How to set and show Session Distribution Policies on PA-5200 Series Firewalls
564
Created On 09/21/22 09:12 AM - Last Modified 05/20/26 20:51 PM
Objective
How to set and show Session Distribution Policies on PA-5200 Series Firewalls running PAN-OS 9.0 or higher.
Environment
- PAN-OS 9.0 or higher
- PA-5200 Series Firewalls
Procedure
CLI Commands - PA-5000 Series Firewalls running PAN-OS 8.1 or lower
- show session info | match Processing
- set session processing-cpu
admin@PA-5050> show system info | match model\|sw- model: PA-5050 sw-version: 8.1.22 admin@PA-5050> show session info | match Processing Processing CPU: random admin@PA-5050> set session processing-cpu dp0 Using DP0 to process future sessions dp1 Using DP1 to process future sessions dp2 Using DP2 to process future sessions random Random select one of DPs to process future sessions
CLI Commands - PA-5200 Series Firewalls running PAN-OS 9.0 or higher
- show session distribution policy
- set session distribution-policy
The PA-5220 firewall has only one DP so sessions distribution policies do not have an effect. Leave the policy set to the default (round-robin).
admin@PA-5250> show system info | match model\|sw- model: PA-5250 sw-version: 10.2.2 admin@PA-5250> show session info | match Processing <<<This doesn't show the current policy anymore admin@PA-5250> admin@PA-5250> show session distribution policy Ownership Distribution Policy: round-robin Flow Enabled Line Cards: [1] Packet Processing Enabled Line Cards: [1] admin@PA-5250> set session distribution-policy > fixed select a fixed DP > hash select DP by address hash > random select random available DP > round-robin select DP by round robin between active DPs > session-load select DP based on session load > symmetric-hash select DP by hash of sorted source and destination IP addresses admin@PA-5250> set session distribution-policy fixed s1dp0 s1dp0 s1dp1 s1dp1 <value> select a fixed DP