Increased Data Plane CPU Utilization in 4.1.4?

[sham]

We recently upgraded our PA-4020s from 4.0.9 to 4.1.4 a few weeks ago.  However, since the upgrade, we have noticed a 20-25% increase in our data plane CPU.  We usually averaged around 40% during business hours, but lately it has increased to 60-65%.  We have not made any major changes to the configuration.  Palo Alto support has informed us that this is normal due to the large increase of code in 4.1 and that other customers have reported the same.  Has anyone else experienced or noticed this increase?  Thanks in advance.

[mikand]

I cant answer your question but an increase in dataplane as long as it doesnt hit 100% is no problem since the dataplane is asic/fpga based (depending on model).

But on the other hand I understand your worry regarding how much traffic the box can deal with. Another thread in here, approx 3 months old, did some tests regarding performance and noticed that the dataplane utilization isnt really 1:1 to performance - it seems that the more traffic you push to it the more it will be able to handle. For example if 50% was with 50.000 sessions then 75% was with 150.000 sessions or something like that (not exact figures, just an example).

Edit: Here is the thread I was thinking of:

Perfomance on PA 4060 - Huge Disappointment

https://live.paloaltonetworks.com/message/11714#11714

And the figures were 38% dataplane with 149.000 concurrent sessions, 50% dataplane with 220.000 concurrent sessions.

One might then think that "Ohh crap... this box isnt near the 2M concurrent sessions that the datasheet claims - more like 0.5M top".

However the user returned and observed 78% dataplane with 600.000 concurrent sessions.

[sham]

Thank you for the additional information.  Do you know if the utilization correlation not being 1:1 was something that was introduced with the 4.1 code?  I believe it used to be a 1:1 correlation in past versions.

[djrodb]

Hi

Just to add to this we've got a 2050 running 4.1.4 and over the last couple of weeks the dataplane has been hitting 100% and recently we've had about 4 outages over the last week with the dataplane resetting itself.

I've reverted back to 4.1 which seems stable.

Rod