Application Dependency Warnings even when allowing required apps

[billperp]

Just a heads-up to anyone on 8.1.8. . .

There is a cosmetic bug that throws bogus dependency warnings even when the dependent apps are included in the affected rule.

It will be fixed in 8.1.9 at the end of June, per support.

[reaper]

Did you receive a bugID to track in the release notes?

[billperp · Accepted solution]

Yes. Here's what they said:

1 - Initial Problem Description 
After upgrading to 8.1.8 there are many application dependency warnings although the dependencies are met

- As informed this is a known issue in Software version 8.1.8 matching an existing reported issue (PAN-117729)
- Fix is targeted to be released with PAN-OS 8.1.9 and the current ETA is 6/27/19

Once you Upgrade to Software version 8.1.9 that will resolve the issue. 

[hshawn]

Thank you for this post. Had I not already have been prepaired from reading this I would have had a major panic this morning when the first commit displayed enough application dependancy warnings to see from space

[billperp]

Glad I could save somebody some time on this. I suspected it was a bug, but I had just completed the long path of upgrading sequentially from 7.1.x ==> 8.1x and I thought the config had become corrupted. . .

To be honest, I was surprised I was the first one to post about this since it's such a visible bug that virtually everyone on 8.1.8 would enounter after a commit.

[hshawn]

There have been several bugs that shock me nobody noticed before the release gets out into the wild... in fact there is still one open that drops SANs from certificates renewed on the firewall, I was told that it will not be fixed anytime soon... and then there are things like this one that are so obvious I just have a hard time trying to figure out how that slipped by

[pa5260]

The biggest surprise is that Palo's "PAN-OS Software Release Guidance" page has 8.1.8 as "Preferred release" with no Notes about this issue.

https://live.paloaltonetworks.com/t5/Customer-Resources/Support-PAN-OS-Software-Release-Guidance/ta-...

I have talked to a Palo engineer AND a Palo manager about this very bug and reminded them that the Preferred release page still says 8.1.8 without any update about this bug.

I do not consider this a cosmetic error because it spams me with over 200 false warnings, potentially hiding real warnings!

Yes it needs to be fixed but even more importantly it needs to be updated on the Preferred release page IMMEDIATELY. Palo is aware of the problem today, 6/17/19. They reconfirmed it with my case that was opened by the manager specifically for this reason so... Let's see how long it takes, or IF they care enough about their customers, to update the Preferred release page. They've know about this problem since your original post... a week ago!

[howardtopher]

Crap.  I wish I had seen this or any notice anywhere before about 2 hours ago.  I would have gone to 8.1.7.  I only get one maintenace night a year to do these upgrades and now I'm probably stuck with this mess till next June.

I've already dealt with globalprotect tunnel warnings that IPv6 is ignored (this here), and now this.  My warning list is massive.

I guess I could try and sneak in a 3am upgrade on a holiday when we're closed.  Perhaps July 4th.

[jparry]

It Is also happening on 9.0.3 for me. 

[SoporteITS]

Hi,

We are affected with PANOS 9.0.7 and  9.0.8 too.

Does anyone know if there is an expected fix for this?

Regards.