topic Resource-unavailable for http traffics in General Topics

Resource-unavailable for http traffics

Javith — Fri, 15 Jan 2016 16:52:07 GMT

Hi All,

Some of the sessions are ended with Resource-unavailable reasons. Almost all traffics in these sessions are web-browsing and some updates traffics on port-80.

All https-443 are working fine. this issue happened for 4 hours on last week.

checked here for describtion: https://www.paloaltonetworks.com/documentation/61/pan-os/newfeaturesguide/networking-features/session-end-reason-logging.html

Is there any way to resolve?. Please suggest

Re: Resource-unavailable for http traffics

Brandon_Wertz — Fri, 15 Jan 2016 19:18:31 GMT

What's the associated hadware?

Do you use any cloud based services?

How many users behind the PA device?

Re: Resource-unavailable for http traffics

syadav — Sat, 16 Jan 2016 09:18:11 GMT

Hi Javith,

May I know the following to have a little background of the issue ?

1. What is the panOS version on the firewall ?

2. Does the issue resolve by itself or you need to restart any services (like dataplane, or reboot the firewall etc ) ?

You may be able to see some indicators by setting the filters and check the global counters for any resource issues (like the ones mentioned in the link you provided).

If the load on the firewall is normal and no suspicious counters are seen the I would suggest you to open a case with Technical Support as this may be a software issue which needs to be investigated.

Hope this helps !

Re: Resource-unavailable for http traffics

Javith — Sat, 16 Jan 2016 19:07:31 GMT

Its PA-3020

May be users accessing some cloud services

concurrent session utlization was 2k only.

Re: Resource-unavailable for http traffics

Javith — Sat, 16 Jan 2016 19:11:33 GMT

Its 7.0.3.

Issue resolved after the reboot.

Firewall load is normal.

I will open the TAC case. Thanks

Re: Resource-unavailable for http traffics

Brandon_Wertz — Mon, 18 Jan 2016 14:54:35 GMT

The reason why I was asking about cloud usage and and internal users, was I was thinking maybe there was a NAT resource exhaustion.

If you're only set up with a single public IP and users, say, were going to O365 you might have reached a mathmatical limit to available NAT ports. Also there's a relatively low limit on SSL interception cabiliites for the 3020.

Re: Resource-unavailable for http traffics

syadav — Mon, 18 Jan 2016 15:47:34 GMT

Hi Brandon,

It is less likely to be NAT exhaustion issue since other traffic like HTTPS (and other) like is working fine (which would also use source NAT). This seem to be a software issue which would require deeper analysis by the Tech support team.