topic Re: 7.0.3 upgrade in General Topics

7.0.3 upgrade

jdprovine — Mon, 23 Nov 2015 13:52:22 GMT

I am planning on upgrading the PA 5050 os from 6.1.7 to 7.0.3. I have been reading over the changes and I think it would be beneficial to see examples instead of description of what changes are , anyone have any recommendations

Re: 7.0.3 upgrade

Brandon_Wertz — Mon, 23 Nov 2015 14:52:37 GMT

Curious what your desire to upgrade to 7.0.3 is? With 7.0.4 coming out soon, you might want to think about waiting until it's released.

Re: 7.0.3 upgrade

jdprovine — Mon, 23 Nov 2015 15:56:58 GMT

I just want to keep my os current. PA told me to wait for there endorsement before going to 7.03 and I was not aware that 7.04 was coming out. I would probably only go to the OS that was one below the latest and greatest until it is tried and recommended

Re: 7.0.3 upgrade

Raido_Rattameister — Mon, 23 Nov 2015 16:14:17 GMT

If you decrypt ssl then better to wait and see if 7.0.4 has any fixes for it in release notes.

Some environments have random issues with 7.0.3

Re: 7.0.3 upgrade

Brandon_Wertz — Mon, 23 Nov 2015 16:30:47 GMT

There are some "cool" features in 7.X that I wanted, but nothing business driving.

I've been keeping in close contact with my SE, I suggest you do the same to make sure you get the right info, but from what i can tell 7.0.4 is going to be the "first suggested" version of 7.X as "stable." I'd wait for that, but I'd confirm with your own account SE.

A side note. 7.1 is going to beta soon and the inital info I've seen there have been huge positive operational support additions to SSL/TLS interactions.

Re: 7.0.3 upgrade

jdprovine — Mon, 23 Nov 2015 16:35:34 GMT

I have not found my SE very helpful, I rarely hear anything from him and little to questions I send him. But what I would really like is to be able to look at a box with the changes on it before upgrading to the newest version. I have read the release notes and there are 62 pages to it, granted I don't use panorama so I can skip that stuff. But as always my biggest concern is how is it going to change what I currently have configured and what are the benefits

Re: 7.0.3 upgrade

mlinsemier — Mon, 23 Nov 2015 16:44:07 GMT

If you must move to 7.x, I would wait for 7.0.4. We were an early adopter to 7.x and have had quite a few issues with everything from SSL decryption issues to dataplane memory leaks (caused by SSL decyription).

You have two choices in my mind:

1) If you must go to 7.0.x for features, wait until 7.0.4 as it has the SSL decyrption memory leak bug addressed.

2) If you can wait, move to 6.1.8 and wait for 7.1.1+ as there are a bunch of improvements in general from this release of PAN-OS, specifically from what I hear better SSL decryption support.

- Matt

Re: 7.0.3 upgrade

Brandon_Wertz — Mon, 23 Nov 2015 16:46:15 GMT

That's unfortunate about your SE...Mine's been good, especially with practical/applicable internal/NDA kinda stuff.

I've got Panorama on 7.0.2 only with 14 or so FWs from 5060s/3k/200s on version 6.X code. The biggest thing I see is ACC is night and day different (In a positive way.)

There are some default behavorial changes but for the most part it's the same "function" with ACC being the 1 major change. If you used ACC a lot in the past it will take some used to the new format.

Re: 7.0.3 upgrade

Brandon_Wertz — Mon, 23 Nov 2015 16:49:19 GMT

Agree with @mlinsemier on going to 7.1.1. Once 7.0.4 has been released I plan on upgrading our enviornment. Then once 7.1.X comes out the TLS support is going to be dramatically improved.

Re: 7.0.3 upgrade

jdprovine — Mon, 23 Nov 2015 17:48:37 GMT

I thought that the new os releases were about every other month according to my software updates but it almost sounds like they are always working on a new revision.

Also when I do contact my SE he tells me to call into support for help.

Re: 7.0.3 upgrade

Brandon_Wertz — Mon, 23 Nov 2015 19:06:15 GMT

The only thing I know for certain is that "patches" X.X.X are released every 6 weeks. I'm not certain about the release cycle of new versions (X.) or major revisions/feature releases (X.X) from within a version.

