topic Re: PAN-OS 8.1.0 SMB Issues in General Topics

PAN-OS 8.1.0 SMB Issues

LukeBullimore — Thu, 03 May 2018 14:34:10 GMT

Hello all,

Please be advised, there is a current issue with PAN-OS 8.1 which seems to break anything SMB related, e.g. mapped network drives. Sessions have an end reason of "resources-unavailable" and go into state "Discard" in the session table.

Upon speaking with a TAC engineer, this is a known issue and they are working towards a fix.

Edit: This is now resolved in PAN-OS 8.1.1 under BugID:

PAN-94445

Fixed an issue where Server Message Block (SMB) sessions were in a discard state with the session end reason resources-unavailable

Thanks,

Luke.

Re: PAN-OS 8.1.0 SMB Issues

Jacopo_Vigano — Tue, 20 Mar 2018 20:29:39 GMT

TAC suggest to create an application override policy as workaround or downgrade to 8.0.X PANOS version.

Jacopo

Re: PAN-OS 8.1.0 SMB Issues

teoder — Wed, 21 Mar 2018 13:43:32 GMT

Did you try the Application Override or did you downgrade?

Re: PAN-OS 8.1.0 SMB Issues

koen.wauters — Wed, 21 Mar 2018 14:04:28 GMT

Applicaton Override does the trick.

Re: PAN-OS 8.1.0 SMB Issues

ppeters86 — Wed, 21 Mar 2018 14:14:39 GMT

I didn't have time to mess around on Sunday when this was discovered, so we downgraded. Thankfully that went smoothly.

Re: PAN-OS 8.1.0 SMB Issues

RikuPessinen — Wed, 21 Mar 2018 15:03:38 GMT

Thanks for the info, I was just about to deploy 8.1 to one firewall 🙂

Re: PAN-OS 8.1.0 SMB Issues

teoder — Wed, 21 Mar 2018 15:05:48 GMT

Ended up doing a downgrade too, went back to 8.0.8. I so wanted the hit counter 😞

Does anyone know if there is an Issue ID for this problem?

Re: PAN-OS 8.1.0 SMB Issues

Pawel_Bakala — Thu, 22 Mar 2018 14:21:29 GMT

We did the downgrade also. Waiting to resolve the issue

Re: PAN-OS 8.1.0 SMB Issues

tom_oconnor_utas — Thu, 22 Mar 2018 16:05:00 GMT

We just had a day's outage due to this issue. Palo Alto *really* should have pulled the update and warned people who have installed it.

Re: PAN-OS 8.1.0 SMB Issues

teoder — Thu, 22 Mar 2018 16:18:42 GMT

So far I've had no issues with 8.1 och PA-220, not that much traffic passing through it though...

On a couple of PA-850 the only option was to do a downgrade, no SMB traffic worked as intended.

Could it be related to certian hardware platforms? What platforms have you experienced problems on?

Re: PAN-OS 8.1.0 SMB Issues

Pawel_Bakala — Thu, 22 Mar 2018 17:44:20 GMT

We have two 3050 's in ha configuration

Re: PAN-OS 8.1.0 SMB Issues

tom_oconnor_utas — Thu, 22 Mar 2018 22:21:19 GMT

We have a pair of PA-5060s, and were seriously affected. Everyone using SMB was unable to do any work for 8 hours.

Re: PAN-OS 8.1.0 SMB Issues

Cramer — Mon, 26 Mar 2018 09:54:51 GMT

Re: Application Override to resolve PAN OS 8.1.0 SMB Issues

Does this apply to environments where the Palo Alto firewall provides routing to the local LAN and IPSEC tunnels to remote LANs on internal trusted interfaces where no Security or NAT policies are programmed?

If so, which applications need to be overridden to work-around this bug?

This is a devastating issue when it occurs.

Our work-sround has been to switch the active and passive roles of 2 PA-500 firewalls to reset the routing. This restores LAN and IPSEC tunnel routing for SMB but only works until the problem returns.

Re: PAN-OS 8.1.0 SMB Issues

Jacopo_Vigano — Mon, 26 Mar 2018 13:16:17 GMT

The problem should be fixed with 8.1.1 which is scheduled to be released by the end of April. The issue ID is PAN-93016.

Thanks.

Jacopo

Re: PAN-OS 8.1.0 SMB Issues

Retired Member — Mon, 02 Apr 2018 17:39:22 GMT

We ran into this issue as well. I'm really surprised this wasn't noticed during testing. Creating the application override solved the problem.

Re: PAN-OS 8.1.0 SMB Issues

BPry — Mon, 02 Apr 2018 18:57:34 GMT

@Retired Member,

It was noticed during testing and we all pretty much chopped it up to the SMBv3 improvements that allow additional threat detection and file identification capabilities that were added into 8.1. I think we were all just under the impression that it wasn't something that would make it into the actual release.

Re: PAN-OS 8.1.0 SMB Issues

Cramer — Mon, 02 Apr 2018 18:58:42 GMT

I agree. SMB is a core service and breaking it is a show-stopper. We use our firewalls as our LAN routers, and this issue resulted in intermittent collapse of SMB across our LAN subnets and across our IPSEC tunnels, totally disrupting our network operations. We discovered that we could temporarily "reset" SMB by forcing an active-passive firewall failover. SMB would work again for a few days until the next recurrence.

We did the application-override but it was useless since we do not apply any policies on our internal routing (intrazone).

When we learned that ther wasn't going to be a hot fix and that the next version of PAN-OS 8.1.1 would not be until the end of April, we decided to roll back all of our firewalls to 8.0.8.

It was also surprising that Palo Alto did not bother to respond to our ticket on this issue.

Re: PAN-OS 8.1.0 SMB Issues

tom_oconnor_utas — Tue, 03 Apr 2018 10:34:00 GMT

I hope this issue has caused an internal investigation to be opened into how a critical bug made it into a GA release, so hopefully it will never happen again.

Re: PAN-OS 8.1.0 SMB Issues

ITSysEng — Tue, 10 Apr 2018 18:12:26 GMT

Is there a sample of how ya'all did the App-override and made it work?

Re: PAN-OS 8.1.0 SMB Issues

Cramer — Tue, 10 Apr 2018 18:24:16 GMT

This is what we tried, but it didn't work since our issues were with the Virtual Router for internal routing.

SMB Application Override

Policies / Application Override

Add
General
Name: SMB L7 Inspect Exclude
Description: To improve SMB performance, Layer 7 inspection is excluded.
Source
Source Zone: L3-trust
Source Address: Any
Destination
Destination Zone: L3-trust
Destination Address: Any
Protocol/Application
TCP
Port 445,139
Application: ms-ds-smb