Firewall PA doesn't process network traffic.

[Miguel-Andrade]

Hi everyone! First, sorry 'cause my English is not good.

My issue don't let me sleep. My firewall (PA-3410 v11.0.0-h1) doesn't process traffic, I can't do ping at other interface than MGMT. The Monitor is clear!.

The only thing I have observed is that the traffic reaches the MAC interface, but the CPU counter does not increase.

After a few minutes sending ICMP and HTTPS traffic, it shows this:

Any idea?

[BPry]

@Miguel-Andrade,

Do you have an interface management profile that would allow you to ping interfaces? By default, the firewall isn't going to have ICMP active on an interface address. Likewise the intrazone-default policy doesn't have logging enabled by default (nor does the interzone-default policy), so you may simply not be passing any traffic that would actually be logged. Without knowing how you've configured your security rulebase it's impossible to know if that's a real issue or not.

[Miguel-Andrade]

Yes I do.

Inter-zone traffic doesn't show it. Logs at the policy are enable. It's not the first time it's happened to me, I still haven't solved the previous case.

[Brandon_Wertz]

Is there a reason why you're running PAN-OS version 11.0.X?  If there's not a specific feature that's in 11.0.X and you can run 10.2.X my suggestion would be downgrade to 10.2.7hx or 10.2.8.  If you need to run 11.0, I would run the latest preferred version of 11.0.  Especially with the new 3400 platform I've ran into a bunch of weird issues.