topic Re: Upgrade to 6.1.1 and problem with Vulnerability Protection profile in General Topics

Upgrade to 6.1.1 and problem with Vulnerability Protection profile

Oleksandr — Wed, 31 Dec 2014 17:31:27 GMT

Hi guys,

I had a problem with Vulnerability Protection profile.

I created Custom Vulnerability signature with exception for only one (1) IP address. But after upgrading to 6.1.1 version (from 6.0.5) this exception stopped working... I had to copletelywrite a new rule to exempt this IP from scanning...

The signature was based on 40015 (SSH Brute-force).

Any ideas?

Thank you!

Alex

Re: Upgrade to 6.1.1 and problem with Vulnerability Protection profile

pulukas — Thu, 01 Jan 2015 13:22:14 GMT

Was the configuration still present but not working or was the customization of the signature lost in the upgrade?

Either way, you should probably create a support case with this information so a bug can be logged and the upgrade issue corrected in future releases.

Re: Upgrade to 6.1.1 and problem with Vulnerability Protection profile

Oleksandr — Fri, 02 Jan 2015 14:38:53 GMT

Thank you roe answer

Yes, the configuration was not changed after upgrade, but THAT signature started blocking valuable server, so I decided to change the rule.

Probably, "exception" feature has changed the logic in new version?

Re: Upgrade to 6.1.1 and problem with Vulnerability Protection profile

pulukas — Fri, 02 Jan 2015 21:27:52 GMT

We have many exceptions setup in our signatures and it is NOT normal for the behavior to change in an upgrade. Based on your description, this is most likely a software bug that should be reported with a ticket to Palo Alto support.