Is PANOS 8.1.3 really functionnal on PA-3250 ?

L1 Bithead

Is PANOS 8.1.3 really functionnal on PA-3250 ?

Hi all,

 

We migrated 2 weeks ago from a PA-3020 to a PA-3250.

 

We upgrated the PA-3020 from PanOS 7.1.19 to 8.1.3 and then we exported the configuration and then imported it into the PA-3250 (that was already in PANOS 8.1.3)


Since this migration we faced to different issues we never encountered using the PA-3020.

The most important of them is that a significative part of http, ftp, smtp (and maybe other traffic) is often recognized as "unkonwn-tcp"

The result is that all security policies based on applications are not working as expected. 20 percent of the sessions (yes 20% !) are not well recognized and are dropped because they didn't match to a security rule.

 

To avoid a blackout of our production, we had to insert more permissives and "old fashion" rules based on adresses and port to allow this traffic.

 

A case is alsoe currently open to the support, but it does not seems to really progress...

 

Does anyone using PanOS 8.1.3 on PA-3250 hardware ?

And if yes, did you faced to similar issues ?

 

Here is a graph of one day unknown-tcp sessions :

unknown-tcp.png 

 

Regards,

L5 Sessionator

Re: Is PANOS 8.1.3 really functionnal on PA-3250 ?

Hi @Infra_DKI


We faced these exact same issues going from PA-5000 series to PA-3260s - huge increase in unknown-tcp which was impacting business. For us, the fix was actually to reboot the firewalls and the problem hasn't occurred since we rebooted (1 or so weeks ago)

 

We also faced an internal path monitoring failure twice which caused dataplane restarts. TAC stated this was fixed in PAN-OS 8.1.4 with Bug-ID PAN-101182

 

Cheers,

Luke.

L1 Bithead

Re: Is PANOS 8.1.3 really functionnal on PA-3250 ?

This feedback is interresting. 

We faced this issue since the migration to this firewall 2 weeks ago.

I will plan a restart to see what happens...

Highlighted
L1 Bithead

Re: Is PANOS 8.1.3 really functionnal on PA-3250 ?

I rebooted the firewall this morning and I have no more abnormal unknown-tcp sessions after 8:30

 

Capture.JPG

 

I will check it in nexts days to see if that occurs again.

Very strange...

L1 Bithead

Re: Is PANOS 8.1.3 really functionnal on PA-3250 ?

The problem seems to be gone since the reboot.

That's very strange. We have to be very carefull to be sure that it will not happen again in the future...

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!