Palo Alto Best Practice

 

Management Plane

Attribute	Details	Recommendation	KB	Type of Check
Permitted IPs	Permitted IPs configured		●     How to Secure the Management Access of Your Palo Alto Networks Device	Security
Software Processes	All processes are running as expected			Health
Core File	Not Found		●     How to Export Core Files ●     How to download core files from firewall WebGUI ●     How to Upload Core Files Directly to Support	Health
MP CPU	No high MP CPU condition detected		●     How To Troubleshoot High Management Plane CPU Usage	Health
Per Process CPU Check	Process 'pan_logdb+' exceeded 80% CPU usage 1 time(s). Process 'pan_repor+' exceeded 80% CPU usage 1 time(s). Process 'pan_logqu+' exceeded 80% CPU usage 1 time(s). Process 'configd' exceeded 80% CPU usage 1 time(s). Process 'wifclient' exceeded 80% CPU usage 1 time(s). Process 'du' exceeded 80% CPU usage 1 time(s).	Investigate CPU usage further		Health
Memory Patterns	No Significant Memory Jumps Detected			Health

 

Dataplane Analysis

Attribute	Details	Recommendation	KB	Type of Check
Session Utilization	Number of sessions supported: 4999998 Number of allocated sessions: 37596 Session table utilization: 0% Session Utilization is healthy below 80%		●     How to Reduce the Session Table Utilization %	Health
Avg DP CPU	No high DP CPU condition detected.		●     How to Troubleshoot High Dataplane CPU	Health
Packet Filters	Enabled		●     Packet Capture and Filters	Health
Dataplane Logging Enabled	Disabled		●     Flow basic debugging	Health
Packet Capture	Disabled		●     Packet Capture and Filters	Health
Jumbo Frames	Disabled		●     How to Enable/Use/Disable/Check Jumbo Frame ●     Session Settings and Timeouts	Informational
DP Utilization	Packet Buffer (Avg): 98 Packet Buffer (Max): 99 Packet Descriptor (Avg): 47 Packet Descriptor (Max): 47 Packet Descriptor (on-chip) (Avg): 0 Packet Descriptor (on-chip) (Max): 0 Packet rate per sec (Max): 125364 Throughput in kbps (Max): 931941 New connection establish rate in cps (Max): 908		●     How to Troubleshoot High Packet Buffer or Packet Descriptors Usage ●     Traffic Latency - Packet Descriptors (on-chip) ●     ML-Powered Next-Generation Firewall Specifications and Features Summary	Health
Dataplane Software Pool Utilization	Software Pools are not over-utilized.			Health
Dataplane Hardware Pool Utilization	Hardware Pools are not over-utilized.			Health
Kernel Panic	Not Found			Health

 

Hardware Environment

Attribute	Details	Recommendation	KB	Type of Check
Fan Alarms	Not Found		●     How to Detect a Bad Fan or Fan Tray Failure	Health
Disk RAID Errors	Not Found		●     How to Detect a RAID Failure	Health
Power Supply Errors	Not Found		●     How to Detect a Bad Power Supply Unit	Health
Thermal Alarms	Not Found		●     View the Maximum and Minimum Thermal Thresholds	Health
SMC Errors	Not Found		●     Replace a PA-7000 Series Switch Management Card	Health
NPC Errors	Not Found		●     Commands to verify Line Card Failures	Health
Disk Usage	root: 25% pancfg: 16% panlog: 64%		●     High Disk Space Usage on /opt/pancfg partition and How To Clear ●     How to Clear Logs To Reduce Disk Space usage on /opt/panlogs ●     High Disk Space Usage on / root partition and How To Clear	Health
SFP Optics In Use	No		●     How to confirm if your SFP transceiver is supported	Health
Hardware Log Errors	Detected	Review Raw logs. Open a TAC case if required		Health
PA5450 MPC	N/A
PA5450 DPC	N/A
PA5450 NC	N/A
PA7050 and PA7080 DPC	N/A
PA7050 and PA7080 LFC	N/A

 

High Availability

Attribute	Details	Recommendation	KB	Type of Check
Active/Passive Pair Information	passive (last 9 minutes)			Informational
Preemptive Option	No			Informational
Link Monitoring	Enabled: yes Failure condition: any Group link group 1: Enabled: yes Failure condition: any Interface ethernet1/9: up Interface ethernet1/10: up Interface ethernet1/11: up Interface ethernet1/12: up Interface ethernet1/13: up			Informational
Path Monitoring	Enabled: no			Informational
Group IDs	Group 12			Informational
HA Priority	Primary: 1 Peer: 2			Informational
HA Link Status	Healthy		●     High-Availability - How to detect HA link failure	Health
HA Config Sync	Enabled: yes Running Configuration: synchronized		●     High-Availability - Out of Sync Peers - Configuration	Health
HA Backup	IP Address: 192.168.101.13		●     How to Configure HA Backup Links	Health
HA Peer Status	HA Peer is functional. HA Peer Connection is Up.		●     High Availability - How to check HA Peer Connection failure	Health
HA Passive Link state	auto

 

User-ID

Attribute	Details	Recommendation	KB	Type of Check
User to IP Mappings	5266 users			Informational
Check Agent Connected and Operational	0 Agents connected		●     How to troubleshoot connection failure to User-ID agent	Health
Verify Terminal Server Agent Status	Not Configured		●     How to Troubleshoot Terminal Server Agent Problems	Health

 

Logging & Reporting

Attribute	Details	Recommendation	KB	Type of Check
Default Log Forwarding Profile	Not Configured	Create a profile named "default"	●     How to configure Log Forwarding	Security
Custom Log Forwarding Profiles	Configured			Informational
Log at Session Start	Not Configured		●     Review Session Log Best Practices	Health
Netflow	Disabled	Enable if required	●     How to Configure Netflow Server Profile and Assign to Interface	Health
Log Retention Days	Max days not configured		●     How to change log retention days	Health
Netstat RX/TX queue	Netstat Recv and Send Queues are normal		●     Internal KB	Health

 

Zone/DoS protection

Attribute	Details	Recommendation	KB	Type of Check
Global Packet Buffer Protection	Configured		●     Configure Packet Buffer Protection	Security
Zone Protection	Number of zones with protection profile: 2		●     DoS and Zone Protection Best Practices	Security
DoS Protection	Not Configured		●     DoS and Zone Protection Best Practices	Security