topic Re: Management Interface traffic logs in General Topics

Management Interface traffic logs

networkzeus — Tue, 23 May 2017 13:17:43 GMT

Hi guys,

Is there a way to see traffic logs of management traffic? I'm trying to troubleshoot user-id redistribution source from the management interface.

Thanks

NetWorkZeus

Re: Management Interface traffic logs

TranceforLife — Tue, 23 May 2017 13:26:26 GMT

MGMT (out of band interface) cannot be a part of the zone, so no traffic logs can be generated. but you still can do a PCAP if that is helps;

https://live.paloaltonetworks.com/t5/Management-Articles/How-To-Packet-Capture-tcpdump-On-Management-Interface/ta-p/55415

Re: Management Interface traffic logs

Raido_Rattameister — Tue, 23 May 2017 13:54:14 GMT

One big advantage of Palo is seperate dataplane (network ports, HA2, HA3) and control plane (mgmt port, HA1).

Even smallest 2 core firewall has one cpu core dedicated for checking passthrough traffic and other for management.

As a result you can manage the box even if you are under attack or your dataplane is fully utilized.

For that reason you can't use regular packet capture but have to use tcpdump that @TranceforLife pointed out.

Re: Management Interface traffic logs

networkzeus — Fri, 26 May 2017 12:21:28 GMT

Awesome thats what I was after!

Thanks