topic ftp and PAN-OS 6.0 problem in General Topics

ftp and PAN-OS 6.0 problem

Oleksandr — Tue, 11 Feb 2014 17:16:18 GMT

Hi Team!

I have a problem with ftp application in PAN-OS 6.0 after upgrading from 5.9.

Passive ftp is stop working correctly.

Temporary resolved by creating an application override rule.

Any ideas?

Thank you

Re: ftp and PAN-OS 6.0 problem

Retired Member — Tue, 11 Feb 2014 17:29:18 GMT

I saw that too

seems to be bug, because downgraded to solve the issue.

Re: ftp and PAN-OS 6.0 problem

Mystique — Tue, 11 Feb 2014 21:07:04 GMT

Can you please check if the session application is not changing to your-freedom in discard state after trying to initiate ftp connection ?

show session all filter state discard

I had same issue and rebuilding the content fixed the issue i.e. downgrade to content version or upgrade to latest content version (if not already on the latest)

Re: ftp and PAN-OS 6.0 problem

Oleksandr — Tue, 11 Feb 2014 21:12:39 GMT

I tried it , but it didn't help me... It was working with latest content update, but on 5.0.9

Re: ftp and PAN-OS 6.0 problem

pulukas — Wed, 12 Feb 2014 02:28:47 GMT

Try changing the service to application default instead of any. Sometimes this prevents the need for an application override rule.

Do be sure to open a case so the bug gets logged and into the process for a future update.

Re: ftp and PAN-OS 6.0 problem

mbutt — Wed, 12 Feb 2014 05:23:28 GMT

I would recommend you to try upgrading to the latest content which got release today 418. If it still does not resolve the issue you are facing open a case with the support collecting

1. Packet captures of the traffic displaying the issue on the client and on the firewall.

2. Traffic logs during the time of the issue.

3. What kind of ftp server and client is being used. Version of the client.

4. Steps to reproduce the issue.

This will help the support is determining the issue faster. Hope this helps.

Thank you

Numan

Re: ftp and PAN-OS 6.0 problem

Oleksandr — Wed, 12 Feb 2014 14:56:28 GMT

I'll try to test it ASAP

Re: ftp and PAN-OS 6.0 problem

Oleksandr — Thu, 13 Feb 2014 17:21:29 GMT

Hi There,

Application override rule not helps for 100%, some sites can't communicate..... It doesn't works on mainframe client (unix based)

So...

Only downgrade?

Re: ftp and PAN-OS 6.0 problem

pulukas — Fri, 14 Feb 2014 02:11:33 GMT

Yes, if the application override does not work to solve the issue, then a downgrade would be necessary.

Be sure you create the application override for the most specific traffic possible and in both directions first.

Also before downgrading follow the steps outlined by mbutt above and get packet captures on both sides of the Palo Alto for the failed traffic. This way support will identify which bug is your issue and can notify you when the fix is being released for the bug.

Steve

Re: ftp and PAN-OS 6.0 problem

Oleksandr — Fri, 14 Feb 2014 15:04:51 GMT

I've opened a case in PA TechSupp

Re: ftp and PAN-OS 6.0 problem

Oleksandr — Thu, 20 Feb 2014 17:22:08 GMT

This is a known bug 61387 and the engineering is currently working towards the fix.

Re: ftp and PAN-OS 6.0 problem

Oleksandr — Wed, 26 Feb 2014 14:45:01 GMT

It will be fixed in 6.0.2 release.