topic Re: Any issues with PANOS 4.0.5? in General Topics

Any issues with PANOS 4.0.5?

bchan — Thu, 15 Sep 2011 14:53:24 GMT

Has anyone ran into issues with PANOS 4.05?

My previous past experience with PANOS 4.0.x was not the greatest.

High CPU utilization, network latency, GUI issues, and logging issues were not

the greatest. The end result was tech support and rollback to PANOS 3.1.x.

Re: Any issues with PANOS 4.0.5?

Bart_Jocque — Thu, 15 Sep 2011 15:32:46 GMT

we are running 4.04 in prod since a while.

We had some issues indeed, but we received workarrounds from the TAC for most of them.

Running 4.05 in lab now.

Re: Any issues with PANOS 4.0.5?

dbaumann — Thu, 15 Sep 2011 17:03:20 GMT

I've had the dataplane restarting due to crashing packet process multiple times. I have a TAC case open.

Re: Any issues with PANOS 4.0.5?

jbaker80 — Fri, 16 Sep 2011 16:31:07 GMT

We're about 1 week into using 4.0.5 and have only run into a couple issues, neither of which I consider to be show stoppers.

The first doesn't seem to be specific to 4.0.5 but it's an issue with administrator accounts syncing down from Panorama to the devices and shared authentication profiles not being useable outside of the Panorama context. Here's a link to the thread on that whole discussion:

https://live.paloaltonetworks.com/message/9307#9307

The other issue that we're dealing with concerns ACC and I currently have a support case open for it. In the ACC tab it shows the list of top applications, but when you drill down into each specific application the sections for additional information such as "Top Users" and "Top Destinations" show "No matching records" even though the traffic logs exist and are viewable on the Monitor tab.

Other than those two issues, from a functional standpoint 4.0.5 has been pretty stable for us so far.

Re: Any issues with PANOS 4.0.5?

pkruse — Fri, 16 Sep 2011 21:39:18 GMT

With the possible exception of an abacus its a fair statement to say no product is without issues. PAN-OS 4.0.5 has been deployed throughout the world in very large to very small, simple to complex networks, in most cases without issue. Of course this isn't to say that we haven't had reports of problems with this code or any past code, rather to point out that we are a responsive developer and if you do encounter a problem PaloAlto Networks is committed to addressing and resolving these issues in a timely efficient fashion. We are a customer driven company and we welcome any input good, bad or indifferent from our customer base.

~Phil

Re: Any issues with PANOS 4.0.5?

friento — Mon, 19 Sep 2011 19:46:55 GMT

Good to know that's only minor issues. I'm 2 days away from deploying it to our 4050. No testlab so it's production device for me.

Re: Any issues with PANOS 4.0.5?

wayne_webner — Mon, 19 Sep 2011 20:44:19 GMT

issues i faced on a 4020 HA were:

1. firewall could not communicate with the PANAGENTS correctly resulting in our domain name being truncated. This inturn means that specific rules relying on a users to AD group membership resulted in them being denied access ( show user pan-agent user-IDs ). SSL VPN login denied for example.

2. Certain SSL decryption certs had to be re-imported.

3. Few app dependencies warnings appeared out of nowhere but easy enough to fix

4. SSL VPN custom portal page ( web login page ) was lost and had to be re-imported.

i hope this helps.

Re: Any issues with PANOS 4.0.5?

georgemorse — Tue, 20 Sep 2011 02:28:58 GMT

I'm only a few days into my 4.0.5 upgrade, from 3.1.8 and it was a very smooth upgrade. There were just a few small minor issues and from previous posts, it looks like I wasn't alone. I upgraded 3 HA Systems and each had different minor issues, that were easily fixed.

1. SSL-VPN Authentication Profile had to be removed and recreated along with the RAIUS Profile.

2. SSL-VPN Custom Portal page had to be reselected in the configuration page.

3. NetConnect 1.2.0 clients prompted for the Java Certificate Experation even if the clients had previously choosen to always trust the certificate.

4. Several URL Filter rules were detecting an overlap which caused a commit failure. After removing the unchecking the URL catagory that was in the error message the commit succeded.

5. Same ACC problem when drilling down on first day, but seems to be working properly today. Might have just need time to generate the logs, since the active units were changed after the upgrade.

All systems under 3.1.8 had CPU usage 20 to 50% consistantly, but after the upgrade and the CPU usage now run at under 5%.

