PANOS 7.0 SNMP logical interface counters

[nextgenhappines]

I tried the feature and the RX and TX counters are a way off from the physical interface (Tested on 5060 using e1/21 and e1/22 for AE1).   I opened a case with TAC,  and this is the explaination from TAC,

For hardware interfaces (ethernet1/21 and ethernet1/22), we only populate ""Physical port counters read from MAC" in the SMNP MIB.

These are MAC counters at the physical interface level.

For logical interfaces (AE1), we only populate "Hardware interface counters read from CPU" in the SNMP MIB.

As we do not actually have a physical interface for AE1, the MAC counters at physical level are not applicable here. We will only look for the Hardware CPU counters here.

Because most of the packets never reach the CPU as they are offloaded, we don't see a significant increment in the Hardware CPU counters.

As the counters on the hardware interfaces and the logical interfaces use different types of counters, it is not appropriate to compare the values on HW interfaces and Logical interfaces.

The logical interface counters are currently monitored based on the counters I have mentioned and this is by design.

You may need to put in a enhancement request to further enhance this feature.

What is the point to add this feature but it can't provide meanful result ?

E

[Brandon_Wertz]

I understand the gripe, but can you not get the info you're looking for by looking at the statistics from the po/vPC?

[nextgenhappines]

Sorry, I forgot to provide additional details.    The firewall is configured as a Layer 3 with sub interfaces (AE1.x, AE1.y, AE1.z , etc...), each sub interface is part of a vsys/zone.  It is helpful to able to see which sub interface on the AE is the top RX/TX, that helps a lot when you need to troubleshoot high usage, or DDOS.

E