Monitor session end reason

[ifpilm]

Hello,

How to check what was the reason behind session end? I mean it could be RST, FIN or timeout from firewall.

Regards,

ifpilm

[pkruse]

Good morning,

The PAN does not provide a GUI display of the type of session end, however you can look at the session ID via the CLI ("show session id xxxx") take note of the timer and this will tell you if its a reset. Or if you require more detailed information you can do a PCAP and follow the steam from beginning to end.

~Phil

[rmonvon]

Beginning with PAN-OS 6.0, we can view the reason of the session via the CLI "show session id xxxx".  The reason is provided in the 'tracker stage firewall" as seen here: