Best way to update app and content without impacting traffic...?

btwright — Tue, 05 Mar 2013 17:46:08 GMT

Hello All,

I am posing this as a question to the community, but in the latest release of app/content updates for PA, a new more focused signature was released. The new more focused signature was ms-wmi, and it was previously identified as msrpc.

So....What's the problem? The problem is that if I update content, I will essentially be blocking any ms-wmi that was previously identified as msrpc, because it was allowed under that previous signatures. This means that when I perform this update, I will be blocking ms-wmi traffic for some period of time [ how long does it take me to push policy, or craft new policy based on the new app signature of ms-wmi? ]. It seems troubling to me that this is the case, and there is no way around it. Has anyone else experienced this?

The only scenarios that I can think of to minimize the impact on the new app signatures are as follows [ in both scenarios, I am utilizing panorama ]:

Scenario 1 [ Panorama with HA pair ]:

1. Update content in Panorama to the latest release

2. In Panorama update all rules that currently have msrpc to allow ms-wmi as well.

3. Update the content/app-ids on the passive firewall.

4. Push new policy from panorama to the passive firewall.

5. Fail over to the passive firewall [ In theory this has policy which already allows the new more focused signature, so it should not disrupt current traffic or new connections ]

6. Update the content/app-ids on the firewall that is now in a passive state.

7. Push updated panorama config to the now passive firewall

8. Fail back to the originally active firewall.

Scenario 2 [ Just deal with the outage time ]:

1. Update content in panorama.

2. Add ms-wmi to all rules that are currently allowing msrpc.

3. Update content on the firewalls.

4. Quickly push policy from panorama as soon as the app/content update has succeeded. [ the ms-wmi traffic will be blocked during the period of time that the new policy is being pushed after the content update has succeeded. ]

Anyone have experience with this ?

Thanks,

Re: Best way to update app and content without impacting traffic...?

scantwell — Fri, 29 Mar 2013 19:22:43 GMT

If you properly identify (or re-categorize) your applications to include the updated signatures, I do not think you will much of an outage. On a PA-500 device, it takes about 2 minutes to push a policy down to the FW. With a faster FW, the commit process could be faster. However, in my testing with pushing down any type of policy, that it "takes effect" somewhere around the 75% mark of the commit. So in terms of outage.. that would be 30 secs or less. Not really an outage, more of a hiccup. Just my thoughts on this. Unless I misunderstood what you were trying to explain to me.

topic Best way to update app and content without impacting traffic...? in General Topics

Best way to update app and content without impacting traffic...?

Re: Best way to update app and content without impacting traffic...?