topic PA3020 - receive errors and output errors. in General Topics

PA3020 - receive errors and output errors.

MPI-AE — Mon, 12 Jun 2017 09:21:07 GMT

Hey!

I don't know if that's a real problem:

I have a PA-3020 and its internal interfaces are connected to a Cisco 3850 Switch (copper, 1000 Base T)

When I do a "show interface ethernet1/5" on the firewall, the receive errors are permanently increasing.

On the cisco switchport, there are a lot of output errors.

The cables are new.

Is anyone in the same situation?

Thanks in advance!

Re: PA3020 - receive errors and output errors.

TranceforLife — Mon, 12 Jun 2017 09:26:52 GMT

Hi,

Post the output of the show interface command, please:

> show interface ethernet1/5

The possible events and packets could be the following incorrect length of VLAN tag, unexpected VLAN tag, unsupported L2 protocol, incorrect IP checksum, TCP/UDP packet checksum error, TCP/UDP port 0, Invalid TCP flag, etc.

https://live.paloaltonetworks.com/t5/Learning-Articles/The-Difference-Between-Receive-Errors-for-Hardware-and-Logical/ta-p/59039

Re: PA3020 - receive errors and output errors.

MPI-AE — Mon, 12 Jun 2017 09:37:29 GMT

Re: PA3020 - receive errors and output errors.

TranceforLife — Mon, 12 Jun 2017 09:53:06 GMT

Hi,

The above-mentioned article explains receive errors counters. So what is happening on the Cisco side? What can you see in the logs or in the interface counters?

Re: PA3020 - receive errors and output errors.

MPI-AE — Mon, 12 Jun 2017 12:08:10 GMT

I get that on the switch port:

But I get that on many interfaces. Very likely that it's a bug of the 3850.

And I figured out that the receive error on the firewall interfaces increments every 10 seconds.

That is when the switch sends out a keepalive.

So maybe everything is fine?!

Re: PA3020 - receive errors and output errors.

TranceforLife — Mon, 12 Jun 2017 12:39:14 GMT

I am not Cisco expert but l think you are on the right way:

https://supportforums.cisco.com/discussion/13018581/catalyst-3850-high-total-output-drops-and-output-errors

Re: PA3020 - receive errors and output errors.

MPI-AE — Mon, 12 Jun 2017 15:13:13 GMT

I will try it!

I have a last question: I have a Aggregate Link on the Palo Alto with two interfaces.

The option "LACP" is disabled.

I get a lot of outpot errors on these interfaces.

Should I enable LACP on the ae and on the switch?

Re: PA3020 - receive errors and output errors.

TranceforLife — Mon, 12 Jun 2017 15:18:18 GMT

Sorry not an LACP guru but I believe it should be enabled from the both sides and at least one side should be active:

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-LACP/ta-p/65837

Re: PA3020 - receive errors and output errors.

MPI-AE — Mon, 12 Jun 2017 15:32:58 GMT

Thanks for the link!

Maybe someone else can share his experiences to do a normal etherchannel or a LACP etherchannel?