About rvandegrift

How have folks setup automated monitoring of HA status and session sync? We see HA instability on a 5060 A/A cluster during periods of high load.  The boxes get too busy to respond to HA messages, lose heartbeat, and start to think the links have failed. Normally, they recover automatically when the load decreases.  But this weekend, we had a case where HA1 heartbeat did not return, and session sync failed as a result. But I can't figure out what to poll.  There's nothing about HA in SNMP.  So I'm looking at the CLI/API.   "show high-availability state" seems to display the configuration, not the status.  And it doesn't give specific status info for the each HA link, heartbeats, or sync.  "show high-availability state-synchronization" looks promising, but I can't tell if it's reporting configuration or status. Ross ... View more

Hello, I've noticed a boatload of application-pcaps - between 5-15k, on days where they are captured.  There are captures from most days, but not every day. As far as I know, I don't have any traffic captures enabled.  All of the following show that captures are disabled: 1. debug dataplane packet-diag show setting (capture and logs disabled on all dataplanes) 2. show running application setting (unknown capture and application capture are disabled) 3. debug ike pcap show (no ipsec config anyhow) What else could be triggering these captures?  Maybe they are used as a part of some firewall feature? This is on PA-5060 running 6.0.5. Ross ... View more

Hello, We're having a few issues with predict sessions begin created erroneously and unnecessarily.  The SIP ALG can be disabled, but when I tried the same process for other applications (ftp, skype, rtmpe, etc), there was no ALG option.  How can these ALGs be disabled? Thanks, Ross ... View more

Hello, Palo Alto's documentation is inconsistent on the behavior of flood protection when it is applied by a zone protection policy. 1) "Threat Prevention Deployment Tech Note - Version 2.0 RevA", page 44 says that the zone protection based flood protection applies per source-destination-port tuple: "Configure Flood Protection settings based on the number of packets you want to allow to each service behind the firewall. Settings apply to all traffic that enters the network through any interface in the zone on which the Zone Protection Profile is active, but a separate counter is maintained for each source IP/destination IP/destination port tuple." 2) "Threat Prevention Deployment Tech Note - Version 2.0 RevA", page 45 directly contradicts this: "Flood Protection enabled under Zone Protection is applied to the aggregate traffic seen on a specific zone. It will maintain a single counter for all traffic, regardless of source IP/destination IP/destination port." Which is correct? Thanks, Ross ... View more