topic Re: Not updating low traffic session status with hw offload enabled in Next-Generation Firewall Discussions

Not updating low traffic session status with hw offload enabled

nikoo — Tue, 14 Mar 2023 08:13:46 GMT

PA-32xx series with 10.1.9 (issue showed up after upgrade)

There is long-lasting SSH session where only something like keepalive is sent every 5 minutes or so. With hardware offload enabled, this traffic is not registered in the dataplane (session stats are not increasing even though there is traffic for that session) and subsequently TTL is not reset and session breaks after hour (TCP timeout).

If HW offload is disabled - everything works as expected, each keepalive resets TCP session TTL.

it looks like the same behavior was seen on other "low traffic" sessions, but SSH is the most obvious one.

Currently there is TAC case open and under research, but I have a feeling this may be wider issue, so maybe there's already feedback on this?

Re: Not updating low traffic session status with hw offload enabled

nikoolayy1 — Thu, 23 Mar 2023 07:16:26 GMT

You may not see it as it is offloaded but have you checked if you create a new service just to change the timeout for example to 4/3 minutes what happens?

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PMbvCAG

Also test application overide:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVLCA0

Re: Not updating low traffic session status with hw offload enabled

nikoo — Fri, 14 Apr 2023 07:17:20 GMT

For future generations - issue PAN-216314. Long story short - there are two ways DP is registering offloaded traffic counters - traffic and time based (Disable Firewall offloading traffic) and time based mechanism was disabled after the upgrade.

When running "debug dataplane internal pdt fe100 csr rd name sem_ctrl" in case of this issue value was

[ 8] ctr_scan_dis = 1 (0x1)

... but it should be 0.

Can be changed via "debug dataplane internal pdt fe100 csr wr_sem_ctrl_ctr_scan_dis value 0".

There is no interruption in traffic, has to be done on each HA node.

Use at your own risk.

Re: Not updating low traffic session status with hw offload enabled

NicolasReyes — Fri, 02 Jun 2023 03:29:16 GMT

Hello, did the TAC give you any solution?