Content 596 Update - Seeking more details on customer reported problems

[btrotter]

Can anyone provide details on some of the problems that were experienced after applying content update 596?

We spent all night troubleshooting a problem where our PA3020 was impacting TCP\9100 traffic. The problem started soon after the update. We would see the TCP handshake between a print server and printer occur, some data would be sent, then we would see TCP retransmissions, long delays in responding to ACK's and a TCP reset from the printer.

It stopped when we bypassed the PA.

I am curious if this could be related to the recalled content update.

[mst]

strongly agree with btrotter: give us some explanation, plz. 🙂

yesterday we had nearly 100% cpu load on useridd process on one cluster's member and 197% 😮 on second member. i restarted useridd daemon and evertyhing gone to the normal state.

probably it is not connected but it would be nice to know what is wrong with 596.

regards 🙂

[BPry]

It would be nice if they provided a little insight to what was actually happening with 596 as our 3020 was all ready to install it before the update was pulled; thankfully it only installs on Wednesdays at 1am or if I really want to force it because of a false positive. 

This update with the SMB fix was soemthing I was really looking forward to as well, since that broke some things for us earlier and I've had to just exlude the vulnerabilty ID for a specific user group. 

[BPry]

"This issue was caused by a PAN-OS bug in 7.1.x, that was triggered by the introduction of an IPS signature in this content update. The bug impacts traffic processing and application identification on firewalls running PAN-OS 7.1.x"

This was the information that I was able to find. It seems like in the past month I've ran into more problems with threat signatures then what I thought was possible. It would be nice if Palo just set these to alert instead of reset-both if they were unsure if they were actually going to work. I would rather have something that was only alerting me to an issue instead of something was was breaking connections. 

[OtakarKlier]

Hello,

I know its a bit late, but I have my PAN's set to dynamically update daily with a threshold. This way I might be only a day behind, but protects against these types of releasese.

Regards,

[btrotter]

While working with a PA engineer today, we got the following response. I am not sure this is an official response or an engineer giving his thoughts on it.

"App update 596 was causing issues with Layer 7 processing, application decoding, and the application engine.  Any problems at Layer 7 (application layer) could cause alterations to the application data being passed, such as the truncated packets we were seeing.  The bug could impact any application. "