Palo Alto Firewall insights

Complex firewall rules with multiple conditions cause high CPU utilization on the dataplane, leading to session drops and packet loss. This occurs when rules are not optimized or consolidated, forcing the firewall to evaluate excessive conditions per packet.

Firewall's threat signature database, App-ID definitions, or antivirus signatures are outdated, leaving the network vulnerable to known exploits. This occurs when content updates fail to download or install automatically.

Security policy rulebase contains unused or rarely-hit rules that expand attack surface unnecessarily. These rules add processing overhead and may contain misconfigurations that create unintended access paths.

Applications running on non-standard ports bypass security policies designed for default ports, creating security gaps. Attackers exploit this by tunneling malicious traffic through allowed applications on unexpected ports.

High Availability failover events occur when one firewall in an HA pair experiences significantly higher packet drops than its peer, causing health check failures. This is often caused by interface errors, forwarding errors, or zone routing issues.

NAT IP pool reaches capacity, preventing new outbound connections from being established. This manifests as connection timeouts for users despite firewall CPU and bandwidth being available.

Firewall session table reaches capacity due to accumulation of long-lived sessions with improper timeout configurations, causing new connection attempts to be dropped or rejected.

DNS proxy cache exhaustion or DNS server connectivity issues cause application traffic failures, manifesting as connection timeouts or incomplete handshakes. This is particularly impactful for applications using dynamic FQDNs in security policies.