Query regarding the default state of FPGA on PA-3060: What's the output of the command "debug dataplane fpga state" running on PAN-OS 9.1.7 or above?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Query regarding the default state of FPGA on PA-3060: What's the output of the command "debug dataplane fpga state" running on PAN-OS 9.1.7 or above?

L2 Linker

Dear Community Members,

 

I hope someone will be able to help me out to confirm the default FPGA states on the PA-3060 appliance and supply some additional info on this matter?

 

As per the knowledgebase article (CAN THE CONTENT INSPECTION PERFORM ONLY IN SOFTWARE OR HARDWARE ON PA-3000 SERIES FIREWALLS?) I see that the used algorithms are:

 

AHO - Hardware (Offloaded)

DFA - Software

*PSCAN - Software, and it will be replacing AHO (but I could not find any info in regards to when it should happen)

Unfortunately, I do not have the needed hardware to execute the command and check it by myself.

And I would like to verify what (on default on PA-3050/3060) the output of the command "debug dataplane fpga state" running the PAN-OS 9.1.7 or above is?

 

I'm also interested to find some more info about the change of algorithm from AHO to PSCAN?

*Does anyone knows in which PAN-OS release it was changed? Is there any documentation at PA available about this change?

 

 I will really appreciate it if someone could help me with those few open points. 

 

Thank you in advance!
Regards,
Arek

 

3 REPLIES 3

L6 Presenter

Was there ever any feedback on this Arek?

 

I have been trying to debug a frequent high DP CPU issue and went from 8.1 to 9.1 based on PA support recommendations. Still have the high DP CPU issue and finally found that AHO is "software only", where as the documentation says it should be in the FPGA on PA-3000 series by default. I also don't have PSCAN listed anywhere. Was this a 9.x change that made AHO software only by default? Unfortunately I don't know what state it was in 8.1.

L1 Bithead

I am also trying to debug high dataplane cpu on 3260, and both aho and dfa is set to software, when disabling software offload (enabling hardware offload) the high dataplane cpu is a problem of the past we have gone from 75+ to 9-10 %. When we disable sofware offload and reboot the firewall it reenables software offload after boot - so to questions comes to mind:

a) Why has software offload been enabled in the first place (it seams to have been disabled in earlier versions)

b) Is there a way to "save" the desired state ?

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLsRCAW

 

According to this knowledebase article is done on purpurse from 9.1

  • 2840 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!