Application failure through firewall when jumbo frames are enabled

• You will observe that a large number of sessions will go to *DISCARD* state with the application showing as unknown-tcp
• The session tracker for the session will show the status "appid stop lookup"

session QoS rule : N/A (class 4)
tracker stage firewall : appid stop lookup
end-reason : unknown

• DP-Monitor logs show the counter appid_post_pkt_queued with the value 4300 which is what is assigned to the appid queue with jumbo frames enabled.

2020-08-30 11:01:56 :appid_post_pkt_queued 4300 0
2020-08-30 11:11:56 :appid_post_pkt_queued 4300 0
2020-08-30 11:21:56 :appid_post_pkt_queued 4300 0
2020-08-30 11:31:56 :appid_post_pkt_queued 4300 0
2020-08-30 11:41:56 :appid_post_pkt_queued 4300 0

• PanOS 9.0.9-h1
• PA-5220
• Jumbo frames enabled

• Enabling jumbo frames on a firewall reduces the appid queue size from 65536 to 4096. 
• unknown-tcp traffic in a customer's environment will cause the appid queue to be quickly filled up
• Once the appid queue limit is hit the default action is drop.