Documentation on the setting "Software Cut Through"

[asaraca]

Hi,

   I can't seem to find any info on the setting "Software Cut Through". It's currently set to true on our PA-460. Would that affect the performance of our firewall ?

Thank you,

Antonio

[GaryOssewa]

The only thing I can find is in a vm-series deployment guide for 11. However, I've encountered issues with this feature on PAN-OS 10.2.6

[EdGal]

4 or five hours ago I had a issue with this parameter after upgrading to 10.2.6. We had to disable it.  According to the information I have, this is what happens:

set session sw-cut-thru no

When software cut through is marked on the flow, the flow parameters aren't correctly set on GP-SSLVPN tunnel packets. This specifically affects packets in request direction and they are dropped due to missing packet fields.

The command address the problem by correctly setting packets fields in code path taken by packets when software cut through is marked on that specific flow session.

If you upgrade to 10.2.6 and after that, some, if not all your GP SSL-VPN traffic is being dropped o tcp-reset, then you should check if this parameter is the root cause.

[GaryOssewa]

Same here. Bug ID PAN-231043 - supposedly fixed in 11.1.0, 11.2.0, 10.2.8, 10.2.7, 11.1.2.

[msyeedrafiqi]

The 'sw-cut-thru' is a sort of software offload feature introduced in 10.1 Once XX number of packets in a session are inspected and deemed safe/valid, then the rest of the packets in that session are 'cut-through' from ingress to egress without having to go through fastpath for forwarding lookup for every packet. Or, in other words, software cut-through is a feature that aims to improve packet forwarding for platforms without hardware offload.