topic Dynamic Update Issue? in General Topics

Dynamic Update Issue?

Mikempo — Wed, 11 Feb 2015 15:51:14 GMT

Our library has a Millenium server, the application is millenium-ils.

It stopped communicating after APP+Threat release 484 installed.

I rolled back to APP+Threat release 482 and it restored communication.

This morning APP+Threat release 485 installed and once again the Millenium Server is unreachable.

Performed the roll back to 482, and it is working fine.

Has any one else seen this?

Re: Dynamic Update Issue?

HULK — Wed, 11 Feb 2015 16:42:33 GMT

Hello Mikempo,

Based on the version 484 Application and Threat Content Release Notes, there are no changes has been implemented for millenium-ils application on this database. Could you please let me know, is it reflecting in your "deny" traffic logs.

You may expand the traffic logs for the Millenium Server and share with us. From the traffic log viewer, we will come to know if that traffic is getting blocked by any of the security profiles ( as a false positive) i.e vulnerability, spyware etc.

For an example:

Thanks

Re: Dynamic Update Issue?

Mikempo — Thu, 19 Feb 2015 17:22:26 GMT

Hulk,

Sorry to take so long.

I checked the Threat logs and filtered with millenium-ils and received a /General Exploit Host Webpage/ under the name column.

The signature ID is /37349/ Severity: High.

Under my custom VP profile, High is blocked.

Last week, I opened a ticket with PA, they gathered info.

This morning they got back to me.

They could not replicate the issue.

They are suggesting a debug (FW off-line).

VP 487 downloaded and installed Tuesday night with same results.

I created an exception on my VP profile to allow ID 37349.

This is where I stand at the moment....

Mike

Re: Dynamic Update Issue?

HULK — Thu, 19 Feb 2015 18:36:41 GMT

Hello Mike,

Could you please let us know the case ID. To investigate this issue, PAN TAC should take below mentioned information:

---- A full session pcap for RX, TX, FWW, DROP all 4 stages in PAN firewall.

---- Flow-Basic, App-ID Basic.

---- pcap at the soucre and destination as well ( if possible)

---- session details (between source and destination)

--- >show session id xxxx

Thanks

Re: Dynamic Update Issue?

Mikempo — Thu, 19 Feb 2015 18:44:17 GMT

Hulk,

[Case#: 00298164 ] - Millenium-ils app stopped working after content update

Mike