topic Re: Source Address - Show ipv4 in General Topics

Source Address - Show ipv4

kevin.shain — Thu, 08 Jul 2021 12:26:39 GMT

I just upgraded from a PA 500 to a PA 820 and something is throwing me for a loop. In all of my reports and in the monitoring section under App Scope the firewall is reporting what appears to be ipv6 addresses, they are in the format of: "::678b:540:ffff:0". I'd prefer to see the ipv4 address as it is much simpler to hunt down the offending user, etc. Any way I can disable ipv6 reporting on the PA 820? I am in PAN OS 10.1.

I should mention that the traffic logs are showing the ipv4 address.

Thanks.

Re: Source Address - Show ipv4

LAYER_8 — Thu, 08 Jul 2021 15:59:27 GMT

This is a known issue, PAN-167327 & PAN-167870 are P1 by engineering and resolved in the next release of 10.1.x.

Some of the IPv4 get rendered as IPv6 addresses, and other times the addresses are in hexadecimal opposed to decimal. Important note, this does not affect data plane processing, just rendering on the MGT plane.

Please note at this time 10.1.0 does not have a preferred or recommended status by Palo Alto's TAC (bookmark this page).

Prior to upgrade of software, please review known issues & upgrade considerations, too.

Best shot would be to downgrade to a preferred release like 10.0.6 to get reporting features back to full functionality until 10.1 earns the preferred status.

Re: Source Address - Show ipv4

kevin.shain — Thu, 08 Jul 2021 16:20:27 GMT

Thanks. Not going to downgrade as we are currently in our downtime here (school) so will hope something gets released in 10.1.x that will be preferred status before we start back up.

Re: Source Address - Show ipv4

LAYER_8 — Thu, 08 Jul 2021 17:42:03 GMT

No guarantees here, but, typically this occurs 1-3 months post release. Go-live date was June 4th, so we may be able to sneak something in before schools return 🙂

Re: Source Address - Show ipv4

palokb57 — Wed, 18 Aug 2021 14:29:59 GMT

10.1.2 still not solved 😞

Re: Source Address - Show ipv4

Keith6783 — Fri, 03 Sep 2021 23:50:25 GMT

ver 10.1.2, as was mentioned by @palokb57 has not yet corrected the problem.

An IPv4 address of A.B.C.D will be written backwards, in hex.

Example, the report shows: ::dcdc:43d0:ffff:0

DC = 220, DC 220, 43 = 67, D0=208 and the tail of :ffff:0 we can toss.

Those octets of the IP are flipped, so the actual IP address in the report is:

208.67.220.220

Re: Source Address - Show ipv4

LAYER_8 — Tue, 07 Sep 2021 15:32:44 GMT

I'm not seeing any current JIRA tickets open for the same issues, perhaps escalate to your account team to see if your territory SE possess alternative guidance. Please note at this time, PAN-OS 10.1.x is still not TAC preferred.

Re: Source Address - Show ipv4

palokb57 — Tue, 14 Sep 2021 08:53:18 GMT

Hi Slick, I dont' get your "JIRA tickets open..." It's just annoying

Re: Source Address - Show ipv4

LAYER_8 — Wed, 15 Sep 2021 16:15:14 GMT

I work at Palo and am relaying that our engineering team (JIRA) doesn't have tickets open on this issue at this time. Which likely means it is resolved in a maintenance release of 10.1.x, I just am unable to see which.

Re: Source Address - Show ipv4

palokb57 — Wed, 03 Nov 2021 08:08:55 GMT

I am very disappointed that even in new version10.1.3 IP v6 addresses are still displayed instead of IP v4. Why is something so essential simply ignored for months? Am I in the wrong place with my complaint?

Re: Source Address - Show ipv4

LAYER_8 — Thu, 04 Nov 2021 20:12:00 GMT

Best avenue to pursue is syncing with your account SE and seeing if you can't get a session with product management, both to ensure your complaint is delivered as unaltered as possible, and to hear their response likewise.

Re: Source Address - Show ipv4

Artemiusm — Tue, 09 Nov 2021 02:10:35 GMT

Man I fully accept with you, so much time we have a trouble with this. Why i updated to 10.X my biggest mistake. Already on 10.1.3 and with this issue.

Re: Source Address - Show ipv4

tjwilliams — Tue, 09 Nov 2021 17:45:31 GMT

PA-820, 10.1.3, problem still exists. Was really excited to see this marked as "fixed" in 10.1.3. notes. Imagine my surprise...(or maybe 800 does not mean 800 series, even though 7000 is marked as "series" 🤔)

Re: Source Address - Show ipv4

Craig5 — Fri, 12 Nov 2021 05:50:03 GMT

PAN-175149 Fix it already. 10.1.3 and the erroneous addresses still exist.

Re: Source Address - Show ipv4

Craig5 — Tue, 21 Dec 2021 07:06:22 GMT

10.1.3 is listed as a preferred release with this bug in it. How is this not a bigger deal than just for a handful of us? Nobody generates reports or uses ACC?

Re: Source Address - Show ipv4

mattbro — Sat, 26 Feb 2022 18:11:10 GMT

I am on 10.1.4 and the same issue is still present. Finding this thread required quite a bit of google magic though. I suspect a lot of people are scratching their heads and manually converting hex formatted IPs to decimal. Come on Palo Alto!

Re: Source Address - Show ipv4

palokb57 — Sun, 27 Feb 2022 10:57:59 GMT

I will not buy the software subscription renewals due in spring 2023 and will recommend another product to my customers.Palo Alto Networks has become too arrogant for me, ignoring a simple problem for months is pathetic.

Re: Source Address - Show ipv4

Craig5 — Mon, 28 Feb 2022 17:10:50 GMT

Support was useless troubleshooting the issue because it's on the development side. Issue is still present in 10.1.4-h4, so I'm rolling back to 10.0. We have too many PA220's to deal with 10.1 and it's bugs in claimed stable releases.

Further, we renewed licensing and PAN-DB URL license was expired because it was changed to Advanced URL Filtering. Thus creating a situation that we had no active URL Filtering. Maybe this is just another 10.1 PA220 bug. You have to delete the old PAN-DB URL license key(s) .

$ delete license key ?

Then select the license key, finally you'll need to run $ request license info

Re: Source Address - Show ipv4

mattbro — Wed, 02 Mar 2022 17:54:07 GMT

Good news: the problem seems to be fixed in 10.2. IPv4 addresses are properly displayed and often resolved to hostnames.

Re: Source Address - Show ipv4

tjwilliams — Thu, 03 Mar 2022 15:17:34 GMT

Thanks for the heads up about 10.2! I'll wait and see how it pans out for right now. Learned a valuable lesson with 10.1.

Had exact same problem with URL filtering license. Took TAC a while to figure out how it should be resolved.