topic Documentation on the setting "Software Cut Through" in Next-Generation Firewall Discussions

Documentation on the setting "Software Cut Through"

asaraca — Sat, 17 Sep 2022 17:27:17 GMT

Hi,

I can't seem to find any info on the setting "Software Cut Through". It's currently set to true on our PA-460. Would that affect the performance of our firewall ?

Thank you,

Antonio

Re: Documentation on the setting "Software Cut Through"

GaryOssewa — Sat, 02 Dec 2023 09:10:48 GMT

The only thing I can find is in a vm-series deployment guide for 11. However, I've encountered issues with this feature on PAN-OS 10.2.6

Re: Documentation on the setting "Software Cut Through"

EdGal — Sat, 09 Dec 2023 13:57:15 GMT

4 or five hours ago I had a issue with this parameter after upgrading to 10.2.6. We had to disable it. According to the information I have, this is what happens:

set session sw-cut-thru no

When software cut through is marked on the flow, the flow parameters aren't correctly set on GP-SSLVPN tunnel packets. This specifically affects packets in request direction and they are dropped due to missing packet fields.

The command address the problem by correctly setting packets fields in code path taken by packets when software cut through is marked on that specific flow session.

If you upgrade to 10.2.6 and after that, some, if not all your GP SSL-VPN traffic is being dropped o tcp-reset, then you should check if this parameter is the root cause.

Re: Documentation on the setting "Software Cut Through"

GaryOssewa — Sat, 09 Dec 2023 16:03:10 GMT

Same here. Bug ID PAN-231043 - supposedly fixed in 11.1.0, 11.2.0, 10.2.8, 10.2.7, 11.1.2.

Re: Documentation on the setting "Software Cut Through"

msyeedrafiqi — Sun, 10 Dec 2023 06:56:22 GMT

The 'sw-cut-thru' is a sort of software offload feature introduced in 10.1 Once XX number of packets in a session are inspected and deemed safe/valid, then the rest of the packets in that session are 'cut-through' from ingress to egress without having to go through fastpath for forwarding lookup for every packet. Or, in other words, software cut-through is a feature that aims to improve packet forwarding for platforms without hardware offload.