About sspringer

The only problems I have seen are related to time sync issues: - Mismatch time between client machine and the firewall(one of them had wrong time) - Firewall had misbehaving or incorrect NTP server configuration Could you provide more info on the configuration. Idle timer configuration? (default is 60 minutes) What type of account used?(superuser/adminrole/etc) Could you also provide more info on the sequence of actions prior to the problem. Does it happen shortly after user login? Is there a certain action that causes the logout to happen?(such as click on Device tab or perform log query) Some debug data that can be gathered: Enable the following debugs and then reproduce the issue -WebUI Debug: How to Run a PAN-OS Web UI Debug -Management Server Debug:      > debug management-server on debug Collect the following files(or a tech support): > less mp-log ms.log > less mp-log appweb3-websrvr.log > less mp-log php.debug.log ... View more

There are some drop counters.. flow_policy_deny                           6        1 drop      flow      session   Session setup: denied by policy flow_tcp_non_syn                           1        0 info      flow      session   Non-SYN TCP packets without session match flow_tcp_non_syn_drop                      1        0 drop      flow      session   Packets dropped: non-SYN TCP without session match flow_fwd_l3_mcast_drop                     9        2 drop      flow      forward   Packets dropped: no route for IP multicast flow_fwd_zonechange                        1        0 drop      flow      forward   Packets dropped: forwarded to different zone Could you configure a packet-filter based on the source and destination used for testing and collect new counters? > debug dataplane packet-diag set filter match source x.x.x.x destination y.y.y.y > debug dataplane packet-diag set filter on Then collect counters with packet-filter > show counter global name filter packet-filter yes delta yes *Note* the filter will only match new sessions, not sessions already present in session table ... View more

Hello, The VM-Series Deployment Guide provides an alternative to enabling promiscuous mode for layer3 deployments. VM-Series Deployment Guide 6.0 (English) Virtualization_Admin_Guide_6.0 page 11(section Requirements): "If you are deploying the VM-Series firewall using layer 3 interfaces, you can instead set the vmNIC MAC address to match the PAN-OS MAC address by manually editing the MAC address for each vmNIC in vSphere to match what is assigned on the VM-Series firewall. This change must be done while the VM-Series is powered off; it allows the firewall to receive frames that are meant for it." Cheers, Stefan ... View more

The GP client had a performance increase included in 1.2.9 for IPsec traffic. Perhaps you could give it a try? ... View more