topic Re: Experience with PANOS 6 so far ? in General Topics

Experience with PANOS 6 so far ?

gafrol — Tue, 28 Jan 2014 09:00:56 GMT

I installed PANOS 6 on our Lab Box. Upgraded from 5.0.9. No problems so far.

Anyone else ?

Re: Experience with PANOS 6 so far ?

dustink — Tue, 28 Jan 2014 18:20:22 GMT

I received an odd error when I tried to upgrade from 5.0.10 -

" Failed to install 6.0.0 with the following errors. SW version is 6.0.0 Error: Upgrading from 5.0.10 to 6.0.0 requires a content version of 401 or greater and found 320-1459. Failed to install version 6.0.0 type panos"

Maybe I'll try downgrading, to upgrade.

Re: Experience with PANOS 6 so far ?

dustink — Tue, 28 Jan 2014 18:46:17 GMT

updating / installing the App and Threats option fixed the install

Re: Experience with PANOS 6 so far ?

mr.linus — Wed, 29 Jan 2014 09:07:25 GMT

Used it in a vwire setup for the DNS sinkholing feature.

Helped me root out a virus infection with a customer.

No issues so far.

Re: Experience with PANOS 6 so far ?

mario11584 — Wed, 29 Jan 2014 17:34:27 GMT

We just bought two new PA-3020s that will go live with 6.0 on Friday night. I'll try to remember and report back and let you know how it goes. I've been using them via the management interface since 6.0 release and I haven't had any problems. Of course, a data load will be the true test.

Re: Experience with PANOS 6 so far ?

pulukas — Thu, 30 Jan 2014 02:31:28 GMT

Running on a test box now and no issues with the upgrade or the 300 rule policy push. The tap traffic of production all seems to behave the same way.

On the feature side, ssl port mirror and the dns sinkhole look like good additions to take a closer look at application in the network.

Re: Experience with PANOS 6 so far ?

Quinton — Thu, 30 Jan 2014 17:51:31 GMT

So far so good. Seems pretty solid. Only issue I found thus far is the dynamic content error when upgrading from 5.x to 6.0. The dynamic content page gives an error and it does not scan traffic for threats.

Re: Experience with PANOS 6 so far ?

cloughr — Fri, 31 Jan 2014 12:41:57 GMT

We use PA-5020s, and I couldn't wait to update to 6, to take advantage of the safe-search filtering. Unfortunately, when we upgraded it broke our user-id system, specifically the group mappings. 90% of all filtering went out of the 'default" policy. We are a large school system and rely on our group filtering. I reverted back to 5.0.9 and have a case open.

Re: Experience with PANOS 6 so far ?

gafrol — Tue, 04 Feb 2014 09:32:15 GMT

Still running 6.0 since almost two weeks without any problems. Well done PAN from my side !

Re: Experience with PANOS 6 so far ?

ericgearhart — Tue, 04 Feb 2014 10:59:36 GMT

gafrol would you care to provide some details of your implementation? PA 5000s? IPsec tunnels? HA? GlobalProtect? What all are you using? Are you taking advantage of the new DNS blackholing?

Re: Experience with PANOS 6 so far ?

mario11584 — Tue, 04 Feb 2014 15:35:05 GMT

We installed new PA-3020s on Friday with 6.0. It's only been a few days and we haven't had a single problem. We have HA, IPSec tunnels, multiple virtual routers, tons of PBFs and static routes and everything has been great.

Re: Experience with PANOS 6 so far ?

mg_imid — Wed, 05 Feb 2014 03:48:44 GMT

I use PA-3050 in my lab, from 5.0.10 to 6.0.0, but some feature like DHCP is not working well, i try to delete and recreate, then it working.

DNS Proxy is failed too, try to delete and recreate is still problem.

Re: Experience with PANOS 6 so far ?

msullivan — Wed, 05 Feb 2014 20:46:27 GMT

cloughr,

Has PA resolved this for you? I use group membership in several critical rules, this kind of issue really grabs my attention.

Thanks,

Mike

Re: Experience with PANOS 6 so far ?

mario11584 — Wed, 05 Feb 2014 20:59:33 GMT

We are using DHCP on 6.0 for one of our networks and it's working great.

Re: Experience with PANOS 6 so far ?

mg_imid — Thu, 06 Feb 2014 08:04:50 GMT

Hi Mario,

Yes it work for workstation, but tested with mobile phone it can't, then i delete and recreate, it's work well now.

For DNS proxy, i think it should work, because my dns server is the problem then it effect to appliance to resolve name.

Re: Experience with PANOS 6 so far ?

Oleksandr — Mon, 24 Feb 2014 21:53:40 GMT

I installed PANOS 6...have some issue with ftp (known bug)

Re: Experience with PANOS 6 so far ?

JosueFernando — Thu, 13 Mar 2014 20:18:13 GMT

You need update the content version first, and after this you should have no problems for update at version 6.0.0

Re: Experience with PANOS 6 so far ?

sbjornstad — Mon, 17 Mar 2014 14:30:40 GMT

Got the same problem. Upgrade from 5.10 to 6.1 !

User ID do not match with "included user groups" and all traffic is denied.

Re: Experience with PANOS 6 so far ?

cstancill — Tue, 18 Mar 2014 07:02:16 GMT

Try and rebuild the userinfo.xml file using the following commands:

> debug user-id clear group all

> debug user-id reset group-mapping all

> debug user-id reset user-id-manager type user-group

> configure

# commit force

This will force the firewall to rebuild the userid.xml file based on a refresh from the LDAP server. If this doesn't work, give support a call so that we can take a look.

Re: Experience with PANOS 6 so far ?

Hithead — Tue, 25 Mar 2014 12:56:45 GMT

Hi guys,

also have problems with the user groups. any solution?