topic Re: HA Group 1: Dataplane is down: packet descriptor leak detected on slot 1 dp0 in General Topics

HA Group 1: Dataplane is down: packet descriptor leak detected on slot 1 dp0

Tue, 27 May 2014 17:36:08 GMT

Hi Guys,

Just encountered a failure on 4000 in an HA setup.

First error is tasks: DP packet descriptor leak detected on slot 1 dp0

HA Group 1: Dataplane is down: packet descriptor leak detected on slot 1 dp0

HA Group 1: Moved from Active to state Non-Functional.

Running recently upgraded to 5.0.12.

Has anyone seen something this or something similar? It seems even after a restart of the firewalls that the problem is still there.

LAN is connected to H3C switches and the Untrust is connected to HP Procurve switches.

No arp entry for the firewall on H3C for LAN IP of the firewall

Had to reboot Internet switch to get everything back up and running.

Opened a case with PAN support as well but wanted to ask here in case someone's seen it.

Thanks so much

Chris

Re: HA Group 1: Dataplane is down: packet descriptor leak detected on slot 1 dp0

mbutt — Thu, 29 May 2014 15:31:41 GMT

Hi Chris,

As i recall similar issue has been seen and are fixed in 6.0.x code.

Here is the bug detail from the release notes of 6.0.x

56107—Addressed dataplane restarts that occurred intermittently on the PA-3000 Series devices deployed in an HA configuration.

Thank you

Numan

Re: HA Group 1: Dataplane is down: packet descriptor leak detected on slot 1 dp0

Tue, 15 Jul 2014 18:28:55 GMT

Hi Numan,

Support finally figured out that the issue is due to an inter-vr routing loop. The problem is that the network processor kept processing the packet and eventually ran out of resources which causes dp restarts and other odd behaviour in the firewall. I was told that in version 6.04 slated to be released at the end of the month, the processing will be offloaded to the data plane and then it will be stopped. A very interesting problem that took about a month to resolve but I'm glad that we've made progress. For now, we use static routes with higher admin distance as a workaround. Thanks

Re: HA Group 1: Dataplane is down: packet descriptor leak detected on slot 1 dp0

pulukas — Tue, 15 Jul 2014 21:01:32 GMT

Thanks for sharing the final answer.