Unable to find the reason for packet drop

[network_020]

Hello,

In our Palo Alto the traffic is allowed on the firewall but it is not working. When we did packet capture we found that return traffic in drop stage. To find the cause of the packet drop I have set the filter using 'Manage Filters' in GUI then use the following command.

debug dataplane packet-diag set filter on

but I am unable to see any output in the command -  show counter global filter packet-filter yes delta yes severity drop

What should be the approach to find the cause of packet drop by firewall.

[emr_1]

I would recommend not use "severity drop" on your command.

Here is one example, as described, there are some counter which is warning with packet drops

====

> show counter global name tcp_drop_out_of_wnd

Name: tcp_drop_out_of_wnd
Value: 0
Severity: Warning
Category: tcp
Aspect: resource
Description: out-of-window packets dropped

====

[OtakarKlier]

Hello,

Check the unified logs in the gui. This should tell you everything you need to know if/where the traffic is getting dropped/blocked.

Regarsds,