CLI commands to verify the DOS functionality on Palo Alto Networks Devices

CLI commands to verify the DOS functionality on Palo Alto Networks Devices

31716
Created On 09/25/18 19:48 PM - Last Modified 07/06/26 11:47 AM


Symptom


Since the DOS/Resource Protection settings do not generate logs by design, it is difficult from the GUI to figure out the DOS functionality.

Cause


Under DoS Protection, for Resources Protection, the firewall tracks the sessions through its session table. Unfortunately, the details of which source/destination is triggering the DoS resource protection threshold cannot be obtained as these are not logged currently.

Resolution


 There are ways to verify functionality via the CLI through the Global Counters: 
> show counter global | match dos
> debug dataplane show dos classification-table
> show counter global filter aspect dos
> show counter global filter aspect dos delta yes

(only shows the difference since last execution)

 
Owner:- ppatel
Other users also viewed:
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClddCAC&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language