About CHOE-KyungJun

@JayGolf    Thank you for your reply   When I entered up to 16,000, I confirmed that it was normally committed. So I don't think there are any special restrictions. Thanks for running your test.   ... View more

Hi @CHOE-KyungJun ,   Development has acknowledged this as a bug (PAN-209491). arget Fix V Target fix versions are currently set at 10.2.5 ,   11.0.1 ,   10.1.10.    Kind regards, -Kiwi.   ... View more

Hi @CHOE-KyungJun ,   This is a little bit strange question.. As it is defined here Network throughput - Wikipedia is the rate (speed) with which traffic is forwarded/delivered over the firewall.Now in Active/Passive HA deployment the passive member does not process any traffic over its dataplane interfaces. It actually disable its routing engine, which ensure that any packet that was forwarded to passive FW dataplane interfaces will be ignored by the firewall.   Which means only the active member is forwarding traffic, therefor throughput is relevant only for the current active device. Each network devices (including any PA FW) is sized for particular maximum throughput - this is the maximum data firewall can process for one second, before start dropping or queuing the traffic. Palo Alto firewall can form HA cluster only if the two members are of the same hardware model (or VM-series capacity). Which means both HA members must have same maximum throughput.   Your question is like asking the question - If you and I are holding hands and you were given a glass of water and start drinking fast, will I start drinking at the same speed as you, because we are holding hands? The answer is no, because only you have a glass and I am sitting idle. You could pass out and I could take the glass and keep drinking.   Now back to your output in the screenshot. You could think that it make sense the passive member to show 0Kbps - because it shouldn't process any traffic. Yes that is correct, BUT, this value will show all the traffic that is processed by the firewall - this will include HA traffic between the two members as well as traffic to its management interface.   To be honest I haven't look at throughput for the passive member, but for me it make sense to see current throughput on passive increase when current throughput on the active increase, this is because more sessions are passive over the active firewall and this data needs to be sync-ed with the passive member, which means sync traffic (HA) traffic between the two members will increase - increasing the current throughput.   ... View more

Hello @CHOE-KyungJun   it feels like the same issue has been discussed recently in this thread: https://live.paloaltonetworks.com/t5/general-topics/disable-iot-feature/td-p/521806   Kind Regards Pavel ... View more

Hi @CHOE-KyungJun ,   In most cases zombie processes are related to memory leaks and/or unresponsive processes .   You could try checking the mp-logs for fail entries if you can find it but my recommendation would be to update your PAN-OS version because 9.1.12-h3 dates from previous calendar year (12/20/2021).   The recommended version on the PAN-OS 9.1 train is 9.1.14-h4 at the moment of this writing.   Kind regards, -Kiwi.   ... View more

Hi @CHOE-KyungJun ,   The log4j issue is resolved in  PAN-OS 10.1 and all later PAN-OS versions. ... View more

@RajuLamichhane  Hi, RajuLamichhane I opened the CASE and confirmed the issue as a problem with azure Therefore, it is recommended to check the peer side first before proceeding with the CASE. ... View more