topic Re: AD trouble after installing content version 729 in General Topics

AD trouble after installing content version 729

TerjeLundbo — Wed, 30 Aug 2017 08:05:52 GMT

We had problems with AD after installing content version 729 this morning. Users were authenticated, but the logon process (group policy, drive mapping) was painfully slow. After we reverted to version 727 everything was OK again. The strange thing is that I see no traffic to our AD controllers being stopped by the firewall.

Anybody else seen this? We're using two PA-5050 in HA (active/passive) running PAN-OS 7.1.10.

Re: AD trouble after installing content version 729

M_Eberhardt — Wed, 30 Aug 2017 08:56:04 GMT

We had big problems too!! Group policy and drive mapping Problems! We have reverted to V726.

PA 5050 Cluster (Active/Passive)

PanOS 7.1.7

Re: AD trouble after installing content version 729

MartinIngebrigtsen — Wed, 30 Aug 2017 10:46:30 GMT

We also had big AD issues after upgrading to 729

PA-7050 in HA running 7.1.10

Seemes fixed afer we reverted to 727

EDIT:

Our own preliminar analysis indicates problems with LDAP (at least) after we upgraded to 729; we noticed the packet buffer was unusually high, and the average duration for LDAP sessions drastically increased, so our best guess is that it was having issues identifying LDAP AppID.

Re: AD trouble after installing content version 729

Trond.Olsen — Wed, 30 Aug 2017 11:04:01 GMT

We experienced LDAP traffic problems also today on our PA with content update 729-4193. We identified a policy that used application filtering with application-default service ports, as we saw undecided traffic on port 389. We resolved this temporarily by changing service ports to any. Our policies that used service ports exclusivly was not affected.

Re: AD trouble after installing content version 729

Jacopo_Vigano — Wed, 30 Aug 2017 13:33:11 GMT

Two of our customer had the same issue this morning.

We have rolled back to 727 to avoid the problem.

PA-5060 PANOS 7.1.10 Active/Passive. We use any as Application and Service. We have only AS,AV VP Profiles enabled.

Thanks.

Jacopo

Re: AD trouble after installing content version 729

JCovell — Wed, 30 Aug 2017 14:18:56 GMT

Our Exchange 2013 servers stopped working when version 729 was downloaded and applied last night. In the Windows event logs, the Exchange servers were complaining about problems with the Exchange topology and not being able to find a valid domain controller, Event IDs, 2130 2142 2070.

We did have LDAP communication from the Exchange servers to the DC being allowed through our PA 3050s, but most flows were very small, ~464 bytes.

I reverted to version 727 and almost immediately the Exchange servers restarted their services and started servicing email.

Re: AD trouble after installing content version 729

s996kingsm — Wed, 30 Aug 2017 14:21:25 GMT

We had issues this morning I'm not sure what all was affected but as soon as I reverted to 727 everything started working.

5060's running 7.1.10

Re: AD trouble after installing content version 729

Frank_Wessbo — Wed, 30 Aug 2017 14:23:20 GMT

Content 729 has been removed now

Re: AD trouble after installing content version 729

JasonPANAcct — Wed, 30 Aug 2017 15:02:49 GMT

Same here. We had more than just AD problems too. We had ssl problems from servers to internet services not working as well as problems with port based connections (app and service = any) for internal server to server connections. All were resolved when we rolled back to 727.

Re: AD trouble after installing content version 729

Leszek_Stefaniak — Wed, 30 Aug 2017 15:05:42 GMT

We noticed problems whit sip session - not only ldap

Re: AD trouble after installing content version 729

RichColeman — Wed, 30 Aug 2017 15:57:07 GMT

Word on the street is the content team is working on resolving the issue, I would expect a fix in the next 24 hours.

Also its always worth setting a delay on the download/install just to protect yourselves against this sort of issue. We set a 24 defer period on our estate. Saved us a few times

Re: AD trouble after installing content version 729

molander — Wed, 30 Aug 2017 16:01:26 GMT

We were seeing various issues with authentication and various traffic breaking on our 7050 HA pairs.

Reverted the App and Threat content version to 726 which resolved all issues.

Re: AD trouble after installing content version 729

cdp181 — Wed, 30 Aug 2017 16:01:47 GMT

Our Palo partner suggested a 72 hour delay on content updates. Interestingly you don't seem to be able to configure a delay in Panorama only on the devices themselves.

Re: AD trouble after installing content version 729

mlinsemier — Wed, 30 Aug 2017 16:16:15 GMT

We ran into the same issues with content 729. Rolling back to 727 resolved our issues.

I'm thinking that delaying it by 24 hours sounds like a good idea. I saw a post above stating that they waiting 72 hours inbetween updates.

By waiting to long it seems we run into a chicken and the egg scenario. What are the dangers where Threats and App-ID are not updated? I assume there could be a window where new Vulnerabilities may not be addressed or changes by the vendors for App-ID may not be properly identified correctly by Policy rules.

Thoughts?

Matt

Re: AD trouble after installing content version 729

MGoodnow — Wed, 30 Aug 2017 16:50:02 GMT

We are also experiencing many issues with 729 and connections related PACS images and interface engines. Removing Threat, resolves all issues.

Re: AD trouble after installing content version 729

Gun-Slinger — Wed, 30 Aug 2017 17:15:36 GMT

We had issues associated with HL7 traffic. We have completed a roll back and that resolved the issue.

Re: AD trouble after installing content version 729

niuk — Wed, 30 Aug 2017 17:19:42 GMT

Was it seen in Monitor/Traffic or Threats , like drops anything ?

Re: AD trouble after installing content version 729

BrianGittens — Wed, 30 Aug 2017 17:20:32 GMT

We also had this problem and committed an Any on the Service for AD to work. We were about to test what the issue was when we saw the PA update on 729. We are reverting to 727 and deleted 729.

Written by Edward Millington

Re: AD trouble after installing content version 729

mivaldi — Wed, 30 Aug 2017 17:24:30 GMT

Please refer to the following Palo Alto Networks Customer Advisory available at:

https://live.paloaltonetworks.com/t5/Customer-Advisories/Important-information-regarding-Content-Apps-amp-Threats-version/ta-p/173866

Re: AD trouble after installing content version 729

ajr0 — Wed, 30 Aug 2017 17:29:00 GMT

@cdp181 wrote:
Our Palo partner suggested a 72 hour delay on content updates. Interestingly you don't seem to be able to configure a delay in Panorama only on the devices themselves.

FYI on panorama 7.x.x and above I think this option is available. It may be available prior to that release but I cannot confirm,.