8.0.14 How is it for you?

[OtakarKlier]

Hello Community,

Is anyone already running the new version and did you run into any issues after the upgrade?

Thanks in advance!

[Remo]

Hi @OtakarKlier

So far I have it on 3 internetfirewallclusters (PA-5220, PA-5050, PA-3020) installed. These firewalls have TLS decryption, wildfire, antivirus scanning, vulnerability protection, anti spyware, fileblocking and URL filtering enabled.

So far without any issues. (On the PA-5220 cluster 8.0.14 is now installed 7 days)

Regards,

Remo

[BPry]

@Remo,

I've moved two pairs of PA-3020s and haven't had any issue; while the PA-220s also work flawlessly I did run into an issue while upgrading one of my PA-200s, but the other ones upgraded just fine so I don't think this had anything to do with the software version. 

[hshawn]

I think we will step up to 8.0.14 next year before going to 8.1.4 but we are so happy with 8.0.12 it has been the best performance and stability we have seen in almost two years (105 days of uptime and no disk space issues, no memory leaks causing midnight alerts and only one failover which may or may not have been firewall related) Hoping 8.0.14 is just as or more stable for us

[TerjeLundbo]

I upgraded our firewalls (two PA-5050 in active/passive HA) to 8.0.14 yesterday morning, and 24 hours later the active firewall rebooted with the following message:

opaque: useridd: restarts exhausted, rebooting system

I've opened a TAC case, will let you know how it ends.

[OtakarKlier]

Thank you all for your thoughts. I think we will prceed and I will report how it goes. I do have many different models and some in HA.

[Alex_Samad]

---

@hshawn wrote:

I think we will step up to 8.0.14 next year before going to 8.1.4 but we are so happy with 8.0.12 it has been the best performance and stability we have seen in almost two years (105 days of uptime and no disk space issues, no memory leaks causing midnight alerts and only one failover which may or may not have been firewall related) Hoping 8.0.14 is just as or more stable for us

---

Interesting I just had to clear my logs on my 5220 because I kept getting alarms my log levels where above the amount.

8.0.12 ... apart from that its been rather good

[TerjeLundbo]

Our problem was related to syslog parsing. We send syslog from our Aruba WLAN controllers to the firewall in order to create IP-user mappings. There is a bug in 8.0.14 that will reboot the firewall if the load goes over a certain level and you use syslog parsing. From TAC:

I have revised the tech support file and it looks like we are hitting an issue.
There is available workaround for this it is to change syslog profile to use regex expression instead of field identifier under:
Device>User Identification>Palo Alto Networks User-ID Agent Setup>Syslog Filters.

This is fixed in 8.1.4, but unfortunately PA will not release the same fix for 8.0.x

We bypassed it by redirecting the syslog traffic to a Windows server running the user-id agent.

[OtakarKlier]

Thank you all for your input. We went ahead with the upgrade and everything is stable so far. I'll update this post if I run into anything out of hte ordinary.

[CSavoy]

To Terjelundbo,

Would it be possible to get your TAC ticket number or the bug reference please ?

I'm facing the same issue with version 8.0.15 and would like further information about the workarounds.

Thanks in advance and best regards,

Christophe

[TerjeLundbo]

I did not get a TAC ticket number at the time, since we use partner support. It might be this bug that was fixed in 8.1.3:

PAN-98530 Fixed a memory leak associated with the logrcvr process when using custom syslog filters in a syslog profile.