topic PAN-88671 in General Topics

PAN-88671

nextgenhappines — Tue, 13 Mar 2018 14:16:16 GMT

Hello,

In PANOS 8.0.8 release, now can disable or enable the L4 checksum checking.

How do I check if my 5200 firewall L4 checksum is enabled or disabled?

How do I check if traffic is dropped due the L4 checksum?

Thanks,

Re: PAN-88671

reaper — Thu, 15 Mar 2018 11:56:56 GMT

enabled
admin@PA-5250> show system state | match l4
cfg.hw.fe100: { 'cfg_mode': 4, 'l4_chk_sum': 1, 'usecase': 1, 'v4_v6_choice': 2, }

disabled
admin@PA-5250> show system state | match l4
cfg.hw.fe100: { 'cfg_mode': 4, 'l4_chk_sum': 0, 'usecase': 1, 'v4_v6_choice': 2, }

these counters will increment when the firewall discards packets: :flow_fpga_rcv_igr_L4CHKSUMERR

Re: PAN-88671

nextgenhappines — Thu, 15 Mar 2018 13:25:05 GMT

Hi Reaper,

I don't see this counter increased (or listed when I run show counter global filter delta yes packet-filter yes ) until I have the pre-parse match enabled.

Re: PAN-88671

reaper — Thu, 15 Mar 2018 13:44:06 GMT

Then I would think it likely no packets are being discarded by this check in the first place

are you seeing this counter pop up: flow_fpga_ingress_exception_err

Re: PAN-88671

nextgenhappines — Thu, 15 Mar 2018 14:15:16 GMT

None of that counter as well, flow_fpga_ingress_exception_err

TAC and I compare the packet captures on the firewall vs on the span port from the switch below the firewall. Packets are getting dropped by the firewall. The counters mentioned were not showing up until you have pre-parse match enabled.

Re: PAN-88671

Karim.Benyelloul — Tue, 15 Jan 2019 14:28:39 GMT

Hi reaper,

Could you please tell me when the counter : flow_fpga_ingress_exception_err pop up ?

Many thanks ,

Kairm

Re: PAN-88671

reaper — Thu, 17 Jan 2019 21:58:25 GMT

hi @Karim.Benyelloul

thats a bit of an open ended question as i cannot tell you wjhen exactly that counter will pop up, it will be part of a larger set of symptoms rather than a 'this counter increments when x is happening'

it is counted when an error occurs when the fpga tries to intake a packet, which can happen due to different reasons