PA Packet Capture

[Sanjay_Ramaiah]

Hi All,

Is there any similar command which we can use to check how the packet flows in PA and where the packet is being dropped, which blade is dropping the traffic. To simplify my question is there any command like Packet tracer command in Cisco ASA?

Also anything like fw monitor in Checkpoint?

Regards,

Sanjay S

[kiwi]

Hi @Sanjay_Ramaiah ,

Afaik there's no equivalent of packet tracer on Palo Alto Networks.  Closest I can think of is the debug flow basic (don't forget to set your filters first): 

> debug dataplane packet-diag set log feature flow basic

There is however an existing feature request for it.  Seems like several other customers have requested it already.

I'd recommend reaching out to your local sales rep and have them add your vote to the existing FR: 3857.

Kind regards,

-Kiwi.

[Sanjay_Ramaiah]

Thank you Kiwi for the valuable information.

I am very new to PaloAlto's so please guide me with a link or something which could help me on how to set the filters.

Also how to undebug the debug set.

[kiwi]

Hi @Sanjay_Ramaiah ,

The following DOC describes the steps to set filters, debug levels, and aggregate logs:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PPizCAG

Similar steps are described in the following discussion on the same topic:

https://live.paloaltonetworks.com/t5/general-topics/commands-to-debug-traffic-between-two-host-using...

Please note that this level of debugging can be quite taxing for the device so caution is advised.

Always set the filter so you're only debugging the traffic you're interested in.

Kind regards,

-Kiwi.