topic Re: Commit error After PANOS10.1.10 upgrade in General Topics

Commit error After PANOS10.1.10 upgrade

Lance — Wed, 24 May 2023 09:55:30 GMT

After upgrading from PANOS 10.1.8-h2 to 10.1.10 we start getting the following commit error.

profiles -> spyware -> sink-alert -> botnet-domains -> dns-security-categories is invalid. Missing pre-defined DNS security category

Any idea to correct this error?

Re: Commit error After PANOS10.1.10 upgrade

kiwi — Wed, 24 May 2023 10:18:20 GMT

Hi @Lance ,

There's a bug in 10.1.10 for this error.

I'd recommend reaching out to support to confirm if you're hitting the exact bug and get updates on its fix release or go to PAN-OS 10.1.9-h3 which is the preferred release at the moment of this writing:

https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-p/258304

Kind regards,

-Kim.

Re: Commit error After PANOS10.1.10 upgrade

Doug.Decker — Mon, 05 Jun 2023 17:22:34 GMT

we had a similar issue and we went into the anti-spyware profile to the dns exceptions tab, checked the check boxes at the bottom for the dns signature excpetions, clicked ok and commit and push.

Re: Commit error After PANOS10.1.10 upgrade

AndresAlfaro — Thu, 13 Jul 2023 01:42:29 GMT

cordial Greetings

Team

The error you mention, in my case, was solved by updating the content, specifically the apps and Threats update.

Re: Commit error After PANOS10.1.10 upgrade

DaveHatch — Mon, 07 Aug 2023 17:11:19 GMT

There is a bug, with a work-around. Check out this --> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000kIDfCAM

Re: Commit error After PANOS10.1.10 upgrade

Adrian_Moechel — Wed, 18 Oct 2023 08:54:20 GMT

Dear Kiwi,

I tried the workaround and all other mentioned solutions here by changing parameters back and forth, but unfortunately i cant solve this warning.

-) changing the action like mentioned in Commit warning "dns-security-categories is invalid. Missing pre-defined DNS security category" (paloaltonetworks.com)did not help.

-) changing the sinkhole address

-) enabling /disabling a dns exception

-) adding / removing a FQDN exception

This customer is currently on 10.1.10, due to other limitations we are waiting for 10.2.6-hx / 10.2.7 before upgrading but i cannot find any known or addressed issue in 10.1.10 / 10.1.10-h1 / 10.1.10-h2 or 10.1.11 - like you mentioned its a known bug in 10.1.10, do you have the bug id?

Thanks,

Re: Commit error After PANOS10.1.10 upgrade

CLIq — Thu, 19 Oct 2023 15:33:53 GMT

You need the latest content updates for threats and applications and need to click through the tabs of each custom spyware profile and click on OK afterwards (not cancel), you dont even need to change anything. after that you commit and it should work fine.

Re: Commit error After PANOS10.1.10 upgrade

Adrian_Moechel — Mon, 23 Oct 2023 10:28:38 GMT

I found the cause for the Error now: Its a Panorama environment and the Firewalls are renewing the content updates every day via shedule, but in the Panorama itself the content update was not up-to-date. I updated it on panorama and went trough all Tabs in alle AS-Profiles and commited and pushed to the Devices and now its gone.

So it was missing the content update in Panorama not on the Firewalls.

Thank you!

Re: Commit error After PANOS10.1.10 upgrade

TimWard — Tue, 21 Nov 2023 20:58:44 GMT

Adrian,

Thank you for your update. You saved me a PA TAC call 🙂

Clicking every tab and using OK vs Cancel, then commit is a requirement for this to work.

Re: Commit error After PANOS10.1.10 upgrade

Adrian_Moechel — Fri, 24 Nov 2023 12:14:15 GMT

Nice Tim! Great to know that my findings could help someone.

Re: Commit error After PANOS10.1.10 upgrade

Afonseca — Mon, 18 Mar 2024 18:50:56 GMT

Thank you. Going through the listed Anti-Spyware profile tabs and clicking "OK" did it for me.