Is there a particular reason why this option is only available from the CLI?
Solved! Go to Solution.
@myky I comes to the Palo Alto architecture - the Mgmt interface is attached to the management plane, which is linux based and you can run tcpdump. All data interfaces are part of the firewall Data Plane which does its own separate packet processing.
I usually have to keep a cheat list like this:
tcpdump filter "dst 10.10.20.6 or src 10.10.20.6"
view-pcap mgmt-pcap mgmt.pcap
view-pcap no-dns-lookup yes no-port-lookup yes mgmt-pcap mgmt.pcap
Definitely more readable in WireShark for sure. If you have that option of accessing an scp server ... sometimes that's not available in my experience!
@craigomatic that is one of the reasons why l started this topic. Another thing with tcpdump, it is good for the basic connectivity check but for instance, if you would like to see RADIUS Access-Accept reply, in particular check for the attributes, tcpdump won't help((
If it's sent in clear text, with verbose commands and x offsets you should be able to see the packets. I've been able to grab ldap credentials on 389 like that. Not sure about radius. You have a whole other set of troubleshooting commands with auth, like below:
test authentication authentication-profile "CorpLDAP" username user password
Then you have to follow the authd.log:
tail follow yes mp-log authd.log
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!