Support for IP fragmentation in active/active HA deployments

Support for IP fragmentation in active/active HA deployments

9419
Created On 04/07/20 23:42 PM - Last Modified 04/27/20 20:46 PM


Question


Can the Palo Alto Networks firewall running in High Availability Active/Active mode reassemble IP fragments if some fragments are received on Firewall A and some other fragments (of the same packet) are received on Firewall B?

Environment


  • PAN-OS 8.1 and above.
  • Palo Alto Firewalls. 
  • High Availability configuration in Active/Active.
  • Asymmetric routing on the local network results in IP fragment #1 sent to Firewall A and fragment #2 sent to Firewall B.


Answer


  1. No, a single firewall must receive all fragments of a packet in order to re-assemble and inspect the packet
  2. If IP fragments are received on two different firewalls they will be dropped
  3. Packet captures in rx stage on both firewalls in active/active displays fragment #1 received on Firewall A and fragment #2 received on Firewall B
  4. Counters will show fragments received but will not show the drop:
> show counter global filter packet-filter yes delta yes 
Global counters:
name                      value     rate severity  category  aspect    description
--------------------------------------------------------------------------------
flow_ipfrag_recv            8        1 info      flow      ipfrag    IP fragments received
flow_ipfrag_query           4        0 info      flow      ipfrag    IP fragments owner query
flow_ipfrag_pkt             4        0 info      flow      ipfrag    packets held by IP fragmentation
flow_ipfrag_entry_alloc     4        0 info      flow      ipfrag    IP fragment entry allocated
 
  1. There is currently no workaround on the firewall for this situation. The behavior cannot be modified.
  2. Avoid network designs which would result in IP fragments being received asymmetrically on two firewalls


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/kcSArticleDetail?id=kA10g000000PPWy&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FkcSArticleDetail