topic Re: issues with app id updates resulting in commit failures due to exclude 'google-drive-web' is not a valid reference in Prisma Access Discussions

issues with app id updates resulting in commit failures due to exclude 'google-drive-web' is not a valid reference

John_Thom — Wed, 22 May 2024 22:43:00 GMT

Hi Looks like the latest update breaks the application filter rule. I had a look and it seem like the "google-drive-web' is a group and does not have an associated risk, 'google-drive-web-base' does have a risk 5 for it, I tried to create one called 'google-drive-web' but I unable to create one as the group is already named 'google-drive-web'

I have Raised a TAC case but any suggestions much appreciated.

Operation

Commit and Push

Status

Completed

Result

Failed

Details

Validation Error:
shared -> application-filter -> Risk 5 -> exclude 'google-drive-web' is not a valid reference
shared -> application-filter -> Risk 5 -> exclude is invalid

Re: issues with app id updates resulting in commit failures due to exclude 'google-drive-web' is not a valid reference

RaymondH — Thu, 23 May 2024 07:12:31 GMT

Yes, i'm having the same issues too ( exact the same error). To commit, i first have to revert to the previous App-ID update.

Re: issues with app id updates resulting in commit failures due to exclude 'google-drive-web' is not a valid reference

VladimirKiseliov — Thu, 23 May 2024 08:23:55 GMT

Thanks, I've got some issues. Reverting to the previous pack helped.

Re: issues with app id updates resulting in commit failures due to exclude 'google-drive-web' is not a valid reference

sahorne — Thu, 23 May 2024 11:45:46 GMT

Having the same issue... Just started yesterday... I am kind of a newbe here... Do you mind saying how did you recert back to the previous pack?

Re: issues with app id updates resulting in commit failures due to exclude 'google-drive-web' is not a valid reference

RaymondH — Thu, 23 May 2024 11:50:23 GMT

Go to : Device \ Dynamic Updates -> Application and Threats ->Revert to 8851-8750. But be aware this is only a temporary solution! Let's hope they release today or tomorrow a new App Policy.

Re: issues with app id updates resulting in commit failures due to exclude 'google-drive-web' is not a valid reference

VladimirKiseliov — Thu, 23 May 2024 11:51:13 GMT

Device --> Dynamic Updates --> Application and Threats, and press Revert on the previous pack.I hope this helps you, as it helped me too

Re: issues with app id updates resulting in commit failures due to exclude 'google-drive-web' is not a valid reference

John_Thom — Thu, 23 May 2024 11:59:48 GMT

Thank you, its fixed our issue and really apprecate you taking the time to share.

Re: issues with app id updates resulting in commit failures due to exclude 'google-drive-web' is not a valid reference

danielb009 — Thu, 23 May 2024 21:27:54 GMT

Thank you. Same issue here. Hopefully they will get it straightened out.

Re: issues with app id updates resulting in commit failures due to exclude 'google-drive-web' is not a valid reference

PZuniga — Fri, 24 May 2024 17:23:20 GMT

This can be fixed by creating a new Application filter with the same "excludes" as the filter/ filters that contain "google-drive-web". In the new filter you can exclude "Google-Drive-web-base". You then have to replace the filter all in the rules the original was located, once you have replaced them you then delete the errored filter.

Re: issues with app id updates resulting in commit failures due to exclude 'google-drive-web' is not a valid reference

mprintz — Wed, 29 May 2024 16:44:28 GMT

For those of you who don't want to wait for a more permanent fix, this worked for me as a quick way to get rid of the "bad" app-id from the app filters. After doing the steps below, you'll need to exclude the new app-ids in your app filters. Thanks to @eric.pedersen for the tip. Palo Alto posted an advisory notice on this issue too.

This application filter is easily fixed on the CLI and doesn't have to be recreated.

For example:

delete application-filter <name> exclude google-chat

or on Panorama:

delete shared application-filter <name> exclude google-chat

or, whatever scope other than shared that your application filter is in.

Re: issues with app id updates resulting in commit failures due to exclude 'google-drive-web' is not a valid reference

John_Thom — Wed, 29 May 2024 18:03:52 GMT

Thanks Pzungia,

This is the way forward there is a post with further detail.

https://live.paloaltonetworks.com/t5/customer-resources/customer-issue-impacting-applications-and-threats-content-update/ta-p/587719

Re: issues with app id updates resulting in commit failures due to exclude 'google-drive-web' is not a valid reference

sahorne — Tue, 11 Jun 2024 13:47:16 GMT

The link tells me I do not have sufficient access...