Symptom

TCP flows from the endpoints hitting different CTS policy other than ICMP or UDP due to incorrect destination SGT lookup. Happening when destination SGT is mapped to any non host range. (For example if the IP-to-SGT mapping uses host and not prefix - lookup works)

Conditions

IP-SGT mapping for destination lookup is used CTS enforcement is happening on a switch with TCP - adjust-MSS configured Tested on Cat 9300 - Cat 9300X in 17.9.3 and 17.12.4 releases

Workaround

none

Further Problem Description