@MickBall hey how's it going? I still manage a PA and billion other things but since they removed my sentinel status I don't get on her much ... View more

I will definitely look into graylog and have you ever heard of ossim or suricatta   ... View more

@BPry  TAC identified alot of fragmented traffic that is getting piled up in the ctd_pkt_queue and driving the DP CPU up high, I think it might be a user using open-vpn and going up to as high as 65Gb of traffic. Is there a way to verify that for sure and if its not that is there a way to deal with fragmented traffic ... View more

@BPry  Yes i keep very close eye on my PA and usually the dataplane runs well below 10% and closer to 5% or below. Its a PA 3050 on OS 8.0.16 which I am in the works to upgrade to 9 once the apocalypse ends. I don't think it is the globalprotect traffic and I think your right that smb traffic may be the culprit but I am having a hard time finding the exact cause. Maybe it has to do with the way that the users are now accessing our file server I am not sure. I have spent alot of time looking at logs, at the ACC and I have a TAC ticket open. There are times when things look normal, like first thing this morning the DP was only 3%, it has now climbed to 33% and will soon be at 60% way higher than the norm and has been on this consistent trend upward since May 12 2020. If you know of anything else I should look at let me know ... View more

@BPry  that is what I thought ,but the dataplane CPU has been running high and spiking at 100% so I sent in a support file with the ticket I opened and then TAC said it was spiking due to decryption but I was sure I didn't have decryption configured and I don't. then I noticed there was some decrypted traffic for the globalprotect client which makes sense but we have 30-40 tops users at any given time on GP and have been running that way a over a month before I saw the CPU spikes. We have had spikes in the past but not like we do now and the overall dataplane CPU has increased from less than 10% to 50-60% since May 13th and i can't find the cause so I opened a tac ticket and they have gotten no where   ... View more

@OtakarKlier @rmfalconer  Yes I had looked at both of those and wasn't sure if they were still applicable since the os described is 6.1. The reason I asked is because I did not configure decryption and I checked and saw there was none configured on the firewall. I did not know if decryption occurs by default on some traffic like URL and globalprotect traffic, because when I check the traffic logs it does show some decrypted traffic. I have also been trying to hunt down some high CPU percentages on the dataplane and am having a hard time pinpointed the cause. TAC said it might be due to decryption of URL traffic but I can't find anything to confirm it. ... View more

@BPry  Do you mean using solarwinds or something to do a netflow collections on all the pa interfaces?   Why not do firewall packet capture on the firewall? ... View more

@BPry  Hows it going? As always you have many good suggestions. I decided to change the action to drop. I currently don't have mine meld and doesn't that cost?  I currently do not have a SIEM setup yet I may need to look into that ... View more

I can't believe 9 is out LOL ... View more

@BPry @OtakarKlier  At the least I can block it through the threat prevention, but I don't know how it works, and it appears to started back when they put in the sip trunks last June. Shouldn't it be causing issues all the time with the phones? ... View more