PA-3260 FPGA aho and dfa software offload seams to be enabled by default on 10.1.x (10.1.6-h6)

[Jakob_Staerk]

I am trying to debug high dataplane cpu on 3260, and both aho and dfa is set to software, when disabling software offload (enabling hardware offload) the high dataplane cpu is a problem of the past we have gone from 75+ to 9-10 %. When we disable sofware offload and reboot the firewall it reenables software offload after boot - so to questions comes to mind:

a) Why has software offload been enabled in the first place (it seams to have been disabled in earlier versions)

b) Is there a way to "save" the desired state ?

Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLsbCAG

[BPry · Accepted solution]

@Jakob_Staerk,

The change to utilize software for both AHO and DFA was made for internal design reasons back in PAN-OS 9.1. It isn't recommended to modify this setting back to hardware unless you've been recommended to do so by TAC. Similar to other debug commands they aren't maintained through reloads because you're changing the way PAN expects the device to be configured. 

I'd recommend reaching out to TAC and have them assist determining why you're suddenly seeing a big increase in dataplane utilization. 

[Jakob_Staerk]

Thanks for you reply

I have opened a TAC case and TAC has confirmed what you say (https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLsRCAW), i am still working with TAC and my local SE to figure out the reason for the high Dataplane cpu load.