Discussion on most stable PAN-OS image as of July 2016

[rpugh1]

I am going through some cleanup of our PAN firewalls. We have 8 sites with active/standby pairs of PAN's. The sites are connected with IPSEC VPN's. The code varies from 6.0.3 to 7.0.4 versions.

What's your feeling on the most stable 7.X code as of now?  

Requirements:

1. I want to get to the newer/later code for encryption enhancements (Suite B algortihms).

2. I'm mostly trying to level set and get everything ont he same version.

3. If there are any great new features that you want to plug int he 7.0.x or 7.1.x code, would like to hear it.

As of now, I am leaning towards 7.0.8 PAN-OS as it is my habit to stay just a bit back of the bleeding edge.

[OtakarKlier]

Bump

I am especailly interested to hear from those who have gone to 7.1.3.

Regards,

[workarounds]

Running couple of 5060 with Active/passive and vsys enabled on 7.0.7 and 7.0.8, so far no compliants yet..    

[Gertjan-HFG]

We are running some small sites with version 7.1.3 and no issues.

I am considering to upgrade 1 primary site to 7.1.3 but only for 1 improvement:

Better SSL decryption PFS cipher support

(Primary sites on 7.0.8 now)

[mlinsemier]

My expereince has been the same as @Gertjan-HFG as we are identically doing the same thing.  7.0.8 on across the board, 7.1.3 Panorama with some testing of 7.1.3.  No issues with 7.1.3, either Panorama or PAN-OS, that I have ran into yet.

Matt

[michelealbrigo]

I'm running two HA pairs, 2x3020 and 2x5050. The 3020s are running 7.1.3 with no issues. I've tested it on the 5050s, got 3 restarts in a few hours. Downgraded to 7.0.8 (which looks very stable, aside from a bug in the software manager(*)) and opened a ticket. Picture of system logs attached.

(*) 7.0.8 does not allow me to upgrade to 7.1.x versions directly, it complains that a "base" 7.1 version is not downloaded on the system, while 7.1.0 is present and loaded in the software manager. Had to take the 7.0.8->7.1.0->7.1.3 route to upgrade on thee 5050s. Opened a ticket.

[bbilut]

I have two sets of firewalls 5060 & 5050's and I'm currently running 7.0.7 and planning to go to 7.0.9 when it comes out 8/1. I've been discussing going to 7.1.5 when it comes out, but support still has not given the 7.1.x branch the official blessing. I currently have no issues on 7.0.7, it's been very stable.

[nextgenhappines]

We are having issue with userid group-mapping stop refreshing with vsys enabled 5060 running 7.0.7 and above.   Restart the useridd process will fix it in the short term, but some of the vsys will stop refreshing the group-mapping in less than 24 hours.  Also, after restart the useridd process, some of the vsys are no longer able to connect to the userid agents.  We end up need to fail over the firewall to restore service.   

The group-mapping refresh issue is fixed in 7.1.4, there is no word from TAC about backport to 7.0 yet.

E