Hi Guys,
Following on from my last post - Site-to-Site VPN - Palo alto to Cisco Router issue
i am experiencing an issue with my PA VM100, there is nothing in the traffic logs....
this is running on VMWare workstation 11
But there is traffic flowing through the firewall 100%, it is functioning perfectly, with the exception of the lack of traffic logs 
Here is the output of sh log traffic
admin@PA-VM> show log traffic
Time App From Src Port Source
Rule Action To Dst Port Destination
Src User Dst User End Reason
===============================================================================
admin@PA-VM>
Hi Parmas,
Yep they are very simple; permit all from in to out and out to in, this is just a lab, all rules logging at session start and end.
I ran a packet capture for all stages, all are picking up packets;
admin@PA-VM> show session all
--------------------------------------------------------------------------------
ID Application State Type Flag Src[Sport]/Zone/Proto (translated IP[Port])
Vsys Dst[Dport]/Zone (translated IP[Port])
--------------------------------------------------------------------------------
901 ping ACTIVE FLOW 172.16.2.100[30501]/Outside/1 (172.16.2.100[30501])
vsys1 172.16.1.100[18]/Inside (172.16.1.100[18])
351 ciscovpn ACTIVE FLOW 192.168.3.2[500]/Outside/17 (192.168.3.2[500])
vsys1 192.168.3.100[500]/Outside (192.168.3.100[500])
825 ipsec-esp ACTIVE TUNN 192.168.3.2[5378]/Outside/50 (192.168.3.2[52372])
vsys1 192.168.3.100[63229]/Outside (192.168.3.100[4975])
898 ping ACTIVE FLOW 172.16.2.100[30245]/Outside/1 (172.16.2.100[30245])
vsys1 172.16.1.100[17]/Inside (172.16.1.100[17])
896 ping ACTIVE FLOW 172.16.2.100[29221]/Outside/1 (172.16.2.100[29221])
vsys1 172.16.1.100[14]/Inside (172.16.1.100[14])
897 ping ACTIVE FLOW 172.16.2.100[29733]/Outside/1 (172.16.2.100[29733])
vsys1 172.16.1.100[15]/Inside (172.16.1.100[15])
899 ping ACTIVE FLOW 172.16.2.100[29989]/Outside/1 (172.16.2.100[29989])
vsys1 172.16.1.100[16]/Inside (172.16.1.100[16])
admin@PA-VM> show session id 901
Session 901
c2s flow:
source: 172.16.2.100 [Outside]
dst: 172.16.1.100
proto: 1
sport: 30501 dport: 18
state: ACTIVE type: FLOW
src user: unknown
dst user: unknown
s2c flow:
source: 172.16.1.100 [Inside]
dst: 172.16.2.100
proto: 1
sport: 18 dport: 30501
state: ACTIVE type: FLOW
src user: unknown
dst user: unknown
start time : Thu Dec 18 02:53:02 2014
timeout : 6 sec
time to live : 1 sec
total byte count(c2s) : 98
total byte count(s2c) : 98
layer7 packet count(c2s) : 1
layer7 packet count(s2c) : 1
vsys : vsys1
application : ping
rule : Outside in
session to be logged at end : True
session in session ager : True
session updated by HA peer : False
layer7 processing : enabled
URL filtering enabled : False
session via syn-cookies : False
session terminated on host : False
session traverses tunnel : True
captive portal session : False
ingress interface : tunnel.1
egress interface : ethernet1/1
session QoS rule : N/A (class 4)
end-reason : unknown
admin@PA-VM>
And the rule;
Hi Hulk,
I tried them all this morning with no luck....
Sorry ;-(
Oh and this is a LAB not a production network, so i can do anything
Is there a command to watch traffic logs live in CLI?
