pan_http2_alloc（） 在工作时间访问网站时失败
8204
Created On 12/19/22 03:32 AM - Last Modified 02/02/24 06:07 AM
Symptom
- 用户无法访问任何网站。
- “HTTP2_Protocol_Error”出现在 Web 检查器控制台日志中。
- 少数用户未发现此问题。
- 仅当禁用“Strip ALPN”时，才会出现此问题
全局计数器（显示全局计数器）
http2_process 4 0 info http2 pktproc Number of http2 connection process
http2_stream_session_alloc 16 0 info http2 pktproc Number of http2 stream sessions allocated
http2_connection_window_update_sent 8 0 info http2 pktproc Number of http2 connection window updates sent
http2_rst_stream_recv 4 0 info http2 pktproc Number of http2 RST_STREAM frames received
http2_connection_protocol_error 2 0 error http2 pktproc Number of http2 connections closed due to protocol violation
http2_stream_protocol_error 1 0 error http2 pktproc Number of http2 streams closed due to protocol violation
http2_connection_cant_write 1 0 warn http2 pktproc Number of http2 send frames dropped after GOAWAY is sent or received
http2_stream_map_alloc_failure 4 0 warn http2 resource Number of http2 stream map allocation failure
http2_header_inflate_failed 2 0 error http2 pktproc Number of http2 hpack inflate failures
http2_frame_drop_ingress 2 0 info http2 pktproc Number of http2 frame dropped at ingress stage
http2_frame_drop_egress 9 0 info http2 pktproc Number of http2 frame dropped at egress stage
http2_continuation_internal 42 0 info http2 pktproc Number of http2 continuation frames for CTD processing
http2_goaway_sent 6 0 info http2 pktproc Number of http2 goaway frames sent
http2_rst_stream_sent 1 0 info http2 pktproc Number of http2 rst_stream frames sent
http2_send_frame_queued 6 0 info http2 pktproc Number of http2 send frames queued for order
http2_headers_frame_queued 42 0 info http2 pktproc Number of http2 send headers frames queued
http2_data_frame_queued 143 1 info http2 pktproc Number of http2 send data frames queued
packet-diag 日志（减去 dp0-log pan_packet_diag.log）：
+0200 Error: header_table_add(pan_hpack.c:365): pan_http2_alloc() failed
+0200 Error: header_table_add(pan_hpack.c:365): pan_http2_alloc() failed
Environment
- Palo Alto PA-3400 系列防火墙
- PAN-OS 10.2.2 和 10.2.3
- 已启用解密或配置了 url-proxy 以显示 HTTPS 请求的响应页面
Cause
由于 PAN-206005 导致的软件问题。
Resolution
- 解决方法是，在解密策略中打开“Strip-ALPN ”以停止使用 HTTP2。
- 要永久修复，请将 PAN-OS 升级到 10.2.4、11.0.1 或更高版本。 此问题已在 PAN-206005 下得到解决