As far as I've looked, it happens on 5020 (7.1.2), 3020 (7.0.6, much more less deviation here, but it may be matter of sample taken), 3020 (7.0.2), 5020 (6.1.11). I guess it is a PAN limitation, and it may be the one Kiwi mentioned, but, well, that sucks. It may be different story with Panorama, but again - just guessing. Edit: Just tested on my lab box - 3050 with 7.1.2 - traffic there is generated rarely and the result for filtering out ssl traffic: Week1 - 192.2 MB & 9.5k sessions Week2 - 154.2 & 19.2k sessions Week3 - 314MB & 28.6k sessions ----- And when range is expanded to Week1+Week2+Week3 we get 707 MB & 66.9k sessions, although manual sum counts up 661 MB & 57.3k sessions. Meh.
... View more