PAN-88671

[nextgenhappines]

Hello,

In PANOS 8.0.8 release,  now can disable or enable the L4 checksum checking.

How do I check if my 5200 firewall L4 checksum is enabled or disabled?

How do I check if traffic is dropped due the L4 checksum?

Thanks,

E

[reaper]

enabled
admin@PA-5250> show system state | match l4
cfg.hw.fe100: { 'cfg_mode': 4, 'l4_chk_sum': 1, 'usecase': 1, 'v4_v6_choice': 2, }

disabled
admin@PA-5250> show system state | match l4
cfg.hw.fe100: { 'cfg_mode': 4, 'l4_chk_sum': 0, 'usecase': 1, 'v4_v6_choice': 2, }

these counters will increment when the firewall discards packets: :flow_fpga_rcv_igr_L4CHKSUMERR

[nextgenhappines]

Hi Reaper,

I don't see this counter increased (or listed when I run show counter global filter delta yes packet-filter yes ) until I have the pre-parse match enabled.

[reaper]

Then I would think it likely no packets are being discarded by this check in the first place

are you seeing this counter pop up: flow_fpga_ingress_exception_err

[nextgenhappines]

None of that counter as well, flow_fpga_ingress_exception_err

TAC and I compare the packet captures on the firewall vs on the span port from the switch below the firewall.  Packets are getting dropped by the firewall.  The counters mentioned were not showing up until you have pre-parse match enabled.  

[Karim.Benyelloul]

Hi reaper,

Could you please tell me when the counter : flow_fpga_ingress_exception_err pop up ? 

Many thanks ,

Kairm

[reaper]

hi @Karim.Benyelloul

thats a bit of an open ended question as i cannot tell you wjhen exactly that counter will pop up, it will be part of a larger set of symptoms rather than a 'this counter increments when x is happening'

it is counted when an error occurs when the fpga tries to intake a packet, which can happen due to different reasons