Traffic logged in an interface in down state

[dept_tec_bcn]

This is our scenario:

- A PA-200 with a subinterface tagged with VLAN ID 200.

- Connected to a Cisco Catalyst switch (trunk with VLAN ID 200 allowed).

- It has been working without problems.

Now, we want to divert traffic to a Cisco router with same IP address as PA-200.

We put Catalyst interface in shutdown state (where PA-200 is connected) at 10.52h.

- We can see interface in "down" state (red) in PA-200.

- We cannot ping this interface IP.

- There's no other interface in this security zone.

But, traffic log is showing that there's some traffic in this interface. How is it possible?

I attach some pictures.

Thank for your answers!

[Anon1]

These are most probably sessions which were started before the interface was shutdown. They stay in the session table until they idle out and then produce the session end log entry.

[apasupulati · Accepted solution]

As you can see from the log details, the session start time was at 10:42 and you have the log option set to log at session end (Type: end), log generated time: 12:09. So as pointed out by Anon, these might be the old sessions which timed out much later and a log was generated at session end.

Thanks,

Aditi