Packet Capture for Cloud NGFW on Azure
Capture, debug, and troubleshoot network traffic directly traversing active Cloud NGFW
on Azure firewall instances using the Packet Capture feature.
| Where Can I Use This? | What Do I Need? |
|---|
|
|
- Cloud NGFW subscription
- Palo Alto Networks Customer Support Portal account
- Azure Marketplace subscription
- Azure Storage Account
- Managed Identity with Storage Blob Data Contributor role
|
The Packet Capture (PCAP) feature in Cloud NGFW on Azure enables you to capture, debug,
and troubleshoot network traffic directly traversing active firewall instances. Packet
captures are defined using a 5-tuple filter and stored securely in your Azure Storage
Account. For more information, see Packet Capture Overview.
Prerequisites
Managed Identity & Role-Based Access Control (RBAC)
To grant the firewall permission to write PCAP files to your Azure Storage Account,
ensure the Managed Identity (MI) attached to the firewall has the correct storage
permissions. The Managed Identity should be given the RBAC role Storage Blob Data
Contributor for your storage account to store packet capture files.
Identify the Untrust Subnet
When creating the firewall, subnets are configured under its settings. The untrusted
subnet represents the network space where packet capture data is written and routed
via the data plane subnet. To find untrust subnet:
- Go to the Firewall section in Azure portal.
- Open the firewall details page or view its JSON/configuration view.
- Under the configuration properties where the virtual network's subnets are
defined, look for the field labeled untrusted subnet (or untrust subnet)
alongside the trusted subnet options.
Steps to Whitelist Untrust Subnet
Go to your Azure Storage Account's Networking
section.
Under Public network access, select Enabled
from selected networks.
Click Add virtual network and choose the Virtual
Network associated with your firewall.
Select and add the firewall's Untrust Subnet.
Folder Structure & File Naming Format
- Storage Account Target: Captured files are stored in a fixed storage
container named pcap-data.
- Folder Path Format:
YYYY/MM/DD/HH-MM-SS (UTC timezone).
- File Naming Format:
<firewall-resource-name>_<chunk-number>_<stage>.pcap
(e.g., fw-instance-1_chunk0_drop.pcap).
Stage Output & Chunking Details
- Chunk-based File Generation: PCAP output files are generated in chunks
per active firewall instance and separated by stage to obfuscate specific
firewall instance counts.
- Missing Stage Files: If a file for a specific stage (e.g., drop) is not
generated in the storage directory, it indicates that no packets matched the
filter criteria at that stage during the capture duration.
This feature requires a supported Cloud NGFW firewall version. If your firewall
is running an older version, an error message will appear as a banner after you
click start custom capture. If you see this error message, please open a
support case with Palo Alto Networks to upgrade your firewall version.
Error message: "Firewall version does not meet the minimum required version for
Packet Capture. Please contact Palo Alto Networks to upgrade the firewall
version"
When an Azure Storage Account has outbound network rules configured (e.g., LRS
with an outbound rule), packet capture file uploads may fail with the following
SSL error:
Failed to upload PCAP file. Error: HTTPSConnectionPool — Max retries
exceeded. Caused by SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate
verify failed
Workaround: You do not need to disable your outbound SSL decryption policy
entirely. Instead, create a decryption bypass exception (a "Do Not Decrypt" rule)
specifically for the PCAP upload traffic:
- Destination: Your Azure Storage Account FQDN (e.g.,
<your-storage-account>.blob.core.windows.net)
- Port: 443 (HTTPS)
- Action: Do Not Decrypt
This ensures your existing outbound decryption rules remain in place while
allowing PCAP upload traffic to reach the storage endpoint without SSL
interception.
