Driver issue with PA-VM 10.1.3 deployed in Azure public cloud

[tamilvanan]

Hi Folks,

We have an PA-VM-100 series firewall deployed in the Azure cloud.

We have three NIC cards mapped to the firewall interfaces which is configured as below:

NIC card 1 <-----> Management interface

NIC Card 2 <----> Untrust interface(Ethernet 1/1)

NIC Card 3 <----> Trust Interface(Ethernet 1/2)

Recently we had upgraded the firewall from PAN-OS version 10.0.4 to PAN-OS 10.1.3.

After that we had started facing an strange issue where when we try to ping ethernet 1/2 from any device deployed in Azure we are facing the latency issue and 35 percent of ping packets are dropped.

But when we had done the packet capture on the firewall we could see that the firewall is responding to all ping requests it had received and no packets are dropped by the firewall.

Upon taking Global counter we had seen the the below drop counter:

pkt_recv_flush_link 73726 9 drop packet pktproc Packets dropped due to link down in dpdk mode

We had powered off the VM and removed the NIC cards on the Azure side and mapped new NIC cards but still we had faced latency issue on the ethernet 1/2.

Upon further research we came to know firewall uses two network interface drivers namely Packet MMAP and DPDK drivers to interact with the underlying VM host interfaces and the DPDK driver will be used by default by the firewall and we can switch to Packet MMAP driver on the firewall by disabling the DPDK driver.

https://docs.paloaltonetworks.com/compatibility-matrix/vm-series-firewalls/sr-iov-and-dpdk-drivers

So we had disabled the DPDK driver on the firewall using the below command and then rebooted the firewall and there were no packet drops/Latency after the firewall driver is switched to Packet MMAP mode.

system setting dpdk-pkt-io off

Is this an bug on PAN-OS 10.1.3 or an expected behaviour. Is this an issue on the firewall side or Azure side.

Need more understanding on this.

Any inputs would be helpful.