Weak Path Affinity

James.McCutcheon — Thu, 03 Apr 2025 05:58:26 GMT

We're looking at some interesting issues around app shift between our Prisma Access tunnel and local/DC breakout. Session starts as SSL, gets pushed over the PA tunnel, gets reidentified as an app that is set to breakout locally and the ION duly changes path and breaks the session. Most apps/devices tolerate this fine, but some refuse to reattempt a new connection and thus are broken from the user perspective.

We're looking at a few things, Path Affinity is one. The doco is pretty clear on how None and Strict work when configured in an App Override or Custom App, but looking at the predefined apps, many of them are set to Weak. But I can't find any explanation of what this default behaviour is, so can't really compare it to Strong. A full site search only gives a short summary from the API doco:

path_affinitystringrequired

This parameter defines the path affinity characteristics to consider during flow decision making. Allowed values: "none" "weak" "strict". If path affinity is none or weak and a better path is available, flows will be moved to a new path. If path affinity is strict, all application flows will continue on the same path.

Better than nothing, but also doesn't help much. Has anyone seen better doco, or done the experimenting to work out how Weak actually works compared to None?

(we have a TAC case open but it's a bit slow, this might be faster. Also aware the App Affinity might not be related to our issue if the Path Policy is higher precedence, but it's still a good knowledge gap to fill)

Re: Weak Path Affinity

nikoolayy1 — Mon, 16 Jun 2025 08:50:44 GMT

Hey @James.McCutcheon any info from the SOC as ION devices nowadays utlize the same app database as Palo Alto NGFW but on the NGFW you can see How to Prevent Application Shift - Knowledge Base - Palo Alto Networks and LIVEcommunity - Handling of and Awareness of APP-ID shifts or new releases - LIVEcommunity - 568136 while ION devices seem more limited.

topic Weak Path Affinity in Prisma SD-WAN Discussions

Weak Path Affinity

Re: Weak Path Affinity