

we found that in this version they addressed an issue which is our case:

11-1-6-h1-addressed-issues

and it seems a bug since it is still present,

regards,

Francesco

Re: Interface Errors after upgrade - VM Series

Justin_Steil — Wed, 23 Apr 2025 08:12:48 GMT

My original recommendation of adjusting the mtu would probably work if you had a real mtu issue. I can confirm that roughly all of my firewalls are reporting these mac errors after the upgrade to version 11.1.6.h3 from 10.2. So i agree , i don't think the issue has been fixed.

Re: Interface Errors after upgrade - VM Series

SergioSegovia — Thu, 24 Apr 2025 06:44:59 GMT

Thanks @ftrabalsini

In our case the FWs are also physical. In your case open to TAC have you reported the related Pan-id bug?

Greetings.

Sergio.

Re: Interface Errors after upgrade - VM Series

SergioSegovia — Thu, 24 Apr 2025 06:47:36 GMT

Thanks @Justin_Steil

Let's hope then that this bug will be solved with a new update and can be reported in the official release notes.

Regards.

Sergio.