High utilization of generic dataplane pool-paloaltonetworks-panos

High utilization of generic dataplane pool-paloaltonetworks-panos
0

High utilization of generic dataplane pool-paloaltonetworks-panos

Vendor: paloaltonetworks

OS: panos

Description:
The dataplane of a Palo Alto Networks firewall has several pools, each with a different role. indeni will alert when a pool is near exhaustion.

Remediation Steps:
Contact Palo Alto Networks technical support.

How does this work?
This script logs into the Palo Alto Networks firewall through SSH and retrieves the status of all the pools. The output includes the total size of the pools and how many elements are available. indeni utilizes this output to determine when the pool is running low on available elements.

Why is this important?
On a Palo Alto Networks firewall, the data plane is where the traffic is handled. In the course of processing traffic the firewall needs to retain certain bits of information. This information is saved in pools of memory, easily accessible but limited in size. When the firewall needs to save information it retrieves a member of the pool and when it is done it returns it. If a pool runs out of members the firewall may have trouble handling traffic, potentially losing part of it.

Without Indeni how would you find this?
An administrator would need to write a script to poll their firewalls for the information, or simply wait until there’s an issue and open a support ticket with TAC.

panos-debug-dataplane-pool-statistics

Failed to fetch the data: https://bitbucket.org/indeni/indeni-knowledge/src/master/parsers/src/panw/panos/debug-dataplane-pool-statistics/debug-dataplane-pool-statistics.ind.yaml

panos-debug-dataplane-pool-statistics

name: panos-debug-dataplane-pool-statistics
description: Grab debug dataplane pool statistics
type: monitoring
monitoring_interval: 30 minutes
requires:
    vendor: paloaltonetworks
    os.name: panos
    product: firewall
comments:
    dataplane-pool-used:
        why: |
            On a Palo Alto Networks firewall, the data plane is where the traffic is handled. In the course of processing traffic the firewall needs to retain certain bits of information. This information is saved in pools of memory, easily accessible but limited in size. When the firewall needs to save information it retrieves a member of the pool and when it is done it returns it. If a pool runs out of members the firewall may have trouble handling traffic, potentially losing part of it.
        how: |
            This script logs into the Palo Alto Networks firewall through SSH and retrieves the status of all the pools. The output includes the total size of the pools and how many elements are available. indeni utilizes this output to determine when the pool is running low on available elements.
        can-with-snmp: false
        can-with-syslog: false
    dataplane-pool-limit:
        why: |
            Capture the pool limit. This information is necessary for tracking health status of the device. If a pool runs out of members the firewall may have trouble handling traffic.
        how: |
            This script logs into the Palo Alto Networks firewall through SSH and retrieves the status of all the pools. The output includes the total size of the pools and how many elements are available. indeni utilizes this output to determine when the pool is running low on available elements.
        can-with-snmp: false
        can-with-syslog: false
steps:
-   run:
        type: SSH
        command: debug dataplane pool statistics
    parse:
        type: AWK
        file: debug-dataplane-pool-statistics.parser.1.awk

panw_pool_usage_generic

Failed to fetch the data: https://bitbucket.org/indeni/indeni-knowledge/src/master/rules/sync_core_rules/paloalto/GenericDataplanePoolUsageRule.scala