topic System alerts in General Topics

System alerts

Joshan_Lakhani — Sun, 16 Aug 2020 10:19:58 GMT

Hello Team,

I am getting system alerts in my firewall below is the error:-

PAN OS - 9.0.6

Disabled applications in vsys1: cip-ethernet-ip-disable-io cip-ethernet-ip-disable-sfc cip-ethernet-ip-enable-io cip-ethernet-ip-enable-sfc cip-ethernet-ip-read-mod-write cip-ethernet-ip-read-tag cip-ethernet-ip-read-tag-frag cip-ethernet-ip-run cip-ethernet-ip-stop cip-ethernet-ip-test-mode cip-ethernet-ip-write-tag cip-ethernet-ip-write-tag-frag dingtalk-file-transfer jandi pfcp philips-ecg retrospect-backup siemens-s7-comm-plus-download siemens-s7-comm-plus-upload.

NOTE: I have checked the all application are disable in Application DB

Below is the current Version for Content ID

Application Version	8305-6248 (08/14/20)
Threat Version	8305-6248 (08/14/20)
Antivirus Version	3441-3952 (08/15/20)

Could you please give any suggestion on this.

Re: System alerts

MP18 — Sun, 16 Aug 2020 17:24:24 GMT

@Joshan_Lakhani

To fix this you need to go to Device,Log Setting, System

Create a filter for example

(severity eq high) and (eventid neq Disabled apps)

not ( description contains 'Disabled applications')

It is your log forwarding profile which is sending you the system alerts.

Regards

Re: System alerts

Joshan_Lakhani — Sun, 16 Aug 2020 19:15:04 GMT

@MP18

I didnt configure the log forwarding , it is showing alerts in systems
Any issue if i ignore this or i need to take some action.
Please suggest.

Re: System alerts

MP18 — Sun, 16 Aug 2020 19:19:39 GMT

You can ignore this these alerts.

Re: System alerts

BPry — Mon, 17 Aug 2020 03:19:17 GMT

@Joshan_Lakhani,

Whoever setup your firewall has them setup so that the new app-ids are disabled when you download a new content update. While this can prevent issues rising from new app-ids being identified, it's something that you would eventually want to bring in so that your firewall can identify all of the new applications PAN has added.

So while these alerts can be ignored, I would definitely make the new signatures active in your next maintenance window and simply verify that the new applications don't cause any issues in your current rulebase.