07-15-2018 01:22 AM - edited 07-15-2018 09:33 PM
Hi ,
When checking monitoring logs very often especially with ICMP, I come across" Session ID 0" and unable to find any information for the same using CLI . This throws error message as Session ID should start with 1. Not sure, why only WebGui displays as 0. Please assist.
admin@PA> show session id 0
0 should be between 1-2147483648
Invalid syntax.
07-16-2018 11:44 AM - edited 07-16-2018 11:44 AM
Session id '0' is used for anything that actually gets denied, because a session was never generated. Essentially the way the firewall functions you can't have a 'null' value for the session-id, so PAN chose to use '0' for anything that isn't allowed. Since the session doesn't actually get created and doesn't truthfully exist except in the logs, you can't view session id 0 via the cli like you could with other sessions.
07-16-2018 11:44 AM - edited 07-16-2018 11:44 AM
Session id '0' is used for anything that actually gets denied, because a session was never generated. Essentially the way the firewall functions you can't have a 'null' value for the session-id, so PAN chose to use '0' for anything that isn't allowed. Since the session doesn't actually get created and doesn't truthfully exist except in the logs, you can't view session id 0 via the cli like you could with other sessions.
07-22-2018 12:08 PM
To be precise Session ID is "0" if the FW action is "drop" for that specific traffic. In case of deny a session is created but the after checking the 5 tuples the FW deny the traffic.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
