Unable to change hardware udp session offloading setting as false

[JoHyeonJae]

 

Hello all,

I am using PA-440 on the PAN-OS 10.2.3-h4.

Due to performance degradation issues, hardware session offloading and hardware udp session offloading was changed to false through the following commands.

> configure
# set deviceconfig setting session offload no
# commit

However, hardware session offloading has changed normally, but hardware udp session offloading has an issue that does not change.

Does anyone know how to take action?

Thanks,

[kiwi · Accepted solution]

Hi @JoHyeonJae ,

Sounds very similar to the issue PAN-83610 (https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-release-notes/pan-os-10-1-5-known-and-addressed...).

Can you try the workaround solution ?

you can persistently disable session offload for only UDP traffic using the 'set session udp-offload no' CLI command.

Hope this helps,

-Kiwi.

[JoHyeonJae]

@kiwi 

Thank you for your reply!

Is this an issue that can occur with 440 equipment, not 5200 series?

[JoHyeonJae]

 Moreover, the system display that 'set session udp-offload no' is an invalid command.

[TomYoung · Accepted solution]

Hi @JoHyeonJae ,

These documents say that offloading is only supported on the PA-3200, PA-5200, and PA-7000 Series.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm8cCAC  So does this one.  https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/monitoring/take-packet-captures/disable-h...

The 1st URL mentions an FPGA that is used for it.  This link -> https://www.paloaltonetworks.com/resources/pa-series-next-generation-firewalls-hardware-architecture... show FPGAs for the 3 Series above and the PA-5400 Series, but not the PA-400.

So, it has never been a feature on the lower end models, and the PA-400 Series does not have FPGAs.  I could be wrong but the evidence suggests the PA-400 does not support this feature.

Thanks,

Tom