How to Take LACP packet captures at Palo Alto Firewall via GUI

The objective of this procedure is to capture LACP control traffic (LACPDUs) to diagnose issues such as link aggregation flaps, negotiation failures, or synchronization delays between the firewall and its peer device.

• Palo Alto Networks Next-Generation Firewalls

• PAN-OS 7.1 and later

• LACP-enabled Aggregate Ethernet (AE) interfaces

1. 1. 1. Access the Packet Capture Tool:

         • Log in to the Web Interface.

         • Navigate to Monitor > Packet Capture.

      2. Configure the Capture Filter:

         • Click Manage Filters and click Add.

         • ID: 1

         • Interface: Select the specific physical member interface of the AE group you wish to troubleshoot.

         • Non-IP: Select only from the drop-down menu to focus on LACP (which is non-IP traffic).

         • Click OK.

         • Set Filtering to ON at the top of the page.

      3. Configure Capture Stages:

         • Under the Stage section, click Add to define where the firewall should intercept the packets.

         • Stage: Select receive; File Name: lacp_receive.pcap.

         • Stage: Select firewall; File Name: lacp_firewall.pcap.

         • Stage: Select transmit; File Name: lacp_transmit.pcap.

         • Stage: Select drop; File Name: lacp_drop.pcap.

         • Click OK.

      4. Execute the Capture:

         • Set Packet Capture to ON.

         • Acknowledge the system performance warning by clicking OK.

         • Note: LACP packets are typically sent every 1 second (Fast) or 30 seconds (Slow). Allow the capture to run for at least 60 seconds to ensure multiple exchanges are recorded.

      5. Stop and Download:

         • Set Packet Capture to OFF.

         • Click the Refresh icon in the Captured Files section.

         • Click the filenames (lacp_receive.pcap, lacp_firewall.pcap, lacp_transmit.pcap, and lacp_drop.pcap) to download them to your local machine for analysis in Wireshark.

• Stage Definitions:

  • Receive: Packets as they arrive at the ingress interface.

  • Firewall: Packets as they are processed by the security engine.

  • Transmit: Packets as they are sent out of the egress interface.

  • Drop: Packets that are discarded by the firewall. This is critical for seeing if the firewall is intentionally rejecting a peer's LACPDU.

• Resource Impact: Packet capture is CPU-intensive. Always ensure the feature is turned OFF immediately after you have collected the required data.