topic Re: What PAN-OS version is support currently recommending? in General Topics

What PAN-OS version is support currently recommending?

scottsander — Mon, 14 Nov 2016 22:05:09 GMT

What PAN-OS version is PAN support currently recommending for active/passive PA-3050s? Last I checked (a few months ago), it was 7.0.8. We're currently running this version, but it has a minor bug that is impacting us. We were told by support a few months ago that the bug is fixed in the 7.1.x branch and that there are no plans to fix it in 7.0.x, but that they don't consider 7.1.4 (at the time) the stable, recommended version.

Re: What PAN-OS version is support currently recommending?

kiwi — Tue, 15 Nov 2016 08:05:08 GMT

Hi @scottsander,

Current recommended release in the PAN-OS 7.1.x branch is version 7.1.5

Cheers !

-Kim.

Re: What PAN-OS version is support currently recommending?

TranceforLife — Tue, 15 Nov 2016 11:02:28 GMT

Hi Wiki,

Quick question about PA-2050 series. Same code ?

Cheers,

Myky

Re: What PAN-OS version is support currently recommending?

kiwi — Tue, 15 Nov 2016 13:21:57 GMT

Hi @TranceforLife,

Yes, also for PA-2050 the recommended release is PAN-OS 7.1.5 for the 7.1.x branch.

Other recommended releases on other branches are : 6.0.15, 6.1.15, 7.0.11, 7.1.5.

Cheers !

-Kim.

Re: What PAN-OS version is support currently recommending?

scottsander — Tue, 15 Nov 2016 16:39:58 GMT

I contacted support and they are recommending 7.0.10 and 7.1.5.

Re: What PAN-OS version is support currently recommending?

jdprovine — Tue, 15 Nov 2016 17:01:18 GMT

what was your bug? we are currently running 7.0.8 and I have noticed that the percentage on the dataplane has really increased

Re: What PAN-OS version is support currently recommending?

scottsander — Wed, 16 Nov 2016 14:13:17 GMT

We do TLS decrypt with "block sessions from untrusted issuers" enabled. In previous major releases of PAN-OS (e.g. 4,.1.x, 5.0.x, and 6.0.x), the block page that would appear when a certificate wasn't trusted would list the certificate issuer and certificate common name. In 7.0.x, those fields are blank, which can make troubleshooting a bit of a pain. For whatever reason, support was told by PAN engineering that they aren't going to fix it in 7.0.x.

It led to an interesting conversation with support:

Me: "You're telling me that I need to move to the 7.1.x branch, but in the same breath you are telling me that 7.0.8 is the version that PAN recommends."

Support: "Yes."

Re: What PAN-OS version is support currently recommending?

jdprovine — Wed, 16 Nov 2016 15:26:38 GMT

Great thanks so much for the information