PA-3020 Dataplane 100%

[sgarvin]

We have aggregated ports for the PA to "handle" what Consolidated has for us on a 2GB circuit.  Is this a case where our 3020 can't handle the traffic we have or is excessive logging a more likely culprit.  GoldSeal has our support and the need for immediate help is basically non existent.  Any suggestions on how to determine dataplane issues or get around GoldSeal for someone to read our TAC file?

[Mudhireddy]

Try to generate the tech support file from the firewall web UI and verify the monitoring outputs of the data plane(DP).

and also using CLI commands > show running resources utilization 

>Check is there any layer-2 loop in a network by disabling the LANB side interfaces.

[sgarvin]

Looks something like this:

> show running resource-monitor

Resource monitoring sampling data (per second):

CPU load sampling by group:
flow_lookup : 83%
flow_fastpath : 83%
flow_slowpath : 83%
flow_forwarding : 83%
flow_mgmt : 82%
flow_ctrl : 82%
nac_result : 83%
flow_np : 83%
dfa_result : 83%
module_internal : 83%
aho_result : 83%
zip_result : 83%
pktlog_forwarding : 83%
lwm : 0%
flow_host : 82%

CPU load (%) during last 60 seconds:
core 0 1 2 3 4 5
* 83 84 83 84 84

[Mudhireddy]

pls check the below KB and verify the outputs.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRTCA0

check which interface is utilizing more and is it L2 traffic ? loop?

and verify the high idle time out sessions and more info on sessions ids?