- As of today you can purchase only following instance family as a reserved instance for elastic search service.
- C4 Compute optimized
- I3 Storage optimized
- M4 General purpose
- R4 Memory optimized
- Note: You will not be able to reserve the T2 family instances for elastic search service.
Day: December 9, 2018
Enable Packet Captures on Palo Alto:
- This document describes the basic steps and commands to configure packet captures on Palo Alto firewalls.
- Create Packet Captures through CLI:
- Create packet filters:
- debug dataplane packet-diag set filter match source <IP_1> destination <IP_2>
- debug dataplane packet-diag set filter on
- debug dataplane packet-diag show setting
- If no source or destination IP address is specified, then “any” (0.0.0.0) is assumed.
- Define the packet capture stages and the corresponding files
- debug dataplane packet-diag set capture stage transmit file <filename_transmit>
- debug dataplane packet-diag set capture stage receive file <filename_receive>
- debug dataplane packet-diag set capture stage firewall file <filename_firewall>
- debug dataplane packet-diag set capture stage drop file <filename_drop>
- Start the packet captures
- debug dataplane packet-diag set capture on
Note: Before starting the captures, make sure that the capture filters have been configured and that the filtering is turned on. For example:
admin@PAN-FW> debug dataplane packet-diag show setting
——————————————————————————–
Packet diagnosis setting:
——————————————————————————–
Packet filter
Enabled: yes
Match pre-parsed packet: no
Index 1: 192.168.0.1[0]->10.20.30.1[0], proto 0
ingress-interface any, egress-interface any, exclude non-IP
Important! Starting a capture without filtering may overload the firewall
- Stop the packet capture
- debug dataplane packet-diag set capture off
- View the capture files
- view-pcap filter-pcap <filename>
To view the capture file in real-time while the capture is running, use the following command:
- view-pcap follow yes filter-pcap <filename>
- Export the capture files
- scp export filter-pcap from <file> to <SCP_serv>
- <SCP_Serv> = user@server:path
- tftp export filter-pcap from <file> to <tftp_Server_addr>
- Clear the packet filters and captures
- debug dataplane packet-diag set filter off
- debug dataplane packet-diag clear filter all
- debug dataplane packet-diag clear capture all
- Enable Packet Captures on webui:
- On the WebUI
- Go to Monitoring > Packet Capture
- Create and Enable a Packet Filter:
- Create stages to capture packets and specify file names:
- Click OK to enable captures
- Download the capture file(s) via HTTP by clicking on the corresponding links after refreshing the capture page.
- On the WebUI