Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Have a Palo Alto Networks PA-200 firewall with the basic setup complete, all outgoing traffic allowed and working fine.

This is showing up in the traffic logs going from the created internal and external zones.

I have been unable to log traffic that is coming in from the external zone - using the packet capture feature I can see pings hitting the interface, but can not get any logs showing dropped packets.

How can I make this type of traffic visible?

There is next to no information online about configuring these devices and just getting this far has been quite hard work!

tag request: palo-alto-networks

share|improve this question
created the tag for you, something I didn't know I could do, hah – SpacemanSpiff Nov 15 '12 at 20:25
up vote 3 down vote accepted

What you are missing is an explicit deny rule that logs the traffic, but be careful, sometimes you have intra-zone traffic out there that is expected behavior.

So... create a rule from external to internal zones to deny all traffic with logging.

share|improve this answer
That worked, thank you. Now seeing dropped ICMP. 1. Added an explicit drop all on the incoming zone with the log setting ticked and log forwarding to panorama set. 2. Added NAT rule between the zone (with no translation). 3. New save and commit. – xddsg Nov 15 '12 at 19:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.