application ver 390

[panos]

Hi,

We informed that 390 was released but I could not find it on dynamic updates.Any problem with that version ?

we had some ssl problem but I don't know if it is related to that or not

[harshanatarajan · Accepted solution]

Yes, there is some issue with the version 390. Engineering is currently working on it. Issue is that the SSL sites are being categorized as "private-ip-addresses" after upgrading the content to version 390.

[HULK]

Hi Panos,

You are right, There is an issue with content version 390. That is why content 390 has been revoked.

BUG opened as - Content 390 SSL sessions generating invalid URL filtering host entries.

Issue reported as:-  "SSL sites are being categorized as 'private-ip-addresses' after upgrading content to version 390". Only IE8 seems to be affected.... Chrome, Firefox and IE9 seem to be not be affected.

Hope this helps.

Thanks

[harshanatarajan]

As of now, workaround would be to revert to content version 389 or do not block 'private-ip-address' category. 

[panos]

Thanks for updates.

Now resolved the issue with reverting.Thanks for help.

[HULK]

Hi Panos,

One recommendation for you you:  Please remove the schedule "download and install" option /change it to download only ( If you have set download and install set to your PAN firewall.)

So it looks like  the 390 content is still available for download , if it has been once downloaded by a firewall previously .  Because content 390 is still available on support.paloaltonetworks.com.

Engineering is still working on it and i will keep you updated for the same.

Thanks

[panos]

Hi,

Thanks for update and help.

Regards.

[mikand]

*mumbles something about what happend to quality assurance*...

[HITSSEC]

We saw about 500,000 log entries with a URL value of %16%03%01/  resulting in them being categorized as Private IP Address.  Caused some problems where URL filtering policies were more explicit.  Disappeared when we reverted to ver 389.  Put in a case and the content was pulled shortly.  Made the URL logs useless for troubleshooting or reporting.

Phil