topic Behaviour identifying SSL after dynamic updates installation in General Topics

Behaviour identifying SSL after dynamic updates installation

soporteseguridad — Wed, 13 Sep 2017 08:53:54 GMT

Hi,

Last night the scheduled dynamic installation was done, the new version 734-4212 (apps) was installed. When this installation happened a lot of traffic before detected like ssl in previous version, it was being detected like "not-applicable" and jumping all rule until default deny. We did a revert updated packet to solve it.

Why PA suddenly stop identifying ssl app with this new update package??? what should we do in order to prevent this fail identifying apps in new apps package??

How should we procced_ Do we re-apply the current version? we should wait for a new one (junmping 734-4241 which is not identifying properly SSL?

Re: Behaviour identifying SSL after dynamic updates installation

kiwi — Wed, 13 Sep 2017 09:38:12 GMT

Hi @soporteseguridad,

I haven't heard of any issues yet.

The application column shows not-applicable if the traffic matches an allowing/blocking security rule via a service filter rather than an application filter :

https://live.paloaltonetworks.com/t5/Management-Articles/quot-Not-applicable-quot-in-Traffic-Logs/ta-p/65745

To prevent any unwanted things from happening you could configure a threshold in your update schedule.

If you decide to configure this threshold then please consider this DOC :

https://live.paloaltonetworks.com/t5/Management-Articles/Dynamic-updates-scheduled-with-a-threshold-set-but-are-never-or/ta-p/65952

Cheers,

-Kiwi

Re: Behaviour identifying SSL after dynamic updates installation

soporteseguridad — Wed, 13 Sep 2017 10:01:52 GMT

An example:

Before apps package was identifying properly the apps SSL. Traffic SSL and rule defined.

After installing last package (last night), we detect problem idetifying SSL

Why its not identifying SSL with the new apps package??

Re: Behaviour identifying SSL after dynamic updates installation

BPry — Wed, 13 Sep 2017 12:47:19 GMT

@soporteseguridad,

While I can't speak to this being a widespread issue as I don't have the current update installed on even my test enviroment at the moment, I would highly recommmend you put some type of delay on your production equipment so that the update needs to be x number of hours old before it gets applied. This usually gives those of us with test envioroments or those that don't have a delay set to notice any potential issues so PA has a chance to pull the update if it trully causes any issues.

Re: Behaviour identifying SSL after dynamic updates installation

soporteseguridad — Wed, 13 Sep 2017 14:29:11 GMT

I cant find the cause why PA is not detecting this SSL traffic. I think it could be a widespead issue. If anyone has any PA confirmation just let me know.

Re: Behaviour identifying SSL after dynamic updates installation

kiwi — Wed, 13 Sep 2017 14:41:32 GMT

Hi @soporteseguridad,

Have you reached out to TAC about this ?

If this was a widespread issue, I would have expected more similar reactions (as with content 729 about 2 weeks ago).

Cheers,

-Kiwi.