real time flow from interfaces - how to get it?

[_slv_]

Hello

On my old Juniper SSG device I had flow control where I can sow real time traffic on interfaces.

How can I do it with PAN? - using only GUI/CLI - not thirty party software?

With regards

SLawek

[gwesson]

There is no real-time flow by default. You could enable QoS on each interface you want to monitor. You would have to specify a profile (there is one by default) for each interface, and then in the Network > QoS section there is an Interface Statistics link. It will give you details about the applications and bytes flowing in real time, with a graph.

Note that enabling the QoS profile does not actually apply any QoS marking (DSCP) or modify the traffic. To do that you would need a QoS policy.

One final note: 5.0.0 had an issue displaying the QoS statistics as mentioned above. 5.0.1 solves that issue.

-Greg

[mikand]

The QoS fix in 5.0.1 seems to be broken, see for more information.

Regarding realtime flow, does slv mean something like (if it existed) "show session tail" ? Where you get a tcpdump lookalike output for all new sessions which are being setup?

[_slv_]

Thx Gwesson - I will configure QoS.

About QoS in 5.x - In latest veriosn 5.0.1h1 its fixed:

46285 – Resolved the issue where QoS statistics were not displaying in the web interface.

Im still on PAN 4.1.8

>Regarding realtime flow, does slv mean something like (if it existed) "show session tail

I'm looking for solution that show me who (IP) generates much traffic in realtime. How to get this information in real time? I think thats posible only on CLI...

[_slv_]

I got some strange (for me resoults) when I turn on QoS. My device is PA200 4.1.8

Im using two interfaces ethernet1/1 and ethernet 4/1 (4/1 has 8 subinterfaces (VLANs)).

I created in Network\QoS polices for ethernet 1/1 and 4/1 (with default profile).

First I enabled policy for 1/1 and .... FTP traffic from TotalCommander to Linux FTP serwer (from computer from 4/1 to serwer on 1/1) is at half speed!. Upload from computer to server is 6.2MB but download is 11.5MB. Why?

next i disable policy for 1/1 and enable for 4/1

Upload from computer to server is about 6.3MB and download 11.3MB.

Could someone explain me what is goin on?

[mikand]

Regarding your original question, something like iptraf would be nifty if that existed in PA 🙂

http://iptraf.seul.org/shots.html

Regarding your QoS, when you enable QoS you always do that on egress interface (since this is where the PA can decide in which order the packets will leave the device).

Also when you enable QoS the performance will decrease - there is a list somewhere on this forum with some performance figures when QoS is enabled (its something like (for PA-5060 (edit: actually 4000 series and older)) 20Gbit/s firewall, 10Gbit/s threat, 5Gbit/s QoS or so).

Edit:

Here is the qos performance table I was thinking of:

https://live.paloaltonetworks.com/message/5367#5367

And according to the link below the qos engine was changed in 5000 series (so my example of 20/10/5 is a behaviour for the 4000 series and downwards)

https://live.paloaltonetworks.com/message/12541#12541

[_slv_]

iptraf is what Im looking for - but it exist on Linux not on PAN - maybe Im wrong and exist ability similar to iptraf on PAN?

Qos performance table answered my question. 50MB is a limit for PA500 (and for younger brother PA200) - both has virtualized hardware.

So I made one step forward. But I still need help.

I have 8 intrefaces on local phisical 1/4. I have 1/4.1, 1/4.2 etc.

How to put different prosiles on it?

For example 1/4.3 is for WiFi - and I need to limit transfer to 4Mb upload and 4Mb download.

I know that upload I need to made on 1/1 (as is a output for traffic from WiFi), but how to do limit to download?

I have no option to select 1/4.3 as a interface inb QoS.

I read "QoS_in_PAN-OS.pdf" but it doesnt answered my question. I also searched this community forum but without usefull answers.