Apps & Threats version 8434-6840 fails to install

[ShaiW]

Hi 

I've had 2 separate NGFW's fail to install Apps & Threats DB version 8434-6840 with this message:

• Error: Application group 'Wifi_Allowed_Apps' member 'visual-studio-live-share-direct' does not exist
• Error: This content install has failed because app 'visual-studio-live-share-direct' has been removed in content version 8434-6840. To successfully install content version 8434-6840 please remove app 'visual-studio-live-share-direct' from any security policy where it is configured.
• Error: Failed to parse security policy
• (Module: device)
• Commit failed

However the listed App is not in use and is not in the database even. I did narrow this down to the app container ms-office365 - If I remove it from my policy I can install the apps DB update, if I add it again, commit fails. If I roll back to 8433 it works fine again.

Anyone got more info about this and how to fix this?

Thanks,

[BPry]

@ShaiW,

I'm actually surprised to see the update still published since this was identified almost immediately upon its release on Friday. If you're using the ms-office365 container in your security rulebase I would just hang out and wait for an updated release or for PAN to actually pull 8434.

[BPry · Accepted solution]

@ShaiW,

PAN has released a new content update that addresses the visual-studio-live-share issue. Testing on my LAB equipment verifies that the patch is working. 

• With this content update, we addressed issues related to the visual-studio-live-share App-ID and the ms-office365 App-ID container that some customers experienced after updating to content release version 8434 (see this page for the details).

[ShaiW]

Thank you @BPry  this explains why only 2 out of 5 NGFW had this issue.

Shai

[anazer]

Shai,

The issue happens if you have the ms-office365 application referenced in your security policy.

visual-studio-live-share-direct comes under ms-office365

-Nasi. 

[ShaiW]

Thanks, I know that. I had to revert to an older apps DB because I could not remove the ms-office365 app container.