topic Re: Shadow Rule Warning after upgrade in General Topics

Shadow Rule Warning after upgrade

AndreaHuszka — Tue, 16 Jun 2020 09:24:06 GMT

Hi All,

We have a customer who has upgraded to 9.0 and they get shadow rule warnings since the upgrade.

All the shadowing rules are more generic with any/any for source and destination, but with source user restrictions.

The shadowed rules have more specific source/destination values.

Traffic is hitting the shadowed rules.

The same rules weren't triggering any warnings under 8.1

Has anyone experienced a similar issue?

Thanks,

Andrea

k-lesne — Tue, 16 Jun 2020 14:00:24 GMT

Hello,

Yes, I have the same thing with upgrade in 9.0.8 (from 8.1.x) but I haven't created a case yet

(For example: src.user ignored)

Retired Member — Tue, 30 Jun 2020 09:29:23 GMT

any update on this ?

Thanks

AndreaHuszka — Tue, 30 Jun 2020 13:41:22 GMT

It appears to be a bug, a fix is targeted for 9.0.11 and 9.1.5

TStiteler — Wed, 01 Jul 2020 15:28:26 GMT

Do you have a reference for this being noted for 9.0.11? Been doing some digging and not finding anything calling this out.

Thanks!

HonoAl — Tue, 09 Mar 2021 12:58:21 GMT

Do we have the bug ID provided by Palo Alto TAC for this issue? Ta.

laurence64 — Tue, 09 Mar 2021 14:07:22 GMT

PAN-137663

Fixed a cosmetic issue where misleading App-ID and rule shadowing warnings populated after a commit.

Fixed in 9.0.11 hopefully this is the one.