topic Re: Route Cache in General Topics

Route Cache

mbs.admin — Mon, 10 Nov 2014 10:07:15 GMT

Hi,

We implemented PA3050 as internal firewall. We configured it as L3 and caters up to 200+ static routes. When we try to remove a single route in virtual router and commit, approximately 20 minutes before it takes effect. Is this normal in Palo Alto?

Thanks,

MBS

Re: Route Cache

HULK — Mon, 10 Nov 2014 13:09:51 GMT

Hello MBS,

AS per my understanding, this behavior is not expected on a PAN firewall.Do a show jobs all to see if the commit itself went fine?

Check show system resources for mgmtsrvr, devsrvr and routed and notice if one of them is abnormally high.

If possible, try restarting the management server and routed process

> debug software restart management-server

> debug software restart routed

Thanks

Re: Route Cache

hshah — Mon, 10 Nov 2014 13:59:35 GMT

Hi MBS,

With successful commit static route changes should be in effect. It shouldn't delay it by 1 minute. Most likely routed process has issue.

Kindly provide us output for

1. show system resource | match routed

2. show system resource | match dev

3. show system resource | match mgmt

If above values are close to 1000 Mb than its good to restart those processes. Commands to restart processes are.

> debug software restart devsrvr

> debug software restart routed

> debug software restart mgmtsrvr

Make sure you check usage before restarting any process.

Regards,

Hardik Shah

Re: Route Cache

mbs.admin — Mon, 10 Nov 2014 15:20:25 GMT

Hi HULK and hshah,

Thanks for the feedback. See below output as requested.

PA3050-Primary(active)> show system resources | match routed

2900 20 0 120m 20m 9904 S 0 0.5 0:45.05 routed

PA3050-Primary(active)> show system resources | match dev

2868 20 0 250m 116m 13m S 2 3.1 2:29.02 devsrvr

662 16 -4 1908 700 472 S 0 0.0 0:00.70 udevd

PA3050-Primary(active)> show system resources | match mgmt

2869 20 0 664m 477m 9020 S 0 12.7 4:55.33 mgmtsrvr

We also have this weird problem that one of our static route entry is automatically deleted. PANOS version is 6.0.5 h3. Any known issues about it?

Thanks,

MBS

Re: Route Cache

hshah — Mon, 10 Nov 2014 21:41:17 GMT

Hi Mbs,

None of the process is over utilized, hence logically I cant ask for process restart. Do you see any error logs in routed daemon.

less mp-log routed.log

Regards,

Hardik Shah

Re: Route Cache

HULK — Tue, 11 Nov 2014 03:59:45 GMT

Hello Mbs,

It would be better to open a ticket with Palo Alto TAC. They will identify, why the route information is not being pushed, even after a successful commit.

You may update below mentioned CLI output ( during commit) for a deeper analysis here too .

> show system resources | match mprelay

> tail follow yes mp-log routed.log

Thanks

Re: Route Cache

mbs.admin — Wed, 12 Nov 2014 10:42:07 GMT

Hi All,

Thank you for all your suggestions. It is a great help but I think it's time that we create a ticket for this. Not sure what's happening with my routes.

MBS