topic Re: Is PANOS 8.1.3 really functionnal on PA-3250 ? in General Topics

Is PANOS 8.1.3 really functionnal on PA-3250 ?

Infra_DKI — Tue, 02 Oct 2018 09:14:08 GMT

Hi all,

We migrated 2 weeks ago from a PA-3020 to a PA-3250.

We upgrated the PA-3020 from PanOS 7.1.19 to 8.1.3 and then we exported the configuration and then imported it into the PA-3250 (that was already in PANOS 8.1.3)

Since this migration we faced to different issues we never encountered using the PA-3020.

The most important of them is that a significative part of http, ftp, smtp (and maybe other traffic) is often recognized as "unkonwn-tcp"

The result is that all security policies based on applications are not working as expected. 20 percent of the sessions (yes 20% !) are not well recognized and are dropped because they didn't match to a security rule.

To avoid a blackout of our production, we had to insert more permissives and "old fashion" rules based on adresses and port to allow this traffic.

A case is alsoe currently open to the support, but it does not seems to really progress...

Does anyone using PanOS 8.1.3 on PA-3250 hardware ?

And if yes, did you faced to similar issues ?

Here is a graph of one day unknown-tcp sessions :

Regards,

Re: Is PANOS 8.1.3 really functionnal on PA-3250 ?

LukeBullimore — Tue, 02 Oct 2018 11:44:23 GMT

Hi @Infra_DKI

We faced these exact same issues going from PA-5000 series to PA-3260s - huge increase in unknown-tcp which was impacting business. For us, the fix was actually to reboot the firewalls and the problem hasn't occurred since we rebooted (1 or so weeks ago)

We also faced an internal path monitoring failure twice which caused dataplane restarts. TAC stated this was fixed in PAN-OS 8.1.4 with Bug-ID PAN-101182

Cheers,

Luke.

Re: Is PANOS 8.1.3 really functionnal on PA-3250 ?

Infra_DKI — Tue, 02 Oct 2018 15:53:17 GMT

This feedback is interresting.

We faced this issue since the migration to this firewall 2 weeks ago.

I will plan a restart to see what happens...

Re: Is PANOS 8.1.3 really functionnal on PA-3250 ?

Infra_DKI — Thu, 04 Oct 2018 16:02:44 GMT

I rebooted the firewall this morning and I have no more abnormal unknown-tcp sessions after 8:30

I will check it in nexts days to see if that occurs again.

Very strange...

Re: Is PANOS 8.1.3 really functionnal on PA-3250 ?

Infra_DKI — Tue, 09 Oct 2018 08:38:35 GMT

The problem seems to be gone since the reboot.

That's very strange. We have to be very carefull to be sure that it will not happen again in the future...