topic Content 571 Customer Advisory in General Topics

Content 571 Customer Advisory

maurisy — Fri, 25 Mar 2016 05:52:10 GMT

Application and Threat Content version 571 was removed from the Palo Alto Networks support site at approximately 0230 PM PST on 24-MAR-2016, after discovering an issue with this content update and Panorama stability related to the Correlation Objects feature. In the interim, customers who have installed content version 571 and use Panorama for device management are advised to roll back to content 570 or disable the "Beacon Detection - Dynamic DNS” (ID-6007) and “Beacon Detection - Heuristics” (ID-6005) correlation objects on the Monitor—>Correlations objects page. Correlation Objects work specifically on the PA-3000, PA-5000, PA-7000 series and PAN-OS 7.0+ and VM or M-Series Panorama 7.0+.

Palo Alto Networks is working to resolve this, and will issue a notification when a remediated version of Application and Threat Content is made available. Please subscribe to this document to receive updates.

Re: Content 571 Customer Advisory

justamoment — Fri, 25 Mar 2016 03:14:35 GMT

FYI, it says it was removed in 2015.

Re: Content 571 Customer Advisory

Maciej.Handwerker@ch2m.com — Fri, 25 Mar 2016 07:28:25 GMT

Does is cause just Panorama instability or can cause firewalls to stop processing traffic?

Re: Content 571 Customer Advisory

daveg-1856 — Fri, 25 Mar 2016 13:23:06 GMT

In our case it caused Panorama to power cycle until it was placed in maintenance mode due to repeated crashing. There were no firewall/ enforcement gateway side effects.

Re: Content 571 Customer Advisory

asenter — Fri, 25 Mar 2016 13:51:48 GMT

I have 5050's and running 6.1.5...do I have to roll back?

Re: Content 571 Customer Advisory

daveg-1856 — Fri, 25 Mar 2016 13:58:20 GMT

Nope, just follow the mitigation listed in the URL below. I have a feeling this bug will be fixed in 7.0.7, at least I hope so. The work around below will work in the mean time.

Thanks,

Dave

Palo Alto Customer Notice on 571:

https://live.paloaltonetworks.com/t5/General-Topics/Content-571-Customer-Advisory/m-p/75230/thread-id/41900

Re: Content 571 Customer Advisory

Jeff-Behm — Fri, 25 Mar 2016 14:04:59 GMT

Does one need to disable the two Corr. Objects only on Panorama, or on all the firewalls, too?

Re: Content 571 Customer Advisory

AndyAbplanalp — Fri, 25 Mar 2016 14:08:28 GMT

Only on Panorama. Our behavior was Panorama would crash due to logd and reboot every 10 minutes or so. Made committing changes to managed devices hard but outside of that caused no issues. Our PAs were at 571 with no issues.

Re: Content 571 Customer Advisory

daveg-1856 — Fri, 25 Mar 2016 14:15:21 GMT

Andy is correct only on Panorama, the gateways are not affected by this due to explanation provided by Andy.

Re: Content 571 Customer Advisory

David_Hulse — Fri, 25 Mar 2016 14:30:32 GMT

Glad to see this one has a definite answer. Was seriously worried we were being DDOSd in some nasty way that the gateways weren't picking up on 😕

Panorama M100s in HA here - once again no issues on gateways, just the Panorama box logd service causing constant restarts.

Re: Content 571 Customer Advisory

Lepton — Fri, 25 Mar 2016 17:49:20 GMT

There appears to be some confusion regaring which platforms require a rollback to 570. I think the question has been answered by the community but I suggest Palo Alto use a more clear format for notices like these. A simple table listing the platforms requiring the rollback would have reduced confusion for us.

Re: Content 571 Customer Advisory

sib2017 — Sun, 27 Mar 2016 07:54:02 GMT

Hi ,

I don't have correlation object feature enabled, still need to toll back?

Thanks

Re: Content 571 Customer Advisory

daveg-1856 — Mon, 28 Mar 2016 14:56:39 GMT

If it is not enabled than no, disabling it is a mitigation against the bug condition.

Re: Content 571 Customer Advisory

maurisy — Mon, 28 Mar 2016 15:45:52 GMT

@LeptonThanks for the feedback here. We'll take this into consideration for future communications.