Why does the ip-user-mapping distinguish DP and MP?

[John_Lee]

Hello

suddenly, I am wondering that ip-user-mapping have two table[DP, MP]

After connecting to AD Server to get Security logs, Why PAFW get that table seperatly,?

I think there are reason, and I don't know well about relating to DP, MP

If DP was restart about someting problem, Would PA be able to get user information through MP?

Do I think of backup?

I have been waiting for answer cleary 😄

Thank you

[reaper · Accepted solution]

Hi John_Lee

The management plane has a much larger chunk of memory reserved for user-IP mappings than the dataplane and will serve as a cache to the dataplane whenever it needs mapping information that is not loaded on the DP yet. If the dataplane were to be restarted the MP will still contain all the mappings.

regards

Tom

[pbalasunda]

@reaper

When you mean MP has a huge chunk of memory for user-ip-mappings, I understand that DP has a limit.

And I would assume that DP cannot write more than what it can hold, how is the scenario where DP cache is already full handled?

Does it overwrite one of the mappings? Which is chosen to be swapped out?

(Might be it maintains a table which has number of hits, or the oldest one that was written in DP, etc?)

[reaper]

the mappings with the lowest time left on the idle timer (so have been idle longest) will be swapped out first

[pbalasunda]

Thank you @reaper