topic Re: How does ACC work? in General Topics

How does ACC work?

nextgenhappines — Sun, 26 Jun 2016 15:01:54 GMT

Hello,

I tried to find a technote to explain how does ACC work, please help me to understand,

1. Where does ACC collect the data from?

2. Is traffic logging (log at session end) required for ACC to work?

3. Is ACC real time (with 15 minute delay)? How does it deal with long live active sessions with very low bit rate ?

Thanks,

Re: How does ACC work?

Roby_Sreejith — Mon, 27 Jun 2016 05:55:24 GMT

1. Where does ACC collect the data from? Dataplane

2. Is traffic logging (log at session end) required for ACC to work? As the logs comes from dataplane, does not matter log at session needs to enabled or not

3. Is ACC real time (with 15 minute delay)? How does it deal with long live active sessions with very low bit rate ? It gives report only for the session which started and ended during the period which you have selected.. So long live session may not be included

Re: How does ACC work?

kiwi — Mon, 27 Jun 2016 07:43:19 GMT

Hi,

We have several articles that could help you out in understanding ACC.

The initial view on ACC is based on appstat database ... this comes directly from DP.

If you drill down in the ACC then you fall back to the trsum database which is dependant on the traffic logs ... notice how logging your traffic is important in this case.

Here are some articles that can help you understand ACC better :

https://live.paloaltonetworks.com/t5/Featured-Articles/Tips-amp-Tricks-FAQ-ACC-PAN-OS-7-0/ta-p/70860

https://live.paloaltonetworks.com/t5/Management-Articles/Tips-amp-Tricks-How-to-Use-the-Application-Command-Center-ACC/ta-p/67342

https://live.paloaltonetworks.com/t5/Management-Articles/ACC-Shows-Different-Results-After-Clearing-Filters/ta-p/53006

https://live.paloaltonetworks.com/t5/Learning-Articles/Video-Tutorial-How-to-Use-the-Application-Command-Center-ACC/ta-p/67451

https://live.paloaltonetworks.com/t5/Featured-Articles/Tips-amp-Tricks-The-Application-Command-Center-ACC-for-PAN-OS-7/ta-p/68308

https://live.paloaltonetworks.com/t5/Featured-Articles/Tips-amp-Tricks-The-Application-Command-Center-ACC-for-PAN-OS-7/ta-p/68890

Re: How does ACC work?

nextgenhappines — Fri, 08 Jul 2016 23:30:33 GMT

Hi,

This is what I notice so far,

I have my cell phone enabled with Wi-Fi Assist which will setup an IPSec tunnel back to the carrier due to poor cell coverage.

1. When I got home, cell phone connects to home wifi and connects to carrier IPSec gateway.

2. Two hour later, review the ACC for last hour, I don't see the IPSec traffic in the inital ACC view.

3. I can see the session is ongoing by review fw session table. If I clear that session. Wait for 15 mins, and review the ACC, I see that application and session on the application usage. But it will show the bytes_sent and bytes_received at the time when the session is closed.