PSE-PLATFORM · Question #236
A network security engineer for a large company has just installed a PA-5060 Firewall to isolate the company's PCI environment from its production network. The company's engineers made configuration…
The correct answer is C. show interface ethernet1/1 D. show interface logical. show interface ethernet1/1 (C) targets the specific suspected interface, revealing physical-layer details like link state, speed, duplex, and error counters - exactly what you need when a cutover introduces latency and connectivity issues that suggest a speed/duplex mismatch…
Question
A network security engineer for a large company has just installed a PA-5060 Firewall to isolate the company's PCI environment from its production network. The company's engineers made configuration changes to the switches on both network segments, and connected them to the new firewall. Soon after the cutover, however, users began to complain about latency and some servicers stopped communicating. There are no security policies that deny traffic between the two networks segments. You suspect that there is an interface misconfiguration on Ethernet 1/1. Which two commands should be used to troubleshoot the issue? (Choose two)
Options
- Ashow interface hardware
- Bshow interface management
- Cshow interface ethernet1/1
- Dshow interface logical
How the community answered
(38 responses)- A13% (5)
- B5% (2)
- C82% (31)
Explanation
show interface ethernet1/1 (C) targets the specific suspected interface, revealing physical-layer details like link state, speed, duplex, and error counters - exactly what you need when a cutover introduces latency and connectivity issues that suggest a speed/duplex mismatch. show interface logical (D) complements this by exposing the logical configuration: IP addressing, zone assignment, and virtual router membership - misconfigurations here would also explain broken inter-segment communication despite having no blocking security policies.
Why the distractors fail: Option A (show interface hardware) returns hardware-level data for all interfaces in aggregate and is not targeted enough to isolate a specific interface issue. Option B (show interface management) only examines the out-of-band MGT port, which is entirely unrelated to data-plane interfaces like ethernet1/1.
Memory tip: Think physical then logical - on PAN-OS, every interface has two planes to inspect. When a specific interface is suspect, always pair the named interface command (show interface ethernet1/1) with the logical view (show interface logical) to cover both OSI Layer 1/2 symptoms and Layer 3 misconfigurations in one diagnostic pass.
Topics
Community Discussion
No community discussion yet for this question.