VM-Series
Deployment
Guide
17
Set Up a VM-Series Firewall on an ESXi Server
Troubleshoot ESXi Deployments
Troubleshoot ESXi Deployments
Many of the troubleshooting steps for the VM-Series firewall are very similar to the hardware versions of
PAN-OS. When problems occur, you should check interface counters, system log files, and if necessary, use
debug to create captures. For more details on PAN-OS troubleshooting, refer to the article on
Packet Based
Troubleshooting
.
The following sections describe how to troubleshoot some common problems:
Basic Troubleshooting
Installation Issues
Licensing Issues
Connectivity Issues
Basic Troubleshooting
For performance related issues on the firewall, first check the
Dashboard
from the firewall web interface. To view
alerts or create a tech support or stats dump files navigate to
Device > Support
.
For information in the vSphere client go to
Home > Inventory > VMs and Templates
, select the VM-Series firewall
instance and click the
Summary
tab. Under
Resources
, check the statistics for consumed memory, CPU and
storage. For resource history, click the
Performance
tab and monitor resource consumption over time.
Installation Issues
Issues with deploying the OVF
The VM-Series is delivered as a downloadable Open Virtualization Format (OVF) file. The OVF is downloaded
as a zip archive that is expanded into three files. If you are having trouble deploying the OVF, make sure the
three files are unpacked and present and if necessary, download and extract the OVF again.
The ovf extension is for the OVF descriptor file that contains all metadata about the package and its
contents.
The mf extension is for the OVF manifest file that contains the SHA-1 digests of individual files in the
package.
Recommendation for Network Troubleshooting Tools
It is useful to have a separate troubleshooting station to capture traffic or inject test packets in the
virtualized environment. It can be helpful to build a fresh OS from scratch with common
troubleshooting tools installed such as tcpdump, nmap, hping, traceroute, iperf, tcpedit, netcat,
etc. This machine can then be powered down and converted to a template. Each time the tools
are needed, the troubleshooting client (virtual machine) can be quickly deployed to the virtual
switch(es) in question and used to isolate networking problems. When the testing is complete,
the instance can simply be discarded and the template used again the next time it is required.
