How to enable and verify ip4-ignore-df setting

• By default, If the DF (Don't Fragment) bit is set in IP header,  Palo Alto Networks Firewall does not fragment the traffic. It discards the packet and sends ICMP: fragmentation needed to the sender with the expected MTU.
• To configure firewall to ignore ipv4 DF bit to fragment traffic (packets) accordingly

• Palo Alto Networks Firewalls
• PAN-OS
• Packet Fragmentation
• The global counter 'flow_fwd_ip_df_drop' increments

> show counter global filter delta yes packet-filter yes

Global counters:
name                                   value     rate severity  category  aspect    description
--------------------------------------------------------------------------------
flow_fwd_ip_df_drop                       61        1 drop      flow      forward   Packets dropped: exceeded MTU but DF bit present

• To set 'ip4-ignore-df' setting to yes 

PA-FW> debug dataplane set ip4-ignore-df ?
> no    enforce DoNot-Fragment for IPv4 packets. Default
> yes   do not enforce DoNot-Fragment for IPv4 packets.

PA-FW> debug dataplane set ip4-ignore-df yes

• To verify if 'ip4-ignore-df' setting is applied successfully

PA-FW> show system state filter-pretty sw.comm.s1.dp0.flow-data | match ip4-ignore-df
  ip4-ignore-df: True, 

• To revert the 'ip4-ignore-df' setting back to default behavior

PA-FW> debug dataplane set ip4-ignore-df no

PA-FW> show system state filter-pretty sw.comm.s1.dp0.flow-data | match ip4-ignore-df
  ip4-ignore-df: False, 

Note: This 'ip4-ignore-df' setting is not persistent across firewall reboot or PAN-OS upgrade. Therefore, please reapply the command after firewall reboot/upgrade.