Change the Session Distribution Policy and View Statistics
The following table describes how to view and change the active Session Distribution Policies and describes how to view session statistics for each dataplane processor (DP) in the firewall.
Show the active session distribution policy.
Use the show session distribution policy command to view the active session distribution policy.
The following output is from a PA-7080 firewall with four NPCs installed in slots 2, 10, 11, and 12 with the ingress-slot distribution policy enabled:
> show session distribution policy
Ownership Distribution Policy: ingress-slot
Flow Enabled Line Cards: [2, 10, 11, 12]Packet Processing Enabled Line Cards: [2, 10, 11, 12]
Change the active session distribution policy.
Use the set session distribution-policy <policy> command to change the active session distribution policy.
For example, to select the session-load policy, enter the following command:
> set session distribution-policy session-load
View session distribution statistics.
Use the show session distribution statistics command to view the dataplane processors (DPs) on the firewall and the number of sessions on each active DP.
The following output is from a PA-7080 firewall:
> show session distribution statistics DP Active Dispatched Dispatched/sec ------------------------------------------ s1dp0 78698 7829818 1473 s1dp1 78775 7831384 1535 s3dp0 7796 736639 1488 s3dp1 7707 737026 1442
The DP Active column lists each dataplane on the installed NPCs. The first two characters indicate the slot number and the last three characters indicate the dataplane number. For example, s1dp0 indicates dataplane 0 on the NPC in slot 1 and s1dp1 indicates dataplane 1 on the NPC in slot1.
The Dispatched column shows the total number of sessions that the dataplane processed since the last time the firewall rebooted.
The Dispatched/sec column indicates the dispatch rate. If you add the numbers in the Dispatched column, the total equals the number of active sessions on the firewall. You can also view the total number of active sessions by running the show session info CLI command.
The PA-5200 Series firewall output will look similar, except that the number of DPs depends on the model and there is only one NPC slot (s1).
Session Distribution Policies
Session Distribution Policies Session distribution policies define how PA-5200 and PA-7000 Series firewalls distribute security processing (App-ID, Content-ID, URL filtering, SSL decryption, and IPSec) among ...
Session Distribution Policy Descriptions
Session Distribution Policy Descriptions The following table provides information about Session Distribution Policies to help you decide which policy best fits your environment and firewall ...
Detailed Device Health in Panorama
Description of the Detailed Device View for device monitoring on Panorama™. ...
Session Owner In an HA active/active configuration, both firewalls are active simultaneously, which means packets can be distributed between them. Such distribution requires the firewalls ...
Troubleshoot Clientless VPN
Troubleshoot Clientless VPN Because this feature involves dynamic re-writing of HTML applications, the HTML content for some applications may not re-write correctly and break the ...
Configure Decryption Broker with One or More Layer 3 Securi...
Configure Decryption Broker with One or More Layer 3 Security Chain Perform the following steps to enable the firewall to act as a decryption broker ...
View Settings and Statistics
View Settings and Statistics Use show commands to view configuration settings and statistics about the performance of the firewall or Panorama and about the traffic ...
Custom PAN-OS Metrics Published for Monitoring
PAN-OS® metrics published to public cloud monitoring systems such as AWS® CloudWatch, Azure® Application Insights, and Google® Stackdriver. ...