topic Re: Why does the ip-user-mapping distinguish DP and MP? in General Topics

Why does the ip-user-mapping distinguish DP and MP?

John_Lee — Fri, 04 Dec 2015 01:54:57 GMT

Hello

suddenly, I am wondering that ip-user-mapping have two table[DP, MP]

After connecting to AD Server to get Security logs, Why PAFW get that table seperatly,?

I think there are reason, and I don't know well about relating to DP, MP

If DP was restart about someting problem, Would PA be able to get user information through MP?

Do I think of backup?

I have been waiting for answer cleary 😄

Thank you

Re: Why does the ip-user-mapping distinguish DP and MP?

reaper — Fri, 04 Dec 2015 08:09:43 GMT

Hi John_Lee

The management plane has a much larger chunk of memory reserved for user-IP mappings than the dataplane and will serve as a cache to the dataplane whenever it needs mapping information that is not loaded on the DP yet. If the dataplane were to be restarted the MP will still contain all the mappings.

regards

Tom

Re: Why does the ip-user-mapping distinguish DP and MP?

pbalasunda — Thu, 11 Aug 2016 08:13:21 GMT

@reaper

When you mean MP has a huge chunk of memory for user-ip-mappings, I understand that DP has a limit.

And I would assume that DP cannot write more than what it can hold, how is the scenario where DP cache is already full handled?

Does it overwrite one of the mappings? Which is chosen to be swapped out?

(Might be it maintains a table which has number of hits, or the oldest one that was written in DP, etc?)

Re: Why does the ip-user-mapping distinguish DP and MP?

reaper — Thu, 11 Aug 2016 10:21:33 GMT

the mappings with the lowest time left on the idle timer (so have been idle longest) will be swapped out first

Re: Why does the ip-user-mapping distinguish DP and MP?

pbalasunda — Thu, 11 Aug 2016 10:43:17 GMT

Thank you @reaper