Questions about PAN-303959

[MasaW]

Attention: Global TPM team,

Hi,

I have some question about PAN-303959.
----
Traffic that is incorrectly identified as unknown-tcp/unknown-udp eventually drops due to an App-ID resource limitation issue.
----
https://docs.paloaltonetworks.com/pan-os/11-2/pan-os-release-notes/pan-os-11-2-9-known-and-addressed...

Q1)

What specifically is the situation where this issue occurs?

Q2)
What exactly is the App-ID resource limitation?

Q3)
Is there a workaround for this issue?

BR,
MasaW

[kiwi]

Hi @MasaW ,

For this specific bug the counter appid_post_pkt_queued counter is critical. An increasing value here shows that packets are being queued for App-ID processing. This a precursor to failure.

Once the appid_exceed_pkt_limit_post counter begins to increment, it is a definitive sign that the system is in a bad state. This counter confirms the App-ID engine has hit its configured limit for total queued packet size, resulting in the failure of application identification and the dropping of traffic.

Please reach out to TAC for a target fix and possible workaround.

Kind regards,

-Kim.