topic Re: Palo VM randomly stops forwarding traffic in General Topics

Palo VM randomly stops forwarding traffic

CobaltGroup — Tue, 09 Jul 2019 11:56:13 GMT

Hi all,

I have a new Palo Alto VM-100 running in Proof of concept on version 9.0.2-h4

I'm using a virtual wire to protect servers against all kinds of attacks, malware etc

Yesterday evening for the first time, everything behind the firewall went down. I could not reach any of the hosts behind the firewall.

After consulting with support, there was an update in the threats database with a bug in it.

I rolled back to previous application and threats version 8166-5525, and rebooted the firewall.

After this everything started to work again.

However this morning, again some issue, suddenly all traffic stops and all services go down.

I cannot find any kind of error message on the palo alto, and I made sure there have been no updates on the application and threats database.

Anybody else experienced this kind of issue, and how do you prevent this from happening?

Thanks

Cobalt

Re: Palo VM randomly stops forwarding traffic

OtakarKlier — Tue, 09 Jul 2019 13:44:38 GMT

Hello,

I would say contact support again. Also check your dynamic updates to make sure you are following best practices on content versions etc.

https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/threat-prevention/best-practices-for-content-and-threat-content-updates

I have mine set as the following:

AV: checks every hour but threshold at 4 hours

App/Threat: check once a day with a 12 hour threshold (so it waits a day)

Wildfire: every minute

Regards,

Re: Palo VM randomly stops forwarding traffic

CobaltGroup — Wed, 10 Jul 2019 11:22:16 GMT

Thank you for your reply.

We looked at the firewall with support when it was not working, but unfortunately support can't find the issue, so we have to troubleshoot more deeply, perhaps on hardware layer ...

Re: Palo VM randomly stops forwarding traffic

OtakarKlier — Wed, 10 Jul 2019 19:50:46 GMT

Or could be a new bug :(.

Re: Palo VM randomly stops forwarding traffic

CobaltGroup — Wed, 10 Jul 2019 20:15:10 GMT

That is of course possible.

So because support was not able to find anything, I have moved the connection of the virtual wire to broadcom chipset NICs instead of intel chipset NICs, to test if it's maybe related to the interfaces.

If the connections are still freezing, I'm going to move the firewall completely to a different box, to eliminate the fact that it might be hardware related.

Re: Palo VM randomly stops forwarding traffic

sherri_king — Tue, 10 Jan 2023 22:28:51 GMT

was the issue resolved by moving the to a broadcom NIC? Currently having an issue where traffic randomly stops.