PA-3260 FPGA aho and dfa software offload seams to be enabled by default on 10.1.x (10.1.6-h6)

[Jakob_Staerk]

I am trying to debug high dataplane cpu on 3260, and both aho and dfa is set to software, when disabling software offload (enabling hardware offload) the high dataplane cpu is a problem of the past we have gone from 75+ to 9-10 %. When we disable sofware offload and reboot the firewall it reenables software offload after boot - so to questions comes to mind:

a) Why has software offload been enabled in the first place (it seams to have been disabled in earlier versions)

b) Is there a way to "save" the desired state ?

Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLsbCAG

[BPry · Accepted solution]

@Jakob_Staerk,

The change to utilize software for both AHO and DFA was made for internal design reasons back in PAN-OS 9.1. It isn't recommended to modify this setting back to hardware unless you've been recommended to do so by TAC. Similar to other debug commands they aren't maintained through reloads because you're changing the way PAN expects the device to be configured. 

I'd recommend reaching out to TAC and have them assist determining why you're suddenly seeing a big increase in dataplane utilization. 

[Jakob_Staerk]

Thanks for you reply

I have opened a TAC case and TAC has confirmed what you say (https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLsRCAW), i am still working with TAC and my local SE to figure out the reason for the high Dataplane cpu load.

[BrijenS]

Hello Jakob,

We are on similar boat as you can you let me know were you able to resolve High DP CPU utilization issue? were you able to find reason for the High DP CPU load?  did TAC recommend any solution?

Thanks,

Brijen Shah

[Jakob_Staerk]

Hi Brijen

Well TAC was basically waste of time - a software upgrade actually solved the problem. The PA-3260 is currently running 11.1.6-p3 and we are currently not seeing the issue.

I don't know what release would work on 10.1.x 

Good luck (Sorry i can't be more helpfull)

[BrijenS]

Thankyou for the update Jakob! Really Appreciate it!

Just curious you moved from 10.1 Train to 11.x and issue got resolved? have you tried any stable releases on 10.2 train? we are on 10.2.8-H4 and seeing this issue.

[Jakob_Staerk]

I can't say for sure - for some time we have been troubled by the high management cpu load - this is also solved tin 11.1.6.h3 (h1 still had the issue) The software upgrades have been driven by emergency upgrades because of security vulnerability - for quite some time now. (we can only dream of a rock solid software release these days)

[BrijenS]

understood... so were you facing MP CPU spikes along with DP CPU? we been having issues with DP (Data Plane CPU).