topic Re: 5.0.3 - ready for production? in General Topics

5.0.3 - ready for production?

_slv_ — Sun, 17 Mar 2013 18:24:23 GMT

I have PA200 with 4.1.10, and I'd like to use few new features from 5.0.x series, and I hope that my problems with QoS will gone

Is it in your opinion (taken from real life) 5.0.3 ready for production environment?

Last time (user id issue) testing team didnt work well in PA, did you discovered or heard about any new issues in 5.0.3?

what I pay attention before the upgrade (I've never done transition from 3.x to 4.x), Of course I will have the recovery procedure on a desk.

With reagrds

SLawek

Re: 5.0.3 - ready for production?

Retired Member — Sun, 17 Mar 2013 18:31:51 GMT

I did not see any problems with 5.0.3 but it is early and most bugs are related to environments.There will be no any panos without any bug but we are using 5.0.3 for production with some customers.

Re: 5.0.3 - ready for production?

mikand — Sun, 17 Mar 2013 19:38:52 GMT

From the reactions in this community forum 5.0.3 seems (so far) to be far more stable than previous releases - however users might have been scared off by the bad things happening to 5.0.0, 5.0.1 and 5.0.2 so its now more of a waiting game for everybody involved.

But as long as you can do a fast rollback (that is make sure you have your licenses, panos-releases AND configurations backuped properly) and monitor the installation live (that is dont install 5.0.3 and go home for the day :smileysilly:) I think you should be fine with 5.0.3 (with a fat disclaimer that noone, so far, seems to have found any major issue with 5.0.3 😉

Re: 5.0.3 - ready for production?

cmcguire-coactive — Mon, 18 Mar 2013 01:25:40 GMT

5.0.1h1 seems a perfectly stable release on the PA-200.

If you are anxious to get up on 5.0, I think 5.0.3 makes sense. You can always go back to 5.0.1h1 (on PA-200). Do realize that there is no roll back to 4.x (if you update your config at all, which presumably you will)

Re: 5.0.3 - ready for production?

_slv_ — Mon, 18 Mar 2013 07:23:12 GMT

Thats good news, so I will prepare to upgrade to 5.0.3 and roll back to 5.0.1.h1

Re: 5.0.3 - ready for production?

_slv_ — Mon, 18 Mar 2013 09:02:34 GMT

I tryed to download 5.0.3 image, after progress bar rised 100% I cant see "downloaded" status in Device > Software, so I tryed to download 5.0.0 but with the same resaults.

In system log I cant find any errors related to PAN software, what is going on?

I have 4.1.0, 4.1.6, 4.1.8, 4.1.10 downloaded to my device. Its occupied some space. How to verify how much free space is left ?

Regards

SLawek

Re: 5.0.3 - ready for production?

Quinton — Mon, 18 Mar 2013 09:32:51 GMT

You'll first have to upgrade to the PANOS 5 base image - i.e. 5.0.0 first then 5.0.3. My experience so far with 5.0.2 and 5.0.3 is great. No issues seen thus far. The built-in agentless User-ID is a nice addition. Overall the performance is much better in terms of commit times, generating reports and searching the logs.

Re: 5.0.3 - ready for production?

Retired Member — Mon, 18 Mar 2013 10:01:32 GMT

can you do a "show system disk-space"

try to delete old version files from webgui or cli ( delete software ....)

and download 5.0.0 see if shows downloaded or not

Re: 5.0.3 - ready for production?

_slv_ — Mon, 18 Mar 2013 11:06:22 GMT

Before delete:

Filesystem	Size Used Avail Use% Mounted on
/dev/sda3	1.9G 1.3G 540M 71% /
/dev/sda5	6.6G 3.8G 2.5G 61% /opt/pancfg
/dev/sda6	1.9G 822M 1011M 45% /opt/panrepo
tmpfs	1.3G 37M 1.2G 3% /dev/shm
/dev/sda8	2.4G 1.9G 401M 83% /opt/panlogs

after I deleted 4.1.0:

Filesystem Size Used Avail

/dev/sda3 1.9G 1.3G 540M

/dev/sda5 6.6G 3.8G 2.5G

/dev/sda6 1.9G 822M 1012M

tmpfs 1.3G 37M 1.2G

/dev/sda8 2.4G 1.9G 401M

why I cant see differences?

now i downloaded 5.0.0 to my device without a problem.

