topic debug dataplane packet-diag causes PA5050 to stop working? PAN-OS 4.1.7 in General Topics

debug dataplane packet-diag causes PA5050 to stop working? PAN-OS 4.1.7

sebastian — Mon, 26 Nov 2012 15:27:17 GMT

Hi,

today i tried to debug a packet flow via the "debug dataplane packet-diag" command.

I did that by using this guide.

Unfortunately this causes our PA5050 Active/Passive Cluster to complete stop working for a few minutes. :smileyangry:

Is this a known bug in PAN-OS 4.1.7?

I used a packet filter so cpu can't/should not be an issue.

Here my debug settings

> debug dataplane packet-diag show setting

DP 0:

--------------------------------------------------------------------------------

Packet diagnosis setting:

--------------------------------------------------------------------------------

Packet filter

Enabled: no

Match pre-parsed packet: yes

Index 1: 10.100.1.37[0]->10.242.3.22[80], proto 6

ingress-interface any, egress-interface any, exclude non-IP

--------------------------------------------------------------------------------

Logging

Enabled: no

Log-throttle: yes

Aggregate-to-single-file: yes

Output file size: 10489183 of 10485760 Bytes (full)

Features:

flow : basic

Counters:

--------------------------------------------------------------------------------

Packet capture

Enabled: no

Snaplen: 0

--------------------------------------------------------------------------------

DP 1:

--------------------------------------------------------------------------------

Packet diagnosis setting:

--------------------------------------------------------------------------------

Packet filter

Enabled: no

Match pre-parsed packet: yes

Index 1: 10.100.1.37[0]->10.242.3.22[80], proto 6

ingress-interface any, egress-interface any, exclude non-IP

--------------------------------------------------------------------------------

Logging

Enabled: no

Log-throttle: yes

Aggregate-to-single-file: yes

Output file size: 4869970 of 10485760 Bytes

Features:

flow : basic

Counters:

--------------------------------------------------------------------------------

Packet capture

Enabled: no

Snaplen: 0

--------------------------------------------------------------------------------

Re: debug dataplane packet-diag causes PA5050 to stop working? PAN-OS 4.1.7

kfindlen — Mon, 26 Nov 2012 16:30:04 GMT

Hello,

It appears that the packet filter was defined, but not enabled. This would cause the filter to be ignored and all traffic to be logged. To enable the filter use the command:

debug dataplane packet-diag set filter on

A helpful step to avoid load issues when doing captures and packet-diag logging is to always view counter output against the packet filter prior to enabling either a capture or log. You can do this with the command:

show counter global filter delta yes packet-filter yes

Run the above command a few times and look at the pkt_recv rate. Any value above 500 for logging, or above 1000 for a capture could potentially cause load issues on a 5000 series firewall. You should refine the filter to decrease the number of sessions being captured or logged to reduce the rate.

Thanks,

-- Kevin

Re: debug dataplane packet-diag causes PA5050 to stop working? PAN-OS 4.1.7

sebastian — Tue, 27 Nov 2012 13:39:28 GMT

Hello Kevin,

sorry sent the wrong screenshot.

The filter is/was on.

But I tried that now again to doublecheck, same issue.

It seems that the packet filtering doesnt work.

Take a look at the counter:

show counter global filter packet-filter yes

Global counters:

Elapsed time since last sampling: 205.860 seconds

name value rate severity category aspect description

--------------------------------------------------------------------------------

pkt_recv 14991383 27660 info packet pktproc Packets received

pkt_sent 60788 103 info packet pktproc Packets transmitted

In the releasenotes for 4.1.9 there is an issue solved, maybe thats my problem.
• 41347 – Packet capture filters were not filtering information accurately. The fix ensures that the pcap filters match the criteria defined on the device and accurately capture all relevant frames in the session.

Sebastian