topic Beware ! PAN-OS 7.0.2 - Seemed to kill AV and inspection in General Topics

Beware ! PAN-OS 7.0.2 - Seemed to kill AV and inspection

greg.collins — Tue, 20 Oct 2015 07:32:55 GMT

Hello

Environment

Rule base is established and working with LDAP integration for users .
Outbound SSL SSL decryption is also setup and working 7.0.1
Rules allow a group to talk to the Internet.
Security profile are used for AV, Anti Spyware , URL filter and File blocking.
SSL decryption is also setup .

Symptom
A bespoke Response Page is setup but is not displayed when I attempt to download bad files.
When I download an EICAR file it is not blocked by the firewall. I get no bespoke response page .
Does the same on SSL .

Nothing in threat logs.

All working 100% on version 7.0.1

Upgrade to 7.0.3 fixes this.

Re: Beware ! PAN-OS 7.0.2 - Seemed to kill AV and inspection

dieter_b — Tue, 20 Oct 2015 07:38:15 GMT

Re: Beware ! PAN-OS 7.0.2 - Seemed to kill AV and inspection

greg.collins — Tue, 20 Oct 2015 07:43:43 GMT

Thanks dieterb but don't think so .

Was also missing other test sites :

http://www.wicar.org/test-malware.html

Only one it picked up was ]

Microsoft Internet Explorer CSS Tags Remote Code Execution Vulnerability

Everything else go let through.

Soon as I upgraded to version 7.0.3 blocking started again .

Not sure if it's AV or file blocking causing issue.

Fairly serious though.

Re: Beware ! PAN-OS 7.0.2 - Seemed to kill AV and inspection

Raido_Rattameister — Tue, 20 Oct 2015 08:37:43 GMT

When running 7.0.2 then upgrade ASAP as there is issue with Wildfire aswell.

7.0.3 release notes

81927

Fixed an issue where a firewall stopped submitting files to a WildFire cloud (public or private) when a CPU process (varrcvr) stopped responding. This issue occurred when receiving an email with a subject line containing more than 252 characters.