topic Re: Firewall Region bug in General Topics

Firewall Region bug

RyanJohnstone — Fri, 06 Sep 2019 10:41:46 GMT

Hello,

we are experiencing the bug as per the link below

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClicCAC

can anyone advise if this has been resolved in release 7.1.x code and if so in what release?

Thanks

Ryan

Re: Firewall Region bug

reaper — Tue, 10 Sep 2019 20:50:56 GMT

hi Ryan

Did you follow the workaround to fix the issue?

This bug is pretty old, so old in fact it is not tracked for any of the current releases (so i'm pretty sure it's fixed in al currently supported OS releases

If you intend to upgrade, I'd recommend going to the last available maintenance release for 7.1 and then plan to move to 8.1 as 7.1 is set to reach end of life in march 2020 (8.0 is set to end-of-life by November 1st 2019)

Re: Firewall Region bug

OtakarKlier — Wed, 11 Sep 2019 16:27:37 GMT

Hello,

If what Reaper is not working for you. Open a ticket with the evidence so that the dev team can update the lists. They use Arin results, but IP subnets are geting bought and sold and sometime vendors are a bit behind. I had an issue where an ISP in Texas was using Canadian IP's that they purchased. So my user was not able to get to any of our services, we block Canada.

Regards,

Re: Firewall Region bug

reaper — Wed, 11 Sep 2019 17:58:02 GMT

@otakar The issue described in the article happens when you create a custom region using one of the built-in names for a region, and then deleting that custom region This locks the region in the idmgr as a custom one even though the custom one was deleted intimated of reverting to the built in (ie creating a custom "BE" region, then deleting that after a while causes the built-in BE to not pick up the iana/ripe/... ip space until you reset the idmgr) :::commit between each step is required::: :::this report is very very (4.1) old:::