topic Re: packet capturing pa in General Topics

packet capturing pa

sib2017 — Sat, 19 Mar 2016 22:13:04 GMT

Hi,

in packet capture , what is actually firewall stage type ? .

Why thers is rx and tx separate ?

sorry for asking a fuzzy question ?

Thanks

Re: packet capturing pa

Raido_Rattameister — Sat, 19 Mar 2016 22:31:06 GMT

receive stage is captured when firewall gets the packet on ingress interface.

firewall stage is when it is processed by firewall engine.

transmit stage is when packet is sent out from egress interface.

drop stage is when it is dropped at any of those stages.

You need diferent stages if you troubleshoot NAT issues for example.

Then it is handy to compare receive and transmit stage to see if your NAT works correctly and changes source/destination IP of outgoing packet.

Same example applies also for troubleshooting SIP traffic issues etc.

Re: packet capturing pa

sib2017 — Sat, 19 Mar 2016 23:16:13 GMT

Thanks man ,

You are always helpful . if pa is in vwire mode , either rx or tx is enough ?

Thank you again

Re: packet capturing pa

Raido_Rattameister — Sat, 19 Mar 2016 23:34:54 GMT

vw mode can throw away packets also.

Lets assume you have zone protection profile to drop fragmented packets.

RX sees them but they are dropped then and nothing is sent out.

Also you apply policies in vw mode also.

I usually start only with receive and drop and sometimes transmit.

receive will show received packets from client side and server side.

drop shows if anything was dropped.

You might care about firewall stage if you want to compare if packet was thrown away right after it was received or later in the stage.

Re: packet capturing pa

sib2017 — Sun, 20 Mar 2016 14:25:53 GMT

Hi,

1 ) PA in vw , qos applied on trust interface and is it good to capturing packet on untrust or trust ?

2 ) I Have a strange issue is like if i download any files it takes very long time .
I don't it is ISP issue or firewall issue .How can i narrow down the issue ?
I just want to make sure palo alto not doing any strange activities ?

below is my topology
core switch -----------trust [PA] untrust---------inside[ASA]outside...WAN ROUTER

Thanks

Re: packet capturing pa

Raido_Rattameister — Mon, 21 Mar 2016 09:25:04 GMT

You can compare receive/transmit times in packet to see how long Palo takes to process.

Disable security profile on the traffic temporarily to see if you see different result.

Re: packet capturing pa

Brandon_Wertz — Tue, 22 Mar 2016 14:22:46 GMT

@sib2017 Just an FYI...Palo's GUI help is context sensitive so if you go to the 'packet capture' area in monitor then go to help in the top right there, it pops up a window with specific info for the screen you were just at.

If you scroll down you'll see there is detailed info for for each of the stages.

As the help is conext sensitive you can follow the same process for other areas fo the appliance in the future to provide info on other functions as well.

Re: packet capturing pa

sib2017 — Thu, 31 Mar 2016 03:57:11 GMT

Hi,

I am using assymteric path ( active -active ). So i believe it is very difficult using packet analysis . Actually i have severe issue like when users are downloding files it takes much longer time than expected .How can i verify PA is not doing any abnormal activities

Thanks

Re: packet capturing pa

santonic — Thu, 31 Mar 2016 06:43:23 GMT

Can you connect a PC directly to ISP and test downloading speed without traffic going through PA?

Do you use a proxy of some sort? Or some other device in your download path?

Try to eliminate devices on path 1 by 1.

I guess you already checked data plane CPU and it isn't high?