I am trying to firgure out two things.
I have a Cisco ASA VPN concentrator that comes to my PA-5220 then goes to an application server.
I am having issues where i see logs in the ASA of traffic coming from the far end point of the tunnel on a constant basis, then going to the application server. I am not constantly seeing any logs in the Monitor. The application vendor acknowlegdes the traffic as well.
The logs I see is about 20 -30 minutes most of the time.
More interestingly is I have many customers coming in the ASA to the same Policy going to same application server on the same port. Those other IPs are showing constant logging.
Second issue is we see latency traffic between the two sides.. The application should have constant traffic every second or quicker.. What see is sometimes on a constant basis there is delays from 5 to 45 seconds.. again no logs in the PA
First how can I check for the traffic in CLI ?
In addition How Can I check to traffic to see if the PA is possibly causing the latency.?
So the Palo Alto sees clean traffic without any VPN as the VPN concentrator is the ASA? Do you have split tunnel configured on the ASA that can cause asymmetrical routing and not all traffic going to the Palo Alto when reachig the app servers?
Another thing to look for is the application shift on the Palo Alto firewall as when for example the traffic is ssl it will pass the security policy rule selection and after the decryption on Palo Alto and it is seen that the traffic google, facebook etc. it will again pass the security rule match from top to bottom as this is called application shift. Maybe you have application shift that after that matches a rule that is without "Log at the session end enabled".
For the latency it is the best to check the global counters by filter by source and destination for something that can cause issues and to do pcap capture at receive and transmit stage for the traffic in the two directions from the client to server and server to client to see if the firewall causes the latency issues. Also you may enable flow basic and flow log option "appid" to see the application shift if you need it. Before months I have made article for such issues:
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!