Symptom

error messages can be seen in the logs like below: *Feb 17 12:04:35.413: %CPPOSLIB-3-ERROR_NOTIFY: F0/0: cpp_sp_svr: cpp_sp encountered an error -Traceback= 1#1a7adc3b780d764f18982daa412d9d76 errmsg:FFFFBA7AD000+DA8 cpp_common_os:FFFFBB835000+1C7C4 cpp_common_os:FFFFBB835000+135AC cpp_fm_server:FFFFBBF46000+92648 cfm:FFFFBB739000+165C0 cfm:FFFFBB739000+CB68 cfm:FFFFBB739000+F8F4 binos:FFFFBACEA000+10D94 cfm:FFFFBB739000+1065C binos:FFFFBACEA000+10D94 cfm:FFFFBB739000+F05C cfm:FFFFBB739000+4A2CC cfm:FFFFBB739000+49D60 cfm:FFFFBB739000+455D4 cpp_fm_server:FFFFBBF46000+9A25C cpp_ *Feb 17 12:04:35.421: %CPPOSLIB-3-ERROR_NOTIFY: F0/0: cpp_cp_svr: cpp_cp encountered an error -Traceback= 1#40164aba518110e349f1075130276279 errmsg:FFFF84137000+DA8 cpp_common_os:FFFF851BF000+1C7C4 cpp_common_os:FFFF851BF000+135AC cpp_fm_client:FFFF86025000+4038 cpp_common_os:FFFF851BF000+E058 cpp_fm_client:FFFF86025000+2378 cpp_common_os:FFFF851BF000+23530 evlib:FFFF84639000+87C4 evlib:FFFF84639000+9144 cpp_common_os:FFFF851BF000+216B4 cpp_common_os:FFFF851BF000+21638 :AAAAAEE40000+2F770 c:FFFF82CA4000+245B0 :AAAAAEE40000+25D *Feb 17 12:04:37.059: %FMFP-3-OBJ_DWNLD_TO_DP_FAILED: F0/0: fman_fp_image: Batch type 1 ID 2882382797 download to DP failed Also on attempt to re-apply policy: 2022/02/17 18:19:18.096641 {plogd_R0-0}{1}: [plogd] [11124]: (debug): sending: facility 16. %CPPOSLIB-3-ERROR_NOTIFY: F0/0: cpp_sp_svr: cpp_sp encountered an error -Traceback= 1#1a7adc3b780d764f18982daa412d9d76 errmsg:FFFFAC5AB000+DA8 cpp_common_os:FFFFAD633000+1C7C4 cpp_common_os:FFFFAD633000+135AC cpp_fm_server:FFFFADD44000+92648 cfm:FFFFAD537000+165C0 cfm:FFFFAD537000+CB68 cfm:FFFFAD537000+F8F4 binos:FFFFACAE8000+10D94 cfm:FFFFAD537000+1065C binos:FFFFACAE8000+10D94 cfm:FFFFAD537000+F05C cfm:FFFFAD537000+4A2CC cfm:FFFFAD537000+49D60 cfm:FFFFAD537000+455D4 cpp_fm_server:FFFFADD44000+9A25C cpp_ 2022/02/17 18:19:18.098999 {plogd_R0-0}{1}: [plogd] [11124]: (debug): sending: facility 16. %CPPOSLIB-3-ERROR_NOTIFY: F0/0: cpp_cp_svr: cpp_cp encountered an error -Traceback= 1#40164aba518110e349f1075130276279 errmsg:FFFF97D4F000+DA8 cpp_common_os:FFFF98DD7000+1C7C4 cpp_common_os:FFFF98DD7000+135AC cpp_fm_client:FFFF99C3D000+4038 cpp_common_os:FFFF98DD7000+E058 cpp_fm_client:FFFF99C3D000+2378 cpp_common_os:FFFF98DD7000+23530 evlib:FFFF98251000+87C4 evlib:FFFF98251000+9144 cpp_common_os:FFFF98DD7000+216B4 cpp_common_os:FFFF98DD7000+21638 :AAAAE41C9000+2F770 c:FFFF968BC000+245B0 :AAAAE41C9000+25D 2022/02/17 18:19:25.587933 {plogd_R0-0}{1}: [plogd] [11124]: (debug): sending: facility 16. %CPPOSLIB-3-ERROR_NOTIFY: F0/0: cpp_cp_svr: cpp_cp encountered an error -Traceback= 1#40164aba518110e349f1075130276279 errmsg:FFFF97D4F000+DA8 cpp_common_os:FFFF98DD7000+1C7C4 cpp_common_os:FFFF98DD7000+135AC cpp_fw_svr_lib:FFFF9B30E000+63F88 cpp_common_os:FFFF98DD7000+23530 evlib:FFFF98251000+87C4 evlib:FFFF98251000+9144 cpp_common_os:FFFF98DD7000+216B4 cpp_common_os:FFFF98DD7000+21638 :AAAAE41C9000+2F770 c:FFFF968BC000+245B0 :AAAAE41C9000+25D84 And traffic drop will be seen despite it is allowed. Other messages can be seen as well: %FMFP-3-OBJ_DWNLD_TO_DP_FAILED: F0/0: fman_fp_image: CCE binding cg=8024880, class=9720769, feat=fw-inspect(5) download to DP failed Then "show platform hardware qfp active classification class-group-manager class-group client cce 8024880" will show inconsistency between "show run" and actual policy-map that was attempted to be downloaded to DP.

Conditions

ZBFW enabled and any "policy-map type inspect" has "class type inspect" with "match protocol attribute application-family " or "match protocol attribute application-group " and FQDN objects within the same policy, not essentially within the same class-map. Having both will affect all ZBFW policy-maps.

Workaround

expand "match protocol attribute application-family " or "match protocol attribute application-group " into individual applications, e.g. match protocol attribute application-family tunneling can be expanded to the list of individual apps: match protocol ayiya-ipv6-tunneled match protocol isatap-ipv6-tunneled match protocol sixtofour-ipv6-tunneled match protocol teredo-ipv6-tunneled

Further Problem Description