I'm working with a customer to resolve some issues with their network, and I have a hunch that their issues is that their firewall is just overwhelmed. However, I've never actually found any information on exactly what to look for to diagnose an overwhelmed firewall.

Does anyone have any sources or just knowledge of what this looks like? The symptoms they are having is that their external clients are suffering from intermittent connectivity, the PAs are HA paired, but one of them is dead and a reboot of the firewall temporarily solves this issue. However, it's strange that only their external clients would suffer from this issue.

They have larger firewalls scheduled to upgrade the older ones, but logistics have prevented this from happening just yet, so here I am.

What do overworked firewalls look like?

  • You could improve your question by editing it to add more details. You may find our Question Checklist helpful when editing your question. You don't diagnose these kinds of problems by looking for symptoms. You need to access the firewalls (either directly or through something like SNMP) to check/track interface statistics, cpu/memory usage, etc. Also, while you say they are HA paired, is this an active/backup or active/active configuration? What models are they and how much bandwidth are they pushing? – YLearn Jul 28 '15 at 18:08
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 12 '17 at 3:41

I assume from the provided tag that it's a Palo Alto.

  1. Check for high CPU utilization, having it consistently work above 80% is a sign that things are bad in that department. CLI command:

    show running resource-monitor

  2. Check out for packet drops:

    show counter global | match drop

  3. Check for high concurrent sessions, CPS:

    show session info

For more info and tips, check out this cheat-sheet of really useful PaloAlto commands to help troubleshooting an "overworked" firewall.

| improve this answer | |

show system resources is another useful command. Baseline performance during a time when you know the system is operating to spec, and compare to when your users are dropping. Here's Palo Alto's KB article on interpreting the output.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.