topic Re: Multiple PA-200 Firewall's lock up and require a reboot in order to function. in General Topics

Multiple PA-200 Firewall's lock up and require a reboot in order to function.

MikeJamrog — Thu, 16 Jun 2016 01:28:37 GMT

I have 24 PA-200 firewalls. They are running on PanOS 6.1.3. At random times the firewall will lock up and requires the device to be power cycled to restore connectivity. I have called Palo Alto support and them connect to one of the devices that had stopped forwarding traffic. This specific firewall I was able to connect to the outside management interface, but this is not the case all the time. Support told me the QOS queue was full and it was causing the issue. I disable qos on all my firewalls and this issue still happens. All these firewalls are connect to cable modems. This has been happening for awhile now and is completely random. I am wondering if anyone else is experinencing this?

Re: Multiple PA-200 Firewall's lock up and require a reboot in order to function.

taviss — Thu, 16 Jun 2016 04:48:20 GMT

What ISP and why kind of Cable modem? It would seem odd that it would fill the Q's up on that. Also what you running behind your pa-200? if your doing full threat and decrypt on it, maybe your over taking your data plane? On your dash board under system recourses what does your session count say?

Not sure if you have thought about upgrading the Pan on it, but we are running a number of PA devices in the 7 train and love it. No issues so far.

Re: Multiple PA-200 Firewall's lock up and require a reboot in order to function.

Raido_Rattameister — Thu, 16 Jun 2016 08:55:44 GMT

If your QoS was still enabled did QoS profile include class 4?

Class 4 has to be added to profile as it is default class. Even when no policy classifies traffic to class 4.

Re: Multiple PA-200 Firewall's lock up and require a reboot in order to function.

Transporter — Thu, 16 Jun 2016 09:06:04 GMT

Hi. Do you still have case open with Palo? I would go back to them and ask for another remote session to investigate a RCA.

Re: Multiple PA-200 Firewall's lock up and require a reboot in order to function.

MikeJamrog — Thu, 16 Jun 2016 19:01:40 GMT

The case is closed, I might be able to re-open it. The problem is, it is random, so I have to call when it happens and then I have to hope I am able to connect to the PA on the ouside management interface ip. Would you like me to see if I can re-open it? We are using Charter cable for the ISP, the devices behind the firewall are cisco 3560 and 2960 switches.