Palo Alto Zone Protection Silent Drops: show counter global When Ping Lies

Palo Alto · Techclick CLI troubleshooting lab

A scanner or a chatty printer is black-holed. Security policy is allow. Packet capture on the host shows SYN, firewall capture is empty.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Palo Alto for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

Zone protection and flood protection drop before policy. Read show counter global filter severity drop and the zone-protection profile counters.

Why this ticket shows up

Reconnaissance protection, SYN flood, and large-ICMP checks discard packets before a session is created, so the traffic log stays quiet.

Symptoms operators actually see

• No traffic log at all

• Only some noisy hosts fail

• Zone-protection profile attached to untrust or a user zone

• Counters climb on flood or scan

CLI first — copy this block

Run these on the Palo Alto device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

show zone-protection zone untrust
show counter global filter severity drop delta yes
show counter global filter packet-filter yes delta yes
show dos-protection zone untrust
show session all filter source 10.9.9.9

How to read that output

If you see flow_dos_* or zoneprotect_* counters climbing and no session, the packet died in zone protection. Policy will never see it.

Triage order

1. Confirm there is no session for the source.

2. Check which zone-protection profile sits on the ingress zone.

3. Read drop counters twice, 10 seconds apart.

4. Temporarily raise the flood threshold or add an exception for the scanner IP.

5. Put the scanner on a dedicated zone if it must stay noisy.

Classic traps

What you see	Real cause	Fix
Add another allow rule	Packet never reached policy	Look at zone protection
Disable all flood protection	One printer is chatty	Exception that host
Capture on the firewall egress	Drop was on ingress	Capture ingress and counters

Proof the ticket is closed

• Session appears for the host

• Drop counters stop climbing for that signature

• App works without disabling the whole profile

Say this in an interview

No traffic log means I look before policy — zone protection and DoS first.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/