topic Unable to find the reason for packet drop in General Topics

Unable to find the reason for packet drop

network_020 — Fri, 17 May 2024 20:10:46 GMT

Hello,

In our Palo Alto the traffic is allowed on the firewall but it is not working. When we did packet capture we found that return traffic in drop stage. To find the cause of the packet drop I have set the filter using 'Manage Filters' in GUI then use the following command.

debug dataplane packet-diag set filter on

but I am unable to see any output in the command - show counter global filter packet-filter yes delta yes severity drop

What should be the approach to find the cause of packet drop by firewall.

Re: Unable to find the reason for packet drop

emr_1 — Tue, 21 May 2024 01:06:59 GMT

I would recommend not use "severity drop" on your command.

Here is one example, as described, there are some counter which is warning with packet drops

====

> show counter global name tcp_drop_out_of_wnd

Name: tcp_drop_out_of_wnd
Value: 0
Severity: Warning
Category: tcp
Aspect: resource
Description: out-of-window packets dropped

====

Re: Unable to find the reason for packet drop

OtakarKlier — Tue, 21 May 2024 22:01:28 GMT

Hello,

Check the unified logs in the gui. This should tell you everything you need to know if/where the traffic is getting dropped/blocked.

Regarsds,