Interface shutting down

[mculbreth]

I have a VM-100 running 8.0.12.  I inherated this configuration from the previous network engineer.  I am quite new to PAN-OS and have found that an interface that faces the Internet is shutting down.  

I can cycle the port in the GUI, and able to ping to the Internet 1.1.1.1 and 8.8.8.8 and within my LAN for no more than 5 minutes then the interface goes down.  

Thinking about this I'm leaning towards some sort DOS trigger that shuts down the interface is configured somewhere.  

I would appreciate your thoughts and suggestions.  

[BPry]

@mculbreth,

It's unlikely to be a DoS policy, but it could have something to do with a Zone Protection profile if one has been inproperly configured. I would take a look at that first just to verify if you have one assigned to your zones or not, and then I would take a look at the system logs and see if the interface is attempting to do a DHCP update every 5 minutes that is mucking up the route table. 

[MP18]

Also did you check the physical connection?

does interface shutdown and comes back on its own?

Also as Bpry mentioned any zone protection applied to that interface?

[mculbreth]

@BPry 

Thanks,

There are Zone Protection policies defined and assigned to the interface.  I'll begin looking at those.  I looked through the logs and seen an excessive amount of hits on one policy, The firewall was trying to send logs to an IP that is not in the management network.  I took that IP out and removed the Management Profile from the interface.  Since this is a development environment I removed the Management Profile from the interface so we could do updates in that subnet.  

[mculbreth]

@MP18 

Thanks.  There are Zone Peotection polices applied.  I'm going to look at those on Monday.  The interface would not come back up after shutting down until I used the WebUI to close then open the port.  Physical connection is in place and works.

I looked through the logs and seen an excessive amount of hits on one policy, The firewall was trying to send logs to an IP that is not in the management network.  I took that IP out and removed the Management Profile from the interface.  Since this is a development environment I removed the Management Profile from the interface so we could do updates in that subnet.  

[BPry]

@mculbreth,

If you look at the threat logs on the firewall you should be able to see if your Zone Protection Profile is actually causing any traffic issues or not.