topic Re: No traffic being logged at all in General Topics

No traffic being logged at all

PaulAlto — Wed, 18 May 2016 12:32:49 GMT

Hello, we've got a bunch of virtual palo alto firewalls running 7.0.1. One set are running fine, largely configured with no issues. The other set are in a different environment, all the infrastructure is the same (same type of hypervisor, same version, all that) The only significant difference is that in the second environment, each PA is part of a HA pair.

Now, we're having all sorts of network issues here, could be related to a whole bunch of things other than the PA, but the thing that I'm trying to get working right now is traffic monitoring on the PA, this should help me debug everything else.

I've got traffic monitoring working in environment 1, but not in environment 2 with the clusters. I'm pretty sure I've done the same things in both, with the easiest way to get monitoring being to create an "allow any" and tell that to log. But even with that I get absolutely nothing on the PA log, not even when I run a continuous ping from the device.

Does anyone have any suggestions for debugging steps for this?

Re: No traffic being logged at all

kiwi — Wed, 18 May 2016 13:12:57 GMT

Hi,

Are you sure your traffic is going through the firewall or even reaching it ?

Is your ping being sourced from a DP interface ? By default your ping will go out the management interface.

Try a PCAP on the firewall to see how traffic is handled (if you're seeing any).

Verify the global counters to see if there's any weird counters that could explain this.

These might be useful :

https://live.paloaltonetworks.com/t5/Featured-Articles/Getting-Started-Packet-Capture/ta-p/72069

https://live.paloaltonetworks.com/t5/Learning-Articles/How-to-Troubleshoot-Using-Counters-via-the-CLI/ta-p/57496

Cheers !

-KiWi.

Re: No traffic being logged at all

reaper — Wed, 18 May 2016 13:22:19 GMT

Did you make sure to register and license the VM ? When a VM is first installed it will be able to provide basic functionality but will not log anything untill it is properly initialized

Re: No traffic being logged at all

Transporter — Thu, 19 May 2016 09:24:22 GMT

Yep, correct. Only VM 5.0.6 will be able to log session without the licenses installed. All higher version of the PA VM will NOT be able to "show " traffic log in the monitoring tab without serial number installed.

Re: No traffic being logged at all

PaulAlto — Thu, 19 May 2016 12:10:39 GMT

Ah, that would explain it. Does being unlicensed also restrict traffic in any way? That could explain some of the other problems we're seeing

Re: No traffic being logged at all

Transporter — Thu, 19 May 2016 12:36:38 GMT

For the simple traffic processing no. But without the licenses/serial number firewall only can have 200 active sessions at the time.