topic PA-3020 Dataplane 100% in General Topics

PA-3020 Dataplane 100%

sgarvin — Mon, 14 Mar 2022 14:50:27 GMT

We have aggregated ports for the PA to "handle" what Consolidated has for us on a 2GB circuit. Is this a case where our 3020 can't handle the traffic we have or is excessive logging a more likely culprit. GoldSeal has our support and the need for immediate help is basically non existent. Any suggestions on how to determine dataplane issues or get around GoldSeal for someone to read our TAC file?

Re: PA-3020 Dataplane 100%

Mudhireddy — Mon, 14 Mar 2022 15:59:46 GMT

Try to generate the tech support file from the firewall web UI and verify the monitoring outputs of the data plane(DP).

and also using CLI commands > show running resources utilization

>Check is there any layer-2 loop in a network by disabling the LANB side interfaces.

Re: PA-3020 Dataplane 100%

sgarvin — Mon, 14 Mar 2022 16:56:49 GMT

Looks something like this:

> show running resource-monitor

Resource monitoring sampling data (per second):

CPU load sampling by group:
flow_lookup : 83%
flow_fastpath : 83%
flow_slowpath : 83%
flow_forwarding : 83%
flow_mgmt : 82%
flow_ctrl : 82%
nac_result : 83%
flow_np : 83%
dfa_result : 83%
module_internal : 83%
aho_result : 83%
zip_result : 83%
pktlog_forwarding : 83%
lwm : 0%
flow_host : 82%

CPU load (%) during last 60 seconds:
core 0 1 2 3 4 5
* 83 84 83 84 84

Re: PA-3020 Dataplane 100%

Mudhireddy — Mon, 14 Mar 2022 17:05:45 GMT

pls check the below KB and verify the outputs.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRTCA0

check which interface is utilizing more and is it L2 traffic ? loop?

and verify the high idle time out sessions and more info on sessions ids?