with session offloaded packet will not go through dataplane ?

[fatboy1607]

how will that packet flow ?
what does offload processor exacly do ? understanding of it
why it needs APP-ID completed

[kiwi]

Hi @fatboy1607,

Once App-ID and Content Inspection are fully completed, the session and subsequent packets can be fully offloaded into the offload processor (FPGA chip). Ingress packets will never reach the Dataplane anymore and the FPGA offload chip will fully manage packet forwarding. This operation will alleviate the load on the Dataplane's cores.

Source + additional details : https://live.paloaltonetworks.com/t5/Learning-Articles/Differences-between-packets-in-slow-path-fast...

Session statistics and timers are maintained in software.

So, it is necessary for offload chip to send regular updates to sofware.

You can verify if a session has been offloaded with show session id <id_num> command.

For example:

> show session id 421199

Session          421199

        c2s flow:

                source:      172.24.12.116 [Untrust-L3]

                dst:         192.168.41.21

                proto:       6

                sport:       43871           dport:      22

                state:       ACTIVE          type:       FLOW

                src user:    unknown

                dst user:    unknown

                offload:     Yes

...

Cheers,

-Kim.