Anyone have issues with 10.0.6

[RobertShawver]

Just kind of a broad general question, but has anyone had any issues going from 9.1.x to 10.0.x in a large environment? Or would the preferred 9.1.x version be the way to go?

[bafergel]

We've been testing 10.0.x and 10.1.x on our Panorama units and on our test firewalls. Unless you need a feature that 10.x offers, like IOT security or DLP, then there isn't much of a point. We've also had some issues with the logs loading correctly, sometimes it displays just random logs that are not the most recent. There was also a bug that caused the Panorama config export to fail and was just recently fixed on 10.1.2. We're also running a bunch of 220 firewalls which the management plane is noticeably slower on 10.x.

We're just going to downgrade Panorama back to 9.1.x and stick on that code train for a while. 

[OtakarKlier]

Hello,

We are running 10.0.6 and the only issue we ran into was if you have more than one DNS entry in a security policy, some of the traffic may not match correctly and get dropped. Luckily it was only on one policy internally and we just swapped the dns entries with IP's.

Regards,

[BPry]

@RobertShawver,

How critical is your environment, and how tolerable is your environment to disruption?

10.0.6 has become the default image across all of my environments, and its stable enough that I don't have any qualms recommending its deployment to the vast majority of environments. In critical environments or those that are intolerable to any outages I'm still recommending 9.1. 

[S.Cantwell]

There are 75 new features in the 10.x software, all designed to improve your security stance within your company. 

[RobertShawver]

Hey Gang -

Really appreciate the feedback.  Upon further review I think I'll stick with the 9.1.X line until 10.1.x has a "preferred" version.  As it stands right now 10.0.x has an EoL date of July 16, 2022, while 9.1.x has an EoL a full six months later of December 13, 2023.

[LAYER_8]

For many of my customer environments I agree 10.0.6 is stable enough to recommend. The inline ML for URL and WF are good enough reasons by themselves, but I agree the 220s are hurt somewhat by the real time data. Many of my larger customers run 10.0 on perimeter and keep 9.1 on east-west for the time being. 

10.1.x we may still be a few weeks/months out from preferred.