Re: Any issues with PANOS 4.0.5?

toddinva — Thu, 22 Sep 2011 13:32:09 GMT

Well, we've got a major problem with 4.0.5, which appears to be the same issue we were having with 4.0.4 until we rolled back to 4.0.3. The Dataplane restarts occasionaly for no apparent reason! This causes traffic to stop for about 10 minutes. We were told it was a known bug in 4.0.4 and that it would be fixed in 4.0.5. Apparently not. It's happened twice since Sunday. We are probably going to rollback to 4.0.3 yet again.

Anyone else run across this problem??

Re: Any issues with PANOS 4.0.5?

dbaumann — Thu, 22 Sep 2011 14:22:41 GMT

@toddinva: I've run across the same problem. This started happening in 4.0.3, and continued in 4.0.4. I was told it would be fixed in 4.0.5, but the dataplane keeps crashing about once a day on average.

Re: Any issues with PANOS 4.0.5?

toddinva — Thu, 22 Sep 2011 14:44:50 GMT

Wonderful. 4.0.3 was stable for us though. We've already gotten the issue escalated, but they really need to fix this...

Re: Any issues with PANOS 4.0.5?

mhorne — Fri, 23 Sep 2011 17:45:43 GMT

i am having the same dataplane crashing issue as well. not every day but it is still there, upgraded from 4.0.4 to 4.0.5 and this issue is not resolved.

Currently escalated to engineering. my boxes are 5020's is active-passive mode.

Re: Any issues with PANOS 4.0.5?

tbrockhausen — Thu, 29 Sep 2011 06:54:29 GMT

wr tried to update von Version 3.1.8 to 4.0.5 (4.0.1 was downloaeded before).

The update failed, because the autocommit job failed.(per CLI show jobs processed)

After Reboot, we tried to install 4.0.1. Here was the same failure, autocommit job Failed.

Then we activated 3.1.10 , and everything works.

Now, we wait for the support.

Are there any log.files, which show us the failure .

Re: Any issues with PANOS 4.0.5?

toddinva — Thu, 29 Sep 2011 12:43:08 GMT

They are now telling me a fix will be in 4.0.6 which is due in mid-October. With a bug this significant, you'd think they would have pulled 4.0.4 and 4.0.5 until this was corrected! Very disappointing...

Re: Any issues with PANOS 4.0.5?

mhorne — Thu, 29 Sep 2011 12:50:10 GMT

Same here, Working with engineering on this and disabled zone protection,DDOS and also any block changes in profiles and it's still an issue. I am sure more tech dumps to follow today.

Re: Any issues with PANOS 4.0.5?

mjacobsen — Thu, 29 Sep 2011 13:47:32 GMT

I believe the dataplane must be restarted after removing any profiles with Block IP actions in order to avoid the problem. If you have done that and it is still happening, be sure to mention that to support as it would indicate that the issue might be different than the one being addressed in 4.0.6.

Mike

Re: Any issues with PANOS 4.0.5?

mhorne — Thu, 29 Sep 2011 13:51:03 GMT

Indeed! I got the message last night just to do that right after it had restarted itself. Already updated my case as well with that info.

Re: Any issues with PANOS 4.0.5?

toddinva — Thu, 29 Sep 2011 14:06:59 GMT

This may be a dumb question, but what do you mean by Block IP actions?

Re: Any issues with PANOS 4.0.5?

mhorne — Thu, 29 Sep 2011 14:19:22 GMT

I created a vulnerability protection policy for SSH bruteforce attacks and changed it fromt he default action of alert to block.

That is what was at issue in my case. Hope that helps.

Re: Any issues with PANOS 4.0.5?

mhorne — Thu, 29 Sep 2011 18:33:55 GMT

Ok issue at hand is the problem keeps resyncing across the data plan, you litterally have to make sure that you stop everything hitting the block counters. Enter this on one of your systems 'show counter global | match blk' (no quotes) if you have negative numbers then call support asap!

This is what we did for a active passive 5020 cluster. once we got everything that was triggering the block counter disabled.

disable sync between the FW's passive then the active nodes, reset the passive dataplane, fail over taking a session hit to the passive node, then reset the data plan on the second FW. reenable the HA data sync on the active then the passive nodes.

Verify that the blk is not incrementing any more and hope that stability ensues again.

4.0.6 fixes this issue, then you should be able to enable the blocks again. two weeks is the estimated time from engineering.

BTW Gary! Awesome job getting figuring this out.

Thank and hope it helps

Mike