AD trouble after installing content version 729

[TerjeLundbo]

We had problems with AD after installing content version 729 this morning. Users were authenticated, but the logon process (group policy, drive mapping) was painfully slow. After we reverted to version 727 everything was OK again. The strange thing is that I see no traffic to our AD controllers being stopped by the firewall.

Anybody else seen this? We're using two PA-5050 in HA (active/passive) running PAN-OS 7.1.10.

[Gun-Slinger]

We had issues associated with HL7 traffic. We have completed a roll back and that resolved the issue.

[niuk]

Was it seen in Monitor/Traffic or Threats , like drops anything ?

[BrianGittens]

We also had this problem and committed an Any on the Service for AD to work. We were about to test what the issue was when we saw the PA  update on  729. We are reverting to 727 and deleted 729.

Written by Edward Millington

[mivaldi]

Please refer to the following Palo Alto Networks Customer Advisory available at:

https://live.paloaltonetworks.com/t5/Customer-Advisories/Important-information-regarding-Content-App...

[ajr0]

---

@cdp181 wrote:

Our Palo partner suggested a 72 hour delay on content updates.  Interestingly you don't seem to be able to configure a delay in Panorama only on the devices themselves.

---

FYI on panorama 7.x.x and above I think this option is available. It may be available prior to that release but I cannot confirm,.

[DavidNestler]

We're running several pairs of PA-3050's in A/P on 7.1.11 with no issues reported at 729. We've reverted to 727 just to be safe. 

[ttsws]

We had trouble with SAP printing but only with destination printers using Kyocera Prescribe

The packet trace shows retransmit because of a missing ACK, but I didn't have time to dig deeper.

All the other problems didn't seem to hit us, alt least not to a degree where the complaints made it to me.

[emilling]

We will send PA out Techsupport file. Our traffic was low to cause any issues with buffers, but any info to help them will be sent.

[gbprotect]

Can anyone confirm that issues are with 729 only? We have firewalls on 728 and have not had any reported issues.

[decoyjim]

We were affected as well.  AD traffic, gpupdates, Apple/Linux authentication with AD were all slow and/or not working.  Reverting back to 727 fixed the issue.

[skiffsumner]

We had major performance issue on our extranet web servers. We reverted back from 729 and issue resolved itself.

PA-500 in HA running 7.1.10

PA-3020 in HA running 7.1.10

[dharle]

External users attempting to connect to applications through GlobalProtect with 5060 HA pair were not able to connect. Reverting to 727 resolved the issue.

[mcneil]

---

@gbprotect wrote:

Can anyone confirm that issues are with 729 only? We have firewalls on 728 and have not had any reported issues.

---

728 works okay.  We had issues with active directory communcation (presumably LDAP) on 729.  Reverting to 728 resolved the issues.

[yan]

we have 3050 HA pair active/active, a  bunch of 3020 and some 500 and 200, all running OS 7.18, using threat 729

no user complaints so far

[Curt_Wilson]

We had been experiencing AJP (TCP 8009) issues between our Web servers and JBoss servers all morning.  Reverting to 727 fixed our issues.