topic Re: Questions about PAN-303959 in General Topics

Questions about PAN-303959

MasaW — Fri, 14 Nov 2025 08:31:33 GMT

Attention: Global TPM team,

Hi,

I have some question about PAN-303959.
----
Traffic that is incorrectly identified as unknown-tcp/unknown-udp eventually drops due to an App-ID resource limitation issue.
----
https://docs.paloaltonetworks.com/pan-os/11-2/pan-os-release-notes/pan-os-11-2-9-known-and-addressed-issues/pan-os-11-2-9-known-issues

Q1)

What specifically is the situation where this issue occurs?

Q2)
What exactly is the App-ID resource limitation?

Q3)
Is there a workaround for this issue?

BR,
MasaW

Re: Questions about PAN-303959

kiwi — Wed, 19 Nov 2025 09:26:22 GMT

Hi @MasaW ,

For this specific bug the counter appid_post_pkt_queued counter is critical. An increasing value here shows that packets are being queued for App-ID processing. This a precursor to failure.

Once the appid_exceed_pkt_limit_post counter begins to increment, it is a definitive sign that the system is in a bad state. This counter confirms the App-ID engine has hit its configured limit for total queued packet size, resulting in the failure of application identification and the dropping of traffic.

Please reach out to TAC for a target fix and possible workaround.

Kind regards,

-Kim.

Re: Questions about PAN-303959

AlexHalbarth — Mon, 04 May 2026 12:32:04 GMT

Hello @kiwi,

Thanks for the clarification.

Will drops happen silently with this bug or would the traffic just go to the intrazone-default rule and cause a log to be generated for discarded traffic?

Thanks and kind regards,

Alexander