Palo VM randomly stops forwarding traffic

Reply
L2 Linker

Palo VM randomly stops forwarding traffic

Hi all,

 

I have a new Palo Alto VM-100 running in Proof of concept on version 9.0.2-h4

I'm using a virtual wire to protect servers against all kinds of attacks, malware etc

 

Yesterday evening for the first time, everything behind the firewall went down. I could not reach any of the hosts behind the firewall.

After consulting with support, there was an update in the threats database with a bug in it.

I rolled back to previous application and threats version 8166-5525, and rebooted the firewall.

After this everything started to work again.

 

However this morning, again some issue, suddenly all traffic stops and all services go down.

I cannot find any kind of error message on the palo alto, and I made sure there have been no updates on the application and threats database.

 

Anybody else experienced this kind of issue, and how do you prevent this from happening?

 

Thanks

Cobalt

 

L7 Applicator

Re: Palo VM randomly stops forwarding traffic

Hello,

I would say contact support again. Also check your dynamic updates to make sure you are following best practices on content versions etc.

https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/threat-prevention/best-practices-for-conte...

 

I have mine set as the following:

AV: checks every hour but threshold at 4 hours

App/Threat: check once a day with a 12 hour threshold (so it waits a day)

Wildfire: every minute

 

Regards,

L2 Linker

Re: Palo VM randomly stops forwarding traffic

Thank you for your reply.

 

We looked at the firewall with support when it was not working, but unfortunately support can't find the issue, so we have to troubleshoot more deeply, perhaps on hardware layer ...

 

L7 Applicator

Re: Palo VM randomly stops forwarding traffic

Or could be a new bug :(.

L2 Linker

Re: Palo VM randomly stops forwarding traffic

That is of course possible.

 

So because support was not able to find anything, I have moved the connection of the virtual wire to broadcom chipset NICs instead of intel chipset NICs, to test if it's maybe related to the interfaces.

 

If the connections are still freezing, I'm going to move the firewall completely to a different box, to eliminate the fact that it might be hardware related. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!