o session

Reply
Highlighted
L1 Bithead

o session

Hi,

Have a installation with a PA-200 firewall.

It's a standard vwire-setup with policyes from untrust to trust. It is places between the ISPs router and another firewall.

The traffic is forwarding between the interfaces, but the PA-200 is counting 0 sessions.

Log monitor e.g state null traffic. 

Have created a case at Palo Alto, but have no solution yet.

Downgraded from 5.0.4 to 5.03 with no luck.

Anyone seen this issue before?


Accepted Solutions
Highlighted
L4 Transporter

Re: o session

Hi

You are saying traffics are traversing PA-200 and you are enable to see any web-sites, right?

I just wonder 3rd party firewall is using pppoe or not.

I saw very similar issue before.

My situation was PA placed between two devices and all packets are capsuled by pppoe.

The result of 'show system statistics session' was counting correctly, but we could not see any sessions.

Regards

View solution in original post


All Replies
Highlighted
L4 Transporter

Re: o session

Hmmm, If I understand you, Vwire is NOT counting any sessions. What I visualize is the following (please confirm if different)

ISP-Router <====>  PA200 <====>  3rd party firewall.

Questions, obeservations I have: If your FW was NOT in the middle, I would be lead to believe that you would have

ISP-Router <========>  3rd party firewall.


Which gives me indication that you have UNTRUST from Internet talking to UNTRUST interface on the 3rd party FW. Maybe your Zones are setup incorrectly?

I would think Untrust talking to Untrust just looks like your setup, (yet you have Untrust talking to Trust, which does not match)

Can you provide a simple network drawing (like I did)

Highlighted
L1 Bithead

Re: o session

Hi,

Your network diagram is correct.

I have ensured that ethernet 1/1 (untrust) is connected to the ISP and ethernet 1/2 (tust)is connected to the original firewall.

Packets from the ISP is untagged, so VLAN should not be a issue.

Have also a second policy that accept traffic from untrust to trust, so in the case that I had mixed between the zones that should not matter (since they have some services on the inside..)

Highlighted
L4 Transporter

Re: o session

Hi

You are saying traffics are traversing PA-200 and you are enable to see any web-sites, right?

I just wonder 3rd party firewall is using pppoe or not.

I saw very similar issue before.

My situation was PA placed between two devices and all packets are capsuled by pppoe.

The result of 'show system statistics session' was counting correctly, but we could not see any sessions.

Regards

View solution in original post

Highlighted
L2 Linker

Re: o session

Hi,

What is configured for "tag allowed" under Network -> Virtual Wires -> (Name of the vwire instance)?

Please add "0-4094" for tag allowed, commit the change and check to see if traffic traverses successfully. 0-4094 will allow tagged as well as untagged traffic through the vwire pair.

Regards,

Manish

Highlighted
L1 Bithead

Re: o session

Thanks for your help.

The problem was PPPoE between the existing firewall and the ISP.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!