Palo VM randomly stops forwarding traffic

[CobaltGroup]

Hi all,

I have a new Palo Alto VM-100 running in Proof of concept on version 9.0.2-h4

I'm using a virtual wire to protect servers against all kinds of attacks, malware etc

Yesterday evening for the first time, everything behind the firewall went down. I could not reach any of the hosts behind the firewall.

After consulting with support, there was an update in the threats database with a bug in it.

I rolled back to previous application and threats version 8166-5525, and rebooted the firewall.

After this everything started to work again.

However this morning, again some issue, suddenly all traffic stops and all services go down.

I cannot find any kind of error message on the palo alto, and I made sure there have been no updates on the application and threats database.

Anybody else experienced this kind of issue, and how do you prevent this from happening?

Thanks

Cobalt

[OtakarKlier]

Hello,

I would say contact support again. Also check your dynamic updates to make sure you are following best practices on content versions etc.

https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/threat-prevention/best-practices-for-conte...

I have mine set as the following:

AV: checks every hour but threshold at 4 hours

App/Threat: check once a day with a 12 hour threshold (so it waits a day)

Wildfire: every minute

Regards,

[CobaltGroup]

Thank you for your reply.

We looked at the firewall with support when it was not working, but unfortunately support can't find the issue, so we have to troubleshoot more deeply, perhaps on hardware layer ...

[OtakarKlier]

Or could be a new bug :(.

[CobaltGroup]

That is of course possible.

So because support was not able to find anything, I have moved the connection of the virtual wire to broadcom chipset NICs instead of intel chipset NICs, to test if it's maybe related to the interfaces.

If the connections are still freezing, I'm going to move the firewall completely to a different box, to eliminate the fact that it might be hardware related. 

[sherri_king]

was the issue resolved by moving the to a broadcom NIC? Currently having an issue where traffic randomly stops.