PA-3260 FPGA aho and dfa software offload seams to be enabled by default on 10.1.x (10.1.6-h6)

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

PA-3260 FPGA aho and dfa software offload seams to be enabled by default on 10.1.x (10.1.6-h6)

L1 Bithead

I am trying to debug high dataplane cpu on 3260, and both aho and dfa is set to software, when disabling software offload (enabling hardware offload) the high dataplane cpu is a problem of the past we have gone from 75+ to 9-10 %. When we disable sofware offload and reboot the firewall it reenables software offload after boot - so to questions comes to mind:

a) Why has software offload been enabled in the first place (it seams to have been disabled in earlier versions)

b) Is there a way to "save" the desired state ?

 

Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLsbCAG

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

@Jakob_Staerk,

The change to utilize software for both AHO and DFA was made for internal design reasons back in PAN-OS 9.1. It isn't recommended to modify this setting back to hardware unless you've been recommended to do so by TAC. Similar to other debug commands they aren't maintained through reloads because you're changing the way PAN expects the device to be configured. 

I'd recommend reaching out to TAC and have them assist determining why you're suddenly seeing a big increase in dataplane utilization. 

View solution in original post

2 REPLIES 2

Cyber Elite
Cyber Elite

@Jakob_Staerk,

The change to utilize software for both AHO and DFA was made for internal design reasons back in PAN-OS 9.1. It isn't recommended to modify this setting back to hardware unless you've been recommended to do so by TAC. Similar to other debug commands they aren't maintained through reloads because you're changing the way PAN expects the device to be configured. 

I'd recommend reaching out to TAC and have them assist determining why you're suddenly seeing a big increase in dataplane utilization. 

Thanks for you reply

 

I have opened a TAC case and TAC has confirmed what you say (https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLsRCAW), i am still working with TAC and my local SE to figure out the reason for the high Dataplane cpu load.

  • 1 accepted solution
  • 1466 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!