Content translations are temporarily unavailable due to site maintenance. We apologize for any inconvenience. Visit our blog to learn more.
11-02-2018 09:49 PM - edited 11-02-2018 09:51 PM
when i run command
show counter global filter delta yes
i see below counters incrementing need to understand which are these drops and why PA is dropping these packets?
do they impact the performance of the PA?
flow_tcp_non_syn_drop
flow_fpga_egress_exception_err
flow_fwd_l3_ttl_zero
flow_action_close
11-02-2018 10:31 PM
Those names are pretty self explaining.
Also description field helps to explain.
For example description for flow_tcp_non_syn_drop says:
Packets dropped: non-SYN TCP without session match
It means that if the first packet in a session is a TCP packet and it does not have the SYN bit set, the firewall discards it (default).
It might help you to get familiar how Palo processes packet.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVHCA0
11-03-2018 07:01 AM
can you please explain about this
flow_fpga_egress_exception_err
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
