topic Re: Wrong Traffic Reports in ACC in General Topics

Wrong Traffic Reports in ACC

shabeerc — Tue, 19 Jul 2011 06:27:36 GMT

Wrong user traffic in ACC than the actual traffic.

Here we are monitoring our server Farm using Tap mode with our Palo Alto

In ACC we can see very high traffic from some Domain/User or IP to some servers.Lets say some users making 20 gb traffic Exchange server or other servers with in Hour.If you look at the detailed traffic there is no such traffic for that specific user.We noticed this with PAN-OS 3.1.8,4.0.1 and 4.0.3 versions from different places.Is it a bug or any other issue

Thanks

Shabeer

Re: Wrong Traffic Reports in ACC

mrajdev — Tue, 19 Jul 2011 14:30:16 GMT

Hi Shabeer,

Can you please let us know which PA firewall model are you seeing this issue on?

Thanks

Re: Wrong Traffic Reports in ACC

Jamiefitzgerald — Tue, 19 Jul 2011 17:22:56 GMT

The application traffic shown in the first table in the ACC is collected regardless of your log settings. So when you say that you look at the traffic logs and do not see the same statistics, it is possible that you are not logging that data, or that the log data is not reflective of the entire time frame shown in the ACC. I hope this helps. Thanks,

~Jamie

Re: Wrong Traffic Reports in ACC

shabeerc — Tue, 19 Jul 2011 17:48:27 GMT

Hi All

I am Using PA-4020 with PAN-OS 3.1.8 and PA-5020 with PAN-OS 4.0.3.The report in ACC from a user to exchange is 20 GB which is impossible in this network. Also after some time the large traffic pointed to another user

Thanks

shabeer

Re: Wrong Traffic Reports in ACC

mrajdev — Tue, 19 Jul 2011 22:14:38 GMT

Hi Shabeer,

Can you please open up a case for support to investigate this issue further.

Thanks