Re: 5.0.3 - ready for production?

Retired Member — Mon, 18 Mar 2013 15:50:48 GMT

after you deleted you downloaded without problem.So this makes issue resolved.

with that show disk command we cannot see that space maybe.Maybe there is a way for that but I do not know how.But deleting unused images make it clear.

also for panos 5 there is a new command

https://live.paloaltonetworks.com/docs/DOC-4687

Re: 5.0.3 - ready for production?

ericgearhart — Wed, 20 Mar 2013 01:15:11 GMT

I believe the recent trainwreck involving today's BrightCloud update that essentially broke all URL categorization (all URLs are categorized as unknown) speaks volumes about 5.0's readiness for production. I believe only the 5.0 codebase was affected.. I haven't seen anyone complaining about 4.1 having the problem.

All sites registering as "unknown"

mmartin wrote:

Came in today with users screaming that they were getting blocked on all websites. Finally extracted enough information from them that the category was coming up as “unknown” for all sites…even Google. Decided it had to be an issue in the URL filtering…updated to latest Brightcloud…no change.

Re: 5.0.3 - ready for production?

mikand — Wed, 20 Mar 2013 07:42:57 GMT

Tricky part in that case is that since BrightCloud was bought by Webroot there have been too many odd behaviour when it comes to the URL-DB. Like broken updates, updateservers not reachable etc (according to posts in this community forum).

Just saying that the latest breakdown of the URL-DB doesnt necessary can be blamed on the PANOS 5.0 release quality

And speaking of which - those of you who use PA's own URL-DB (instead of Brightcloud), any problems for you yet with broken updates or such?

Re: 5.0.3 - ready for production?

ericgearhart — Wed, 20 Mar 2013 13:39:17 GMT

Don't the PA appliances check in to and receive their BrightCloud updates from PA servers? If that's the case then PA is on the hook for this.

If the PA appliances reach straight out to BrightCloud for their updates then I agree, I'm more inclined to give PA a "pass" on this one

Re: 5.0.3 - ready for production?

ericgearhart — Wed, 20 Mar 2013 13:49:26 GMT

Just FYI...

I have a PA4020 running 5.0.3 and I have a PA5020 running 4.1.8.

The 4020 running 5.0.3 is affected by the "unknown" category issue.

The 5020 running 4.1.8 seems to be unaffected... categories seem to be working fine.

Re: 5.0.3 - ready for production?

_slv_ — Wed, 20 Mar 2013 19:29:02 GMT

Today I upgarded my device. But of course I run into some problems.

Upgrade to 5.0.0 went OK

On PA200 I had 4.1.10 5.0.0 firmware and I have 5.0.3 on my laptop (beacause I cant download it to my device). I tryed x2 to upload it to my device, but after successful upload it doesnt appear as downloaded.

I had to download it from GUI. Finally I get it on my device

Re: 5.0.3 - ready for production?

dyang — Thu, 21 Mar 2013 00:13:15 GMT

When a device attempts to pull an update (or do a dynamic URL lookup) from BrightCloud, the device connects directly to BrightCloud's servers for this information, not the Palo Alto Networks update server.

Re: 5.0.3 - ready for production?

ericgearhart — Thu, 21 Mar 2013 00:49:49 GMT

Do you guys have any updates on why 5.0 was affected but 4.1 wasn't? It's really curious why the update affected one version and not another.

Re: 5.0.3 - ready for production?

gafrol — Thu, 21 Mar 2013 13:09:51 GMT

quinton schrieb:

You'll first have to upgrade to the PANOS 5 base image - i.e. 5.0.0 first then 5.0.3.

Not true. You just need to download the 5.0 image and the donwload and install 5.0.3.

Re: 5.0.3 - ready for production?

gafrol — Thu, 21 Mar 2013 13:14:50 GMT

mikand schrieb:

And speaking of which - those of you who use PA's own URL-DB (instead of Brightcloud), any problems for you yet with broken updates or such?

No Problems so far with 5.0.3 and PANDB.

Re: 5.0.3 - ready for production?

ahpadmin — Thu, 21 Mar 2013 13:23:45 GMT

I've upgraded to 5.0.3 and seem to be having issues with web filtering. I was on version 5.0.1 prior and everything worked fine. Now all of the url categories that are set to blocked aren't working.