This is an Informational KB on the steps for removing service-offload/ power mode express-path

This article talks about how we enable service-offload/power mode express-path and how to disable the same.

The method for enabling or disabling service-offload/Power mode express-path is different for 21.1 junos or below  and 21.2 or above of Junos.

Enabling service-offload/power mode express-path on Pre 21.2 junos:

On an SRX5000 line device with IOC or flex IOC cards, use the below command: (Flex IOC is end off support product)
set chassis fpc fpc-number pic pic-number services-offload
 

On an SRX5000 line device with Modular Port Concentrator (MPC), enable NP cache on the IOC using the below command:
set chassis fpc fpc-number np-cache

On SRX4600 device, the np-cache option is enabled by default. Hence, the set chassis fpc fpc- number np-cache command is not applicable.

We also need to enable service-offload on the security policy for the traffic.

set security policies from-zone zone-2 to-zone zone-1 policy express-path-policy-2 then permit then permit services-offload

Once the above things are enabled, we need to reboot the device for the configuration to take effect.

After the reboot, you should see the below output for the command "show chassis fpc pic-status" to confirm if service-offload is enabled or not.

Slot 4 Online  SRX5k IOC4 MRATE
PIC 0 Online  MRATE-6xQSFPP-XGE-XLGE-CGE- np-cache/services-offload
PIC 1 Online  MRATE-6xQSFPP-XGE-XLGE-CGE- np-cache/services-offload
 

Disabling service-offload on pre 21.1 junos:

On an SRX5000 line device with IOC or flex IOC cards, use the below command: (Flex IOC is end of support product)

delete chassis fpc fpc-number pic pic-number services-offload

On an SRX5000 line device with Modular Port Concentrator (MPC), disable NP cache on the IOC using the below command:

set chassis fpc fpc-number np-cache-disable

We also need to disable service-offload on the security policy for the traffic.

delete security policies from-zone zone-2 to-zone zone-1 policy express-path-policy-2 then permit then permit services-offload

Once the above things are disabled, we need to reboot the node for the configuration to take effect.
After the reboot, you should not see service-offload/np-cache under the "show chassis fpc pic-status"
 

Post 21.2 junos:

By default, 21.2 or above junos has the service-offload/Power-mode-express-path is enabled.
Disabling service-offload/Power-mode-express-path on junos 21.1 or above:

On SRX4600 device, the np-cache option is enabled by default. Hence, the set chassis fpc fpc- number np-cache command is not applicable.
If you do not use express path, do not configure it in any security policies.

set security forwarding-options services-offload disable

Option 2:

When customer upgrades the device from 21.1 or below to 21.2 or above and has the service-offload/power mode express-path enabled.

Upgrading junos from older code to 21.2 or above,  the below configuration would be on the device if service-offload is configured.

set chassis fpc fpc-number np-cache

set security policies from-zone xyz to-zone abc policy test-policy then permit services-offload
set security policies from-zone xyz to-zone abc policy policy_test then permit services-offload

In the above situation, we need to follow the below steps to disable the service-offload/power mode express-path

set security forwarding-options services-offload disable
set chassis fpc fpc-number np-cache-disable
delete security policies from-zone xyz to-zone abc policy test-policy then permit services-offload
delete security policies from-zone xyz to-zone abc policy policy_test then permit services-offload

For Example:
 

{secondary:node0}[edit]
root@SRX5800# set chassis fpc 9 np-cache-disable
 

{secondary:node0}[edit]
root@SRX5800# set chassis fpc 10 np-cache-disable

{secondary:node0}[edit]
root@SRX5800# commit

/node0:
configuration check succeeds
node1:
warning: System or cluster nodes need to reboot after fpc 9 changed to np-cache-disable mode.
warning: System or cluster nodes need to reboot after fpc 10 changed to np-cache-disable mode.
commit complete

Once the steps are done, device is required to be rebooted for disabling service-offload/power mode express-path to take effect.
However, if the service-offload/power mode express-path is enabled or disabled only for specific policy, then reboot is not required, clearing the existing sessions for that policy will be sufficient.

 

Note: If the device does not have SOF/NP-Cache enabled, but PME is enabled then command to disable is different and reboot is not required.

To disable Power-mode-express-path, please use the below command:
set security flow power-mode-disable