topic Decryption problem with 5.0.7 in General Topics

Decryption problem with 5.0.7

Hithead — Sat, 14 Sep 2013 09:57:07 GMT

Hi,

since we've upgraded our PAs (200, 2000), we notice more and more decryption problems with HTTPS websites. The problem appears suddenly, almost all HTTPS doesn't work and a restart of the PA is required to solve the problem...And then, after one or more days it appears again...

We decided to downgrade our PAs back to 5.0.6...

Did someone also notice it?

Re: Decryption problem with 5.0.7

hshah — Sat, 14 Sep 2013 13:24:54 GMT

Hi Hithead,

There is one reported issue with SSL decryption in 5.0.7, that might be fixed in 5.0.8.

At this point I can not get more troubleshooting to match exact symptoms because PAN-OS is already downgraded.

As of now I will suggest to be on 5.0.6.

Regards,

Hardik Shah

Re: Decryption problem with 5.0.7

shasnain — Sat, 14 Sep 2013 13:56:24 GMT

Please run the following commands and show the entire output on 5.0.7. The sample output would be something like below and more.

admin@500> debug dataplane pool statistics

Verify Software pools are not depleted:

Software Pools

[ 0] software packet buffer 0 : 16384/16384 0x8000000021800680

[ 1] software packet buffer 1 : 8192/8192 0x8000000022010700

[ 2] software packet buffer 2 : 8192/8192 0x8000000022818780

[ 3] software packet buffer 3 : 4096/4096 0x8000000023820800

When the issue is happening If by any chance the number is reaching to 1 that would indicate that some buffer is leaking. If this is the case you will need to open a case with Tech support to further investigate the issue.

Thanks.

Re: Decryption problem with 5.0.7

hshah — Sat, 14 Sep 2013 16:21:09 GMT

Hi Shasnain,

Current PAN-OS 5.0.6 is in use, SSL Decryption may not encounter same issue which we are thinking about.

Regards,

Hardik Shah

Re: Decryption problem with 5.0.7

Hithead — Mon, 16 Sep 2013 06:57:15 GMT

Hi guys,

thank you for the information.

shasnain Already downgraded all my PAs to 5.0.6. So your command wouldn't help. We don't like to update it again. Thanks anyway.

A ticket has been open...Will wait for 5.0.8...