Symmetric return on L2 subinterface fails after some time

[andregrueneberg]

We are running the latest PanOS 8.1 version on a PA3050 and we want to make use of symmetric return. In general this is working just fine, but it seems we are triggering a corner case. We can successfully initiate an SSH session (i.e. key exchange, authentication etc. work like a charm), but after 4-5 characters on the prompt, the session freezes. So far we have found that the freeze is caused by VLAN tags not being present in the outgoing return packets.

Example:

Client 192.168.1.13 behind Router 10.100.1.244 connected to PA on ethernet1/2.410 wants to connect to server 192.168.2.21:22 connected to PA on ethernet1/2.835.

Without PBF the client 192.168.1.13 is in another VLAN directly connected to the same PA, but we have found that this doesn't matter. It does matter that the client is not directly connected to the same VLAN -- i.e. traffic originated by 10.100.1.244 (also matching the PBF rule) works flawlessly.

We have a PBF like that:

<entry name="return">
  <action>
    <no-pbf/>
  </action>
  <from>
    <interface>
      <member>vlan.410</member>
    </interface>
  </from>
  <enforce-symmetric-return>
    <enabled>yes</enabled>
    <nexthop-address-list>
      <entry name="10.100.1.244"/>
    </nexthop-address-list>
  </enforce-symmetric-return>
  <source>
    <member>any</member>
  </source>
  <destination>
    <member>n_192.168.2.0-24</member>
  </destination>
  <source-user>
    <member>any</member>
  </source-user>
  <application>
    <member>any</member>
  </application>
  <service>
    <member>s_ssh</member>
  </service>
</entry>

I.e. no-pbf for the forward section and symmetric return via the router.

Has anyone ever come accross this issue? Any idea why after some time the VLAN tag 410 is just dropped from return packets?

What bugs me the most: The session is running like a charm ... until after the handshake (application detection?) and only then the VLAN tags goes missing.

Thanks for ideas,

André

PS: So far the first level support was not very helpful with this issue.