topic Can't clear session from CLI in General Topics

Can't clear session from CLI

${userLoginName} — Fri, 28 Mar 2014 09:58:15 GMT

Running PANOS 6.0.1. I can't seem to clear a session from the CLI. Just tested on a PA-500 running 6.0.0-b42 and I have the same problem.

Anyone knows if this is a bug?

admin@PA-vm> show session all filter destination 212.x.x.x

--------------------------------------------------------------------------------

ID Application State Type Flag Src[Sport]/Zone/Proto (translated IP[Port])

Vsys Dst[Dport]/Zone (translated IP[Port])

--------------------------------------------------------------------------------

37676 ms-lync-base ACTIVE FLOW *NS 10.123.48.19[52444]/L3-LAN/6 (84.x.x.x[49836])

vsys1 212.x.x.x[443]/L3-Internet (212.x.x.x[443])

admin@PA-vm> clear session id 37676

session 37676 cleared

admin@PA-vm> show session all filter destination 212.x.x.x

--------------------------------------------------------------------------------

ID Application State Type Flag Src[Sport]/Zone/Proto (translated IP[Port])

Vsys Dst[Dport]/Zone (translated IP[Port])

--------------------------------------------------------------------------------

37676 ms-lync-base ACTIVE FLOW *NS 10.123.48.19[52444]/L3-LAN/6 (84.x.x.x[49836])

vsys1 212.x.x.x[443]/L3-Internet (212.x.x.x[443])

admin@PA-vm>

Re: Can't clear session from CLI

HULK — Fri, 28 Mar 2014 13:28:53 GMT

Hello Sir,

Could you please check the session details with below mentioned command:

admin@PA-vm> show session id 37676 >>>>Then verify the session start time.

Clear the session admin@PA-vm> clear session id 37676

Again, verify the same session ID: admin@PA-vm> show session id 37676 >>>>>>> check session start time, if this is showing the same start time.

Try to clear the same session from the session browser and let us know the result.

Thanks

Re: Can't clear session from CLI

${userLoginName} — Fri, 28 Mar 2014 15:23:26 GMT

admin@PA-vm> show session id 30711 | match start

start time : Fri Mar 28 16:17:33 2014

admin@PA-vm> clear session id 30711

session 30711 cleared

admin@PA-vm> show session id 30711 | match start

start time : Fri Mar 28 16:17:33 2014

Note: session 30711 is my ssh session to one of the dataplane ports of the Palo Alto, so clearing it should disconnect me. (Just as an example, other sessions can also not be cleared from the CLI)

When pressing the cross in the session browser for the session with ID 30711, the cross disappears, all information remains on the page about the session, the ssh session keeps on running and I get the same info for:

admin@PA-vm> show session id 30711 | match start

start time : Fri Mar 28 16:17:33 2014

Re: Can't clear session from CLI

knarra1 — Sat, 29 Mar 2014 02:43:57 GMT

In 6.0 there is issue with clearing the session with ID and identified as bug. It would be fixed in later maintenance release (probably 6.0.2). Can you try clearing the session by using filters than specific session id and that should clear the session eg: > clear session all filter source destination application SSH

Re: Can't clear session from CLI

HULK — Sat, 29 Mar 2014 02:57:19 GMT

Hello,

It it your production firewall or a test FW..?

Thanks

Re: Can't clear session from CLI

prb — Mon, 31 Mar 2014 17:28:10 GMT

I ran into this as well after upgrading to 6.0, I tried multiple iterations of clearing session with ID with no luck,

later gave a shot using specific filter conditions and was able to get it cleared.

Re: Can't clear session from CLI

${userLoginName} — Tue, 01 Apr 2014 09:40:56 GMT

HULK Both Palo Alto I ran it on are in a lab.

prb Thanks, clearing the session with "clear session all filter ..." works

Re: Can't clear session from CLI

sspringer — Tue, 01 Apr 2014 17:23:00 GMT

knarra1 is correct - This issue should be fixed in 6.0.2.

Re: Can't clear session from CLI

${userLoginName} — Fri, 25 Apr 2014 21:30:49 GMT

For documentation purposes: fixed in 6.0.2