I think the later two are "it depends."

Re: 7.0.3 upgrade

jdprovine — Tue, 24 Nov 2015 13:46:26 GMT

Okay I never viewed them as patches before, that gives me a totally different perspective

Re: 7.0.3 upgrade

jdprovine — Tue, 24 Nov 2015 15:33:21 GMT

I found a link that helps

https://live.paloaltonetworks.com/t5/Featured-Articles/Tips-amp-Tricks-The-Application-Command-Center-ACC-for-PAN-OS-7/ta-p/68308

Re: 7.0.3 upgrade

john.langford@aplp.net — Tue, 24 Nov 2015 17:18:56 GMT

I would avoid 7.0 2 or 3 at all costs. We upgraded and have had nothing but problems. SSL decryption stops working (stops passing traffic). The firewalls have buffer problems and stop passing all traffic. We were a happy PAN customer for 5 years and now I spend my days and nights nursing my Palo Alto firewalls and talking to TAC. 7.0.x is one of the worst versions of code I have seen in my 30+ years in IT.

AVOID, AVOID, AVOID!

Re: 7.0.3 upgrade

googol — Tue, 24 Nov 2015 17:29:32 GMT

I upgraded to 7.0.3 because I had to get 1-2 of the features it provided. luckily I dont use some of the services (yet) that have been really problematic for users. I would have stayed on 6.1.X if I could.

Re: 7.0.3 upgrade

jdprovine — Tue, 24 Nov 2015 21:05:47 GMT

What services are you referring too?

Re: 7.0.3 upgrade

mlinsemier — Tue, 24 Nov 2015 21:16:54 GMT

I agree with @john.langford and couldn't have said it better. We are actually going to downgrade a few active/passive firewalls running 7.0.3 to 6.1.8 just to resolve issues with SSL decryption / dataplane memory leak bugs. We experienced them in 7.0.1 as well.

I'm hoping 7.1.x gets a more rigorous QA to avoid these types of issues. Basically in my mind if you want to run SSL Decryption and 7.0.x, it's not if, its just when will your SSL sessions stall or SSL buffers run out before you have to reboot / restart the dataplane. I'm actually surprised that the software posted hasn't been deffered.

Love the product however I am not sure what happened with 7.0.x.

-Matt

Re: 7.0.3 upgrade

jdprovine — Tue, 24 Nov 2015 21:26:46 GMT

Great information latest and greatest isn't as important and most stable

Re: 7.0.3 upgrade

Remo — Sun, 29 Nov 2015 22:08:46 GMT

Hi all

As @mlinsemier, john.langford@aplp.net and others already said. Unless you do not really need the features of 7.0.x STAY WITH 6.1.X!

Thes is just the short list of bugs I know and also experienced:

SSL Decryption completely useless (if you have more than a few users)
Global Protect: If you use LDAP as Authentication Profile there is this nice bug which shows a "Password expires in 0 days" on the Global Protect agents as you can see here (VPN users getting password expires in 0 day) --> probably fixed in 7.0.5
Global Protect: There is an issue with RADIUS authentication and setting permissions on GP Portal for AD Users/Groups whitch at least prevents Global Protect from working in my situation
User ID Redistribution: With this I don't know exactly whats going wrong because I hadn't had enough time to investigate further because I had to go back from 7.0.3 to 6.1.8, But an other firewall on 6.1.7 was not able to get the Global Protect User-IP Mappings from the 7.0.x Firewall

I also agree with you all with the point that I still really like the PaloAlto Products, but there have to be big, really big quality improvements in 7.1 to restore the trust into the product I once had.

Regards,

Remo

Re: 7.0.3 upgrade

Valdas_Rutkauskas — Wed, 02 Dec 2015 19:33:57 GMT

We have 37 firewalls (from 5000 to 200 ) managed with Panorama 7.0.3. I love template and device group stacking feature, new ACC look. 15 of them running 7.0.3 the rest is on 6.1.7. I dont see any issues on 7.0.3, but we dont use SSL decryption or GP, any other features works just as it suppose to.