01-17-2023 06:46 AM
We have a 5220 running 9.1.12-h3, and it has a 10 Gb vwire with multiple VLANs configured with managed switches on both sides.
There was a 13 Terrabyte copy across this vwire, and then as that was finishing, there was a 3 Terrabyte data copy. Both were sources from the same side of the vwire, and both towards (destination side of vwire) servers and storage on the other side of the vwire.
Just as both overlapped, we lost connectivity to servers and other resources on the destination side of the vwire. Once we restarted the dataplane on the firewall, we could access the servers and resources.
Interestingly, the Data Plane CPU (in the System Resources widget) showed less than 10% during this issue.
Has anyone experienced this or similar behavior? Is it possible for the dataplane to be overwhelmed? And if so, for the CPU utilization to be low?
Thanks for any help.
02-01-2023 02:36 AM
I have sometimes because of a DOS attack high traffic the firewall to get stuck even after the CPU gets better as I have mentioned in https://live.paloaltonetworks.com/t5/general-topics/knowledge-sharing-high-data-plane-cpu-because-of... but also keep in mind that the memory could have been the issue, so also check the memory if you again have this issue:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000oNDmCAM
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PNtHCAW
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClUb
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
