topic Re: High Data Plane CPU because of DDOS or overutilization in General Topics

Knowledge sharing: High Data Plane CPU because of DDOS or overutilization (access to Palo Alto Auto Assistant may help)

nikoolayy1 — Mon, 14 Jun 2021 19:41:19 GMT

I have seen for example on a small firewall when the customer enables SSL decryption that the counters for work groups "ecdhe_key_gen", "flow_host " etc. jump. This may show that the firewall can't handle the ssl decryption or that there is an SSL DDOS attack:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmV2CAK

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClXwCAK

If you have access to the Palo Alto Auto Assistant tool (like F5 ihealth but for some reason Palo Alto gives access to this tool only to Partners) you can use it to better view such issue from the Tech support file. Otherwise use the logs and global counters in the articles I provided.

For more about Palo Alto logs and their meaning you can view:

https://live.paloaltonetworks.com/t5/general-topics/knowledge-sharing-palo-alto-general-logs-and-log-files-that-are/m-p/410110#M92552

Re: High Data Plane CPU because of DDOS or overutilization

S.Cantwell — Thu, 13 May 2021 00:22:17 GMT

Hello @nikoolayy1

I have a PA-220 and decrypt all of my traffic (minus 3 protected URL categories) and I do not notice slowdowns. I will acknowledge that I do see CPU spike, but I can confirm that I am not over-utilizing my FW. The smaller FWs do not have a network processor; everything is emulated in software, so there will be global counters that may be a misnomer or can be ignored.

Re: High Data Plane CPU because of DDOS or overutilization

nikoolayy1 — Thu, 13 May 2021 14:52:41 GMT

Yes but there is a limit to everything even to Palo Alto, which otherwise is a great firewall that is not just a server like the most other firewalls but a purpose build firewall for blocking advanced attacks. The example I talk about is that the customer firewall that was a small model I think 220 crashed and we used the Palo Alto Auto Assistant and a firewall tech support to see that the data plane delta of the max counters changed right before the crash (jumped like crazy) and it was related to SSL key generation and the number of hosts. The client mentioned that they rerouted a lot of client traffic to the firewall right before the crash it seems to have been too much for this model, so I am mentioning this to who sees similar issues about what can be checked if a higher model firewall is needed or if a Layer 7 DDOS has happened.

Re: High Data Plane CPU because of DDOS or overutilization

MP18 — Fri, 14 May 2021 00:20:43 GMT

@nikoolayy1

Also I have seen High DP utilization due to SSL decryption, Excess amount of traffic and also DDos.

Regards

Re: High Data Plane CPU because of DDOS or overutilization

nikoolayy1 — Fri, 14 May 2021 12:34:01 GMT

Yes and if the issue is still present then the Chrome tool Pan(w)achrome can also be used that is free and accessible by everyone not like the web tool Palo Alto Auto Assistant. There is also another web tool I think named PANS that can also view logs in a tech support file but it is primary for investigating issues with the control plane issues.

https://live.paloaltonetworks.com/t5/blogs/get-more-gui-functionality-using-pan-w-achrome/ba-p/178071

Re: Knowledge sharing: High Data Plane CPU because of DDOS or overutilization (access to Palo Alto Auto Assistant may help)

NikolayDimitrov — Mon, 28 Jun 2021 14:55:57 GMT

Another info is if the client has rebooted the firewall or if the firewall crashed the max counters will all jump when the firewall sees traffic and this is normal as the counters were reseted, so don't get confused.