Query regarding the default state of FPGA on PA-3060: What's the output of the command "debug dataplane fpga state" running on PAN-OS 9.1.7 or above?

[A_Adamski]

Dear Community Members,

I hope someone will be able to help me out to confirm the default FPGA states on the PA-3060 appliance and supply some additional info on this matter?

As per the knowledgebase article (CAN THE CONTENT INSPECTION PERFORM ONLY IN SOFTWARE OR HARDWARE ON PA-3000 SERIES FIREWALLS?) I see that the used algorithms are:

AHO - Hardware (Offloaded)

DFA - Software

*PSCAN - Software, and it will be replacing AHO (but I could not find any info in regards to when it should happen)

Unfortunately, I do not have the needed hardware to execute the command and check it by myself.

And I would like to verify what (on default on PA-3050/3060) the output of the command "debug dataplane fpga state" running the PAN-OS 9.1.7 or above is?

I'm also interested to find some more info about the change of algorithm from AHO to PSCAN?

*Does anyone knows in which PAN-OS release it was changed? Is there any documentation at PA available about this change?

 I will really appreciate it if someone could help me with those few open points. 

Thank you in advance!
Regards,
Arek

[Adrian_Jensen]

Was there ever any feedback on this Arek?

I have been trying to debug a frequent high DP CPU issue and went from 8.1 to 9.1 based on PA support recommendations. Still have the high DP CPU issue and finally found that AHO is "software only", where as the documentation says it should be in the FPGA on PA-3000 series by default. I also don't have PSCAN listed anywhere. Was this a 9.x change that made AHO software only by default? Unfortunately I don't know what state it was in 8.1.

[Jakob_Staerk]

I am also trying to debug high dataplane cpu on 3260, and both aho and dfa is set to software, when disabling software offload (enabling hardware offload) the high dataplane cpu is a problem of the past we have gone from 75+ to 9-10 %. When we disable sofware offload and reboot the firewall it reenables software offload after boot - so to questions comes to mind:

a) Why has software offload been enabled in the first place (it seams to have been disabled in earlier versions)

b) Is there a way to "save" the desired state ?

[Jakob_Staerk]

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLsRCAW

According to this knowledebase article is done on purpurse from 9.1