topic Re: Possible issues with Application update version 396 in General Topics

Possible issues with Application update version 396

HITSSEC — Wed, 02 Oct 2013 12:32:48 GMT

We are seeing issues with Google ssl traffic being identified as Ultrasurf. Problem went away when we backed out the update (which included updates to the ultrasurf application definition). Ticket is into Support. May want to avoid updating to 396 for now.

Phil

Re: Possible issues with Application update version 396

wh4t3ver — Wed, 02 Oct 2013 15:06:55 GMT

We are experiencing the same issue on our network as well. Rolling back to 395 resolved the issue for us. Please update this thread when you hear back from support.

Jared

Re: Possible issues with Application update version 396

sspivey — Wed, 02 Oct 2013 15:14:07 GMT

Same here.

One odd detail I noticed is that we update threats automatically at 02:00, and Google was being classified normally until 07:36 (ET), after which it started showing up as 'ultrasurf' in the log.

Re: Possible issues with Application update version 396

gswcowboy — Wed, 02 Oct 2013 15:32:53 GMT

Were there pcaps attached to the ticket? What's the case number?

Re: Possible issues with Application update version 396

HITSSEC — Wed, 02 Oct 2013 15:37:55 GMT

Case # is 163564. No Pcaps attached to the case, but should be reproducible in a lab

Re: Possible issues with Application update version 396

gswcowboy — Wed, 02 Oct 2013 15:49:35 GMT

Unable to reproduce thus far but bug has been filed to have Engineering to take a look. If at all possible, please reproduce on your end and attach client end pcaps to the case. We can utilize it on tcpreplay server.

admin@Phoenix-VM-Lab148> show session all filter source 192.168.148.11

--------------------------------------------------------------------------------

ID Application State Type Flag Src[Sport]/Zone/Proto (translated IP[Port])

Vsys Dst[Dport]/Zone (translated IP[Port])

--------------------------------------------------------------------------------

30984 ssl ACTIVE FLOW NS 192.168.148.11[55085]/L3-Trust/6 (10.30.6.148[36135])

vsys1 74.125.239.136[443]/L3-Untrust (74.125.239.136[443])

31004 ping ACTIVE FLOW NS 192.168.148.11[16]/L3-Trust/1 (10.30.6.148[16])

vsys1 4.2.2.2[42398]/L3-Untrust (4.2.2.2[42398])

30999 ssl ACTIVE FLOW NS 192.168.148.11[55087]/L3-Trust/6 (10.30.6.148[21642])

vsys1 74.125.239.111[443]/L3-Untrust (74.125.239.111[443])

31003 ping ACTIVE FLOW NS 192.168.148.11[16]/L3-Trust/1 (10.30.6.148[16])

vsys1 4.2.2.2[42397]/L3-Untrust (4.2.2.2[42397])

30995 ping ACTIVE FLOW NS 192.168.148.11[16]/L3-Trust/1 (10.30.6.148[16])

vsys1 4.2.2.2[42394]/L3-Untrust (4.2.2.2[42394])

31000 ping ACTIVE FLOW NS 192.168.148.11[16]/L3-Trust/1 (10.30.6.148[16])

vsys1 4.2.2.2[42395]/L3-Untrust (4.2.2.2[42395])

31001 ssl ACTIVE FLOW NS 192.168.148.11[55088]/L3-Trust/6 (10.30.6.148[28109])

vsys1 74.125.239.111[443]/L3-Untrust (74.125.239.111[443])

31002 ping ACTIVE FLOW NS 192.168.148.11[16]/L3-Trust/1 (10.30.6.148[16])

vsys1 4.2.2.2[42396]/L3-Untrust (4.2.2.2[42396])

30998 ssl ACTIVE FLOW NS 192.168.148.11[55089]/L3-Trust/6 (10.30.6.148[26079])

vsys1 74.125.129.104[443]/L3-Untrust (74.125.129.104[443])

30996 ping ACTIVE FLOW NS 192.168.148.11[16]/L3-Trust/1 (10.30.6.148[16])

vsys1 4.2.2.2[42393]/L3-Untrust (4.2.2.2[42393])

30986 ssl ACTIVE FLOW NS 192.168.148.11[55086]/L3-Trust/6 (10.30.6.148[54225])

vsys1 74.125.239.106[443]/L3-Untrust (74.125.239.106[443])

Re: Possible issues with Application update version 396

wh4t3ver — Wed, 02 Oct 2013 16:34:52 GMT

Below is a link to a pcap I created of traffic going to 140.197.248.94 that was being blocked for ultrasurf. 140.197.248.94 is a google cache server located on our network. I hope this helps.

Re: Possible issues with Application update version 396

cloughr — Wed, 02 Oct 2013 16:45:43 GMT

We had severe issues with ALL google apps as a result of this change. Google traffic was being blocked as ultrasurf app traffic. PAN please post something when this has been resolved.

Re: Possible issues with Application update version 396

cchristiansen — Wed, 02 Oct 2013 17:17:58 GMT

Please revert to version 395. This issue has been verified and is being addressed.

-chadd.

Re: Possible issues with Application update version 396

HITSSEC — Wed, 02 Oct 2013 19:14:29 GMT

version 396 appears to be withdrawn from the download site.

Phil

Re: Possible issues with Application update version 396

HITSSEC — Thu, 03 Oct 2013 11:42:37 GMT

Apps and Threat update 397 released - No issues seen relating to Ultrasurf.

Phil

Re: Possible issues with Application update version 396

cloughr — Thu, 03 Oct 2013 15:22:20 GMT

I installed update 397, re-added ultrasurf, and it's still blocking google traffic for us. I will back-rev to 395 until resolved...

Re: Possible issues with Application update version 396

HITSSEC — Sat, 05 Oct 2013 00:25:09 GMT

Cloughr,

We have generated about 40M log entries since we installed 397 with no ultrasurf traffic seen. What type of google traffic are you seeing as ultrasurf. For us it was just doing web searches via https.

Phil

Re: Possible issues with Application update version 396

kk555 — Mon, 07 Oct 2013 17:35:33 GMT

We are on 397 and still experiencing the issue with Google being inappropriately identified as Ultrasurf.

Re: Possible issues with Application update version 396

kk555 — Tue, 08 Oct 2013 13:55:24 GMT

Is there a plan to resolve this?

I'm currently forced to be putting in huge blocks of "ignore" ultrasurf in our policy set.

Re: Possible issues with Application update version 396

ksuuk — Wed, 09 Oct 2013 05:59:49 GMT

Version 398 is out. And includes some google apps modifications. Should we test it?

Re: Possible issues with Application update version 396

HITSSEC — Thu, 10 Oct 2013 01:02:59 GMT

Ksuuk,

We have been on 398 for 12 hours now with no issues seen.

Phil

Re: Possible issues with Application update version 396

cloughr — Fri, 11 Oct 2013 14:44:05 GMT

ksuuk- That fixed it for us, thanks!!!