topic Re: Traffic logged in an interface in down state in General Topics

Traffic logged in an interface in down state

dept_tec_bcn — Wed, 18 Sep 2013 11:16:41 GMT

This is our scenario:

- A PA-200 with a subinterface tagged with VLAN ID 200.

- Connected to a Cisco Catalyst switch (trunk with VLAN ID 200 allowed).

- It has been working without problems.

Now, we want to divert traffic to a Cisco router with same IP address as PA-200.

We put Catalyst interface in shutdown state (where PA-200 is connected) at 10.52h.

- We can see interface in "down" state (red) in PA-200.

- We cannot ping this interface IP.

- There's no other interface in this security zone.

But, traffic log is showing that there's some traffic in this interface. How is it possible?

I attach some pictures.

Thank for your answers!

Re: Traffic logged in an interface in down state

Anon1 — Wed, 18 Sep 2013 11:56:56 GMT

These are most probably sessions which were started before the interface was shutdown. They stay in the session table until they idle out and then produce the session end log entry.

Re: Traffic logged in an interface in down state

apasupulati — Wed, 18 Sep 2013 15:37:26 GMT

As you can see from the log details, the session start time was at 10:42 and you have the log option set to log at session end (Type: end), log generated time: 12:09. So as pointed out by Anon, these might be the old sessions which timed out much later and a log was generated at session end.

Thanks,

Aditi