AD trouble after installing content version 729

[TerjeLundbo]

We had problems with AD after installing content version 729 this morning. Users were authenticated, but the logon process (group policy, drive mapping) was painfully slow. After we reverted to version 727 everything was OK again. The strange thing is that I see no traffic to our AD controllers being stopped by the firewall.

Anybody else seen this? We're using two PA-5050 in HA (active/passive) running PAN-OS 7.1.10.

[j.bronson]

I have not had problems with 729 so I'm not going to uninstall it. I'll just let it naturally expire when the next Applications and Threats is released, unless some problem I don't see now arises. Maybe we've not had problems because we don't have a firewall boundary between AD and our users or applications. Thusly, AD traffic does not ingress or egress on the Palo Alto. We have PA-3020's.

[ejorgensen]

We also had AD authentication issues from web applications traversing the firewall.  Reverting to 727 fixed the issue.

[ejorgensen]

---

@ajr0 wrote:

---

---

FYI on panorama 7.x.x and above I think this option is available. It may be available prior to that release but I cannot confirm,.

---

This features is described in (at least) 6.1 and 7.1 documentation:

"In rare instances, errors in content updates may be found. For this reason, you may want to delay installing new updates until they have been released for a certain number of hours. You can specify how long after a release to wait before performing a content update by entering the number of hours to wait in the Threshold (Hours) field."

[CollinMacmillan]

In created serious issues for our RDS clusters as well, resulting in Error 802 issues. Rolling-back to 727 restored our RDS services.

[c_luck]

Just so you know, the Threshold feature that is available on the firewalls is NOT available on the scheduled content update jobs that are pushed from Panorama.  I checked all the way up to 8.0.4 and the threshold option is not available.

[Creval]

Three of your customers ;-).

Rolled back to 727...

[mivaldi]

Please review this article before deciding to implement a Threshold setting.

https://live.paloaltonetworks.com/t5/Management-Articles/Dynamic-updates-scheduled-with-a-threshold-...

[ithorolfsson]

This update affected various applications here.  Oracle, FTP etc.

Everything started working again after downgrading.

[Frederico]

Hello guys,

Here we are facing a problem with a process in 100% (pan_task process), someone with the same issue?

Only in PA-200 - pan_task process 100% after 729 update

[JustinWalker]

Was there any way to view this issue from the monitoring logs or any kind of debugging?   

[bruce.lenhart]

We saw logs in 'Data Filtering' relating to the application that broke for us - sawthat ms-ds-smbv2 was being flagged and even though it is set to alert only, traffic was broken. Looks as if the firewall is fragmenting a packet and this disrupts the connection and we get retransmits/resets immediately after on our captures of broken traffic.

[gwesson]

@Frederico said:

> Here we are facing a problem with a process in 100% (pan_task process), someone with the same issue?

>

> Only in PA-200 - pan_task process 100% after 729 update

The pan_task process should always be at or close to 100%, even when there's no traffic passing. You only see it on the 200 in the "show system resources" output because there is not a separate dataplane like on other platforms. You can view the same data on other systems by looking in the dp-monitor.log file if you wanted to confirm.

Depending on the platform, it's one of:

less dp-log dp-monitor.log
less dp0-log dp-monitor.log
less s2dp0-log dp-monitor.log

[DSteuerman]

This was also affected any new Cisco VPN home phone that connected to the concentrator but was unable to register. Once we reverted back to version 727 it started to work again.

[cdp181]

---

@ejorgensen wrote:

---

@ajr0 wrote:

---

---

FYI on panorama 7.x.x and above I think this option is available. It may be available prior to that release but I cannot confirm,.

---

This features is described in (at least) 6.1 and 7.1 documentation:

"In rare instances, errors in content updates may be found. For this reason, you may want to delay installing new updates until they have been released for a certain number of hours. You can specify how long after a release to wait before performing a content update by entering the number of hours to wait in the Threshold (Hours) field."

---

For firewalls I see the option to delay but not for scheduled updates from Panorama.  This is 7.1.6 :-

[j.bronson]

I take my last post back.  I found an affected application with extremely slow performance, and I rolled back the Applications and Threats to 728 and volia, it works normally now.  I have no idea why, as none of the traffic for the application should be crossing a firewall boundary.  I would have done some packet captures if I wasn't busy with 10 other things.  But at any rate count us in as another affected customer.