topic Re: Because of CVE-2021-44228, need to upgrade Panorama in Panorama Discussions

Because of CVE-2021-44228, need to upgrade Panorama

AaronDeRooy — Wed, 15 Dec 2021 22:10:32 GMT

Managed Palo Alto firewalls are running 9.1.11 and are unaffected by CVE-2021-44228 but Panorama running 9.1.11 is. If I upgrade Panorama to 10.1.2, will I have any problem with it seeing and managing the managed Palo's still running 9.1.11?

Re: Because of CVE-2021-44228, need to upgrade Panorama

ChristianBolelli — Wed, 15 Dec 2021 22:33:55 GMT

I have the same problem but I hope Palo Alto release an hotfix for 9.1 asap.

Re: Because of CVE-2021-44228, need to upgrade Panorama

PavelK — Wed, 15 Dec 2021 23:10:44 GMT

Hello @AaronDeRooy

When it comes to Panorama as long as Panorama is running PAN-OS version higher than managed Firewall you will not have an issue to manage Firewalls and collect logs, so in your case you will not have issue to manage Firewalls running 9.1 after upgrading Panorama to 10.1.

For now, I am only worried about customers running M-100 that can run highest version 9.1. For those like @ChristianBolelli mentioned Palo Alto will hopefully release Hotfix in 9.1 release.

Kind Regards

Pavel

Re: Because of CVE-2021-44228, need to upgrade Panorama

Mark-Hietpas — Thu, 16 Dec 2021 17:15:04 GMT

One thing to take into consideration before upgrading Panorama to 10.1.x and managing 9.1.x firewalls is "Panorama should be running the same or a later version of a feature release than the firewall (more than two feature versions is supported but not recommended)" I would take a close look at changes and additions to features in 10.0 and 10.1, because you may run in to odd issues when pushing out new configs.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRrCAK

Re: Because of CVE-2021-44228, need to upgrade Panorama

grenzi — Tue, 21 Dec 2021 11:29:15 GMT

@Mark-Hietpas wrote:

"Panorama should be running the same or a later version of a feature release than the firewall (more than two feature versions is supported but not recommended)"

I can't find that recommendation, the page you linked to has been removed.