topic Re: Issue Content release 8061-4973 on PAN-OS 8.1 in Advanced Threat Prevention Discussions

Issue Content release 8061-4973 on PAN-OS 8.1

abruggeman — Mon, 10 Sep 2018 08:30:56 GMT

Hi all,

We have experienced big issues after content release 8061-4973 was installed on our 3250 with PAN-OS 8.1.3:

- Threat id 40736 was suddenly blocking a lot of letigimate http(s) traffic.

- Radius authentication worked randomly, but 95% of the time NOT.

- A download from a Symfony server waits 1 minute before the download starts.

After rolling back to 8059-4961, all problems were gone.

We started a support call with Palo Alto support, through our reseller.

i'm curious if anyone else experienced these kind of problems?

Albert Bruggeman

Re: Issue Content release 8061-4973 on PAN-OS 8.1

Charles_Warnky — Mon, 10 Sep 2018 13:19:31 GMT

I did too but I am on 5050s with 7.0.4 and it was 8059-4961 from 8/30. The content release did not make any modifications to 40736 according to the release notes.

Re: Issue Content release 8061-4973 on PAN-OS 8.1

LukeBullimore — Mon, 17 Sep 2018 18:46:22 GMT

Hi @abruggeman

Did you hear anything back from TAC regarding Threat-ID 40736? We're getting multiple false positive instances; looking at the details of the ID in the Threat Vault it doesn't look as though it has had any modifications since its release.

First Release	8025 (2018-06-01 UTC)
Last Update	8025 (2018-06-01 UTC)

I'm surprised there haven't been more reports of this since this is high severity vulnerability signature which people should definitely be blocking - we've had this vulnerability signature trigger against sites like Google and the Captive Apple site. I think I'll be logging a TAC case of my own 😉

Re: Issue Content release 8061-4973 on PAN-OS 8.1

abruggeman — Tue, 13 Nov 2018 16:36:07 GMT

Hi,

This became a long story, with even more issues on the 3250 with 8.1.3.

One is concerning specific SSL traffic which sometimes is just not working.

Another one is with a soap application which introduces a delay with any threats&apps content version higher than 8059-4961.

Both occur without any content inspection at all.

We have 2 TAC cases now but it seems hard for PA to solve this.

Regards