Last Modified: Oct 06, 2020
See more info
Known Affected Versions:
14.0.0, 184.108.40.206, 220.127.116.11, 18.104.22.168, 22.214.171.124, 126.96.36.199, 14.0.1, 188.8.131.52
Opened: Sep 14, 2017
This can occur with an unknown subscriber policy that doesn't have classification filters. Since applying classification may impede performance significantly, there is an optimization rule that if the first policy applied to a flow doesn't have classification filters, classification for that particular flow will be optimized out. When this occurs, flows will remain unclassified for their lifetime. As a result of remaining unclassified, if PEM pushes some classification match policies to this flow, the policies will not get applied.
In this scenario, classification match policies may not be applied to existing flows.
Global/unknown policies doesn't include any classification filter.
A simple workaround would be, put a Any/Any classification filter in global or unknown subscriber policy to enabled classification for flow at its early stage.