with session offloaded packet will not go through dataplane ?

fatboy1607 — Thu, 22 Dec 2016 11:39:58 GMT

how will that packet flow ?
what does offload processor exacly do ? understanding of it
why it needs APP-ID completed

Re: with session offloaded packet will not go through dataplane ?

kiwi — Thu, 22 Dec 2016 12:09:08 GMT

Once App-ID and Content Inspection are fully completed, the session and subsequent packets can be fully offloaded into the offload processor (FPGA chip). Ingress packets will never reach the Dataplane anymore and the FPGA offload chip will fully manage packet forwarding. This operation will alleviate the load on the Dataplane's cores.

Source + additional details : https://live.paloaltonetworks.com/t5/Learning-Articles/Differences-between-packets-in-slow-path-fast-path-and-offloaded/ta-p/58845

Session statistics and timers are maintained in software.

So, it is necessary for offload chip to send regular updates to sofware.

You can verify if a session has been offloaded with show session id <id_num> command.

For example:

> show session id 421199

Session 421199

c2s flow:

source: 172.24.12.116 [Untrust-L3]

dst: 192.168.41.21

proto: 6

sport: 43871 dport: 22

state: ACTIVE type: FLOW

src user: unknown

dst user: unknown

offload: Yes

...

Cheers,

-Kim.

topic Re: with session offloaded packet will not go through dataplane ? in General Topics

with session offloaded packet will not go through dataplane ?

Re: with session offloaded packet will not go through dataplane ?