PAN-308564 Known Issue

[JosephBedard]

I could not help notice that all of the latest and preferred 11.1.x, 11.2.x and even 12.1.x all have the following known issue.

PAN-308564

Packets are dropped on SD-WAN interfaces if they require fragmentation for an interface but have the Don't Fragment (DF) bit set. This results in unexpected packet drops. This affects client to server sessions when using SD-WAN for NGFW. Workaround: Allow fragmenting packets with DF bit set (debug dataplane set ip4-ignore-df yes).

What I am curious about is because this sounds like expected IP behavior. When a DF bit is set and the packet exceeds the MTU, it gets dropped.

RFC 8900 - IP Fragmentation Considered Fragile

The only thing if this is an issue is in cases where PMTU (ICMP Type 3, Code 4) is being black holed.

Given this KB: Effects Of Interface MTU on SDWAN VIF - Knowledge Base - Palo Alto Networks

I find that all my IPSec tunnel based SDWAN VIFs have a MTU of 1432, as expected.

RFC8900 describes a scenario that may be relevent to SDWAN path logic. (Section 3.2. Policy-Based Routing)

So I tested it.  I had one path with a underlay MTU of 1500 and another path with a MTU at 1432.

The SDWAN VIF properly showed a MTU of 1432. (Expected as per the KB above)

As the bug report described above, I experienced a flurry of dropped packets due to fragmentation in my tests.

After placing a MSS clamp (adjustment of 109) and the problem of drops went away.

This lead me to hypothesis that the issue with PAN-308564 may be that the SDWAN VIF may be black holing PMTUD.

No quesiton here, just sharing my recent observations.