06-26-2016 08:01 AM - edited 06-26-2016 08:01 AM
Hello,
I tried to find a technote to explain how does ACC work, please help me to understand,
1. Where does ACC collect the data from?
2. Is traffic logging (log at session end) required for ACC to work?
3. Is ACC real time (with 15 minute delay)? How does it deal with long live active sessions with very low bit rate ?
Thanks,
E
06-26-2016 10:55 PM
1. Where does ACC collect the data from? Dataplane
2. Is traffic logging (log at session end) required for ACC to work? As the logs comes from dataplane, does not matter log at session needs to enabled or not
3. Is ACC real time (with 15 minute delay)? How does it deal with long live active sessions with very low bit rate ? It gives report only for the session which started and ended during the period which you have selected.. So long live session may not be included
06-27-2016 12:43 AM
Hi,
We have several articles that could help you out in understanding ACC.
The initial view on ACC is based on appstat database ... this comes directly from DP.
If you drill down in the ACC then you fall back to the trsum database which is dependant on the traffic logs ... notice how logging your traffic is important in this case.
Here are some articles that can help you understand ACC better :
https://live.paloaltonetworks.com/t5/Featured-Articles/Tips-amp-Tricks-FAQ-ACC-PAN-OS-7-0/ta-p/70860
07-08-2016 04:30 PM
Hi,
This is what I notice so far,
I have my cell phone enabled with Wi-Fi Assist which will setup an IPSec tunnel back to the carrier due to poor cell coverage.
1. When I got home, cell phone connects to home wifi and connects to carrier IPSec gateway.
2. Two hour later, review the ACC for last hour, I don't see the IPSec traffic in the inital ACC view.
3. I can see the session is ongoing by review fw session table. If I clear that session. Wait for 15 mins, and review the ACC, I see that application and session on the application usage. But it will show the bytes_sent and bytes_received at the time when the session is closed.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
