ION not forwarding traffic for a specific UDP flow

• Forwarding of UDP-based (or non-tcp) application flows stopped although the flow exist in the ION's flow table .
• This happened after an event such as a VPN or a Circuit flap.
• TCP flows are forwarded and working as expected.

• Prisma SD-WAN
• ION devices

• When there is an event like a link/vpn failure or circuit flap, the ON device switches the flow's path.
• Since the source machine is constantly sending traffic, the session never times out.
• The ION device does not have the chance to recalculate the path once original Path is recovered.
• Additionally, for UDP, it's not possible to track the status of the connection (as it is in TCP), therefore on the ION device the UDP flow is alive as long as there's one-way traffic.

1. Using the following command, check the flow. The output shows that the selected path-id is not the expected one:

inspect flow brief srcv4=<IP1> dstv4=<IP2>

2. Check the Path using the path-id retrieved in the previous command:

inspect flow brief srcv4=<IP1> dstv4=<IP2>

3. Clear ongoing UDP flows related to these two hosts:
   

clear flows srcv4=<IP1> dstv4=<IP2> prot=17

A potential long-term fix may consist of reviewing the Path Policy definition. If the Path Policy rule that the UDP traffic matches is configured in such a way that only a single path (or DC) is allowed, upon failure of any tunnel/s make up the path, the UDP flow won't take any other path that the ones strictly allowed in the path rule; hence, the flow won't get stuck on a non-working path, and when that appropriate path recovers from the failure, the UDP flow will be assigned to it.