topic Re: Wildfire stopped working on PANOS 7.0.2 in General Topics

Wildfire stopped working on PANOS 7.0.2

nikonau — Mon, 14 Sep 2015 08:18:05 GMT

Hi All,

Have an issue with WF wherein it has completely stopped working on PANOS 7.0.2.

I have a ticket with 3rd party support and PA for this, just wondering if anyone has experience or knows the fix.

Mgmt interface is service route for wf public cloud - i am registered:

//

nickeo@chal-telehouse> show wildfire status

Connection info:
Signature verification: enable
Server selection: enable
File cache: enable

WildFire Public Cloud:
Server address: wildfire.paloaltonetworks.com
Status: Idle
Best server: ap-northeast-1.wildfire.paloaltonetworks.com
Device registered: yes
Through a proxy: no
Valid wildfire license: yes
Service route IP address: 10.6.15.241

The issue appears to be data plan related:

nickeo@chal-telehouse> debug wildfire dp-status

DP status:
DP: not connected

It appears content is not forward from data plane to mgmt interface to be uploaded to wf public cloud.

Can do test registration fine.

Any ideas would be greatly appreciated.

Cheers,

Nick

Re: Wildfire stopped working on PANOS 7.0.2

reaper — Mon, 14 Sep 2015 08:23:54 GMT

Hi Nick

you could try resetting the dp connection through:

> debug wildfire reset dp-receiver

Re: Wildfire stopped working on PANOS 7.0.2

nikonau — Mon, 14 Sep 2015 08:33:11 GMT

Hi There,

Ok tried that, no cigar.

nickeo@chal-telehouse> debug wildfire reset dp-receiver

nickeo@chal-telehouse>
nickeo@chal-telehouse>
nickeo@chal-telehouse>
nickeo@chal-telehouse> debug wildfire dp-status

DP status:
DP: not connected

(i waited a few mins between reset and status).

Is there a log i can pull for dp-receiver to shed light on why its not connecting?

Re: Wildfire stopped working on PANOS 7.0.2

nikonau — Tue, 15 Sep 2015 01:59:57 GMT

For anyone else that comes across this:

//
Please see Palo Alto's update as below:

After having a closer look there is a buffer leak on the dataplane

Software Pools
[ 0] software packet buffer 0 ( 512): 8938/32768 0x8000000039fe8680
[17] FPTCP segs ( 16): 1/32768 0x80000000b17e4be0

According to another similar case the FPTCP would cause the connection between DP and MP to drop

Workaround was to reboot the appliance - still finding out root cause:

nickeo@chal-telehouse> debug wildfire dp-status

DP status:
DP: 127.131.2.1:25792

Re: Wildfire stopped working on PANOS 7.0.2

nikonau — Tue, 22 Sep 2015 08:15:43 GMT

Summary:

Wildfire stopped inspecting and uploading files. This is problem is caused by a bug which is a buffer leak on the PA firewall dataplane.

From the >debug dataplane pool statistics, it is found that the available FPTCP segs and software packet buffer are exhausted.

Wildfire got disconnected from DP. This is observed by:
> debug wildfire dp-status

Restarting the device resolved this issue.

The fix of this bug is still under development by the Palo Alto engineering team.

The bug ID is 81868 – WildFire submission logs not updating.