topic Re: Upgrade to 7.1.0 in General Topics

Upgrade to 7.1.0

Brandon_Wertz — Tue, 05 Apr 2016 13:25:37 GMT

I upgraded our lab palo to 7.1.0 last night. Has anyone else upgraded anything in their enviornment yet? I don't plan on doing anything in our production enviornment until at least 7.1.1 or 7.1.2.

Not really having much time yet I don't have much to say other than I'm looking forward greater awareness from things like the SaaS reports as well as the extra 10 or 12 cipher suites that are supported in 7.1.0 over prior versions.

Gotta say though I'm not digging the new look/feel of the GUI. The sharp lines/edges make the view feel "old."

Re: Upgrade to 7.1.0

Brandon_Wertz — Tue, 05 Apr 2016 14:07:51 GMT

Question for the "Palo" people on the site:

EBLs, formerly Dynamic Block Lists, now being able to use URLs; Can/How (can) we use EBLs with URLs in a URL Profile?

Re: Upgrade to 7.1.0

jvalentine — Tue, 05 Apr 2016 17:57:36 GMT

Gotta say though I'm not digging the new look/feel of the GUI. The sharp lines/edges make the view feel "old."

It grows on you. It took me a week or two to get used to it (during beta), but now I prefer the new style... and that's after 4yrs+ of experience with the previous GUI design. Hopefully you experience the same.

Re: Upgrade to 7.1.0

Retired Member — Tue, 05 Apr 2016 18:48:53 GMT

Upgraded my lab. Running the final for 2 days now.

Finally the ECDHE ciphers for the SSL proxy are there, and they work!

Only inbound ssl decyption with ECDHE ciphers don't work for me.

For now i am satisfied.

Re: Upgrade to 7.1.0

NickThen — Tue, 05 Apr 2016 18:38:57 GMT

Looking to upgrade to take advantage of the new ciphers, but will probably wait until 7.1.2 or 7.1.3. We got bit with the SSL memory leak in 7 and I need to make sure things are stable. Right now EHDCE ciphers are killing us as we do overrides weekly. Much needed feature.

Re: Upgrade to 7.1.0

Brandon_Wertz — Tue, 05 Apr 2016 18:43:01 GMT

yeah no way I'm risking my neck putting it in prod yet. There are A LOT of "known issues" for 7.1.0. I'll wait for that list to be pared down.

Re: Upgrade to 7.1.0

brucegarlock — Tue, 05 Apr 2016 19:38:59 GMT

I'm eager to update, but feel the same way. Wait until 7.1.1 or later. There are a few things I really like:

* Commit Queues (commits take forever on our PA-500)

* GP for chrome

* Unified logs

* External Dynamic Lists

* PFS for SSL

We're not affected by any of the known issues. How safe do you think it would be to update now, versus waiting? We have a HA pair, so I could always upgrade one of them, and turn Off HA and see how things run.

Re: Upgrade to 7.1.0

Brandon_Wertz — Tue, 05 Apr 2016 20:24:43 GMT

Personally I wouldn't do it.

But you can review the "known issues." See if any surround anything you'd be implementing in your enviornment. If there isn't anything there theoretically you might be "safe." Even then I'd talk to your SE and get their take. Then I'd tell management that you're upgrading to this new software but there could be a potential that things could go horribly wrong. Give them your thought on how you'd fix it quickly.

If after all that management is comfortable and you're comfortable...Go for it.

Personally I'd just wait the 6 more weeks for at least 7.1.1 to come out.

Re: Upgrade to 7.1.0

Brandon_Wertz — Tue, 05 Apr 2016 20:26:21 GMT

@brucegarlock Commits are great in 5060s. hahaha

Re: Upgrade to 7.1.0

brucegarlock — Tue, 05 Apr 2016 20:29:52 GMT

Brandon_Wertz I am jealous 🙂

I've started looking at my back-out plan, but you are right - I should just wait a bit and be patient. 🙂

Re: Upgrade to 7.1.0

Brandon_Wertz — Wed, 06 Apr 2016 03:26:52 GMT

Trust me I'm feeling froggy with all the extra features 7.1 has, but I prefer to keep my job. So I sit and wait...waiting to play with the shinies...Begging for me to bring them out to play.

Re: Upgrade to 7.1.0

googol — Thu, 07 Apr 2016 03:11:16 GMT

I'll be upgrading my panorama to 7.1, but holding off on the firewalls until later, like 7.1.2 unless I need the feature sooner.

Re: Upgrade to 7.1.0

mlinsemier — Thu, 07 Apr 2016 13:31:08 GMT

I had a chance to play with it in beta, but not quite as much as I would have liked too.

I installed it on a lab PA-200 yesterday from a perfectly working version of 7.0.6.

I am having some decrypt issues with websites again. Sites such as Google Earth, Bing maps, banking websites, etc. are spinning and spinning in Chrome, IE, and Edge eventually come up, but continue to spin. Search boxes where you would expect to see auto-populated data (say Bing maps) don't work. Disabling the decrypt SSL rul instantly resolves the issue.

I'll probably open a ticket with Palo Alto again for investigation. It always seems to boil down to features that I feel we need the most as engineers not working correctly.

Matt

Re: Upgrade to 7.1.0

jdelio — Thu, 07 Apr 2016 23:30:05 GMT

@Brandon_Wertz, about EBL/EDL, I have created the following to show how to use the EBL in a URL filtering policy here:

https://live.paloaltonetworks.com/t5/PAN-OS-7-1-Videos/PAN-OS-7-1-URL-Filtering-Dynamic-Block-List-External-Block-List/ta-p/74098

I hope this answers this question.

Re: Upgrade to 7.1.0

Brandon_Wertz — Fri, 08 Apr 2016 01:28:12 GMT

Exactly what I was looking for thanks @jdelio

Re: Upgrade to 7.1.0

googol — Fri, 08 Apr 2016 22:05:39 GMT

don't even install 7.1 on your panorama unless you want your configuration wiped by panorama templates when committing...

yay for bugs

Re: Upgrade to 7.1.0

craymer — Sun, 10 Apr 2016 01:23:32 GMT

Upgraded to 7.1 friday night to test over the weekend and ran into multiple problems with rule processing and URL filtering. sites being blocked that should be allowed. sessions failing to be recognized and blocking on final rule.

We are reverting. 😞

Re: Upgrade to 7.1.0

jvalentine — Sun, 10 Apr 2016 04:12:24 GMT

PAN-OS 7.1.0 has a change in default behavior with respect to security policy processing. Check out the release notes and see if this might be what you experienced:

- https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os-release-notes/pan-os-7-1-release-information/changes-to-default-behavior#15554

Re: Upgrade to 7.1.0

jsotech — Mon, 11 Apr 2016 12:41:27 GMT

We upgraded to 7.1 in test and ran into a number of issues with Linux IPsec clients (and some mobile clients not using GlobalProtect app) being unable to negotiate with the VPN and not establishing connection.

While there are some nice feature additions, this was pretty show-stopping and we probably won't go any further until a cause is identified (we're still testing various configurations to determine if anything about our setup was causing the issue.)

Re: Upgrade to 7.1.0

shizl8r — Mon, 11 Apr 2016 20:47:51 GMT

Also ran into the Linux IPSec clients issue.

Error on the linux clients is showing:

configuration response rejected: (ISAKMP_N_ATTRIBUTES_NOT_SUPPORTED)

Hopefully a resolution is in the works.