Experience with PANOS 6 so far ?

[gafrol]

I installed PANOS 6 on our Lab Box. Upgraded from 5.0.9. No problems so far.

Anyone else ?

[Oleksandr]

I installed PANOS 6...have some issue with ftp (known bug)

[JosueFernando]

You need update the content version first, and after this you should have no problems for update at version 6.0.0

[sbjornstad]

Got the same problem. Upgrade from 5.10 to 6.1 !

User ID do not match with "included user groups" and all traffic is denied.

[cstancill]

Try and rebuild the userinfo.xml file using the following commands:

> debug user-id clear group all

> debug user-id reset group-mapping all

> debug user-id reset user-id-manager type user-group

> configure

# commit force

This will force the firewall to rebuild the userid.xml file based on a refresh from the LDAP server. If this doesn't work, give support a call so that we can take a look.

[Hithead]

Hi guys,

also have problems with the user groups. any solution?

[sbjornstad]

Not yet

[Hithead]

is the problem already reported to PaloAlto Support?

[sbjornstad]

Dont think so. Havent found any article about it !

[Hithead]

Just created a ticket...lets wait.

[sbjornstad]

Great

[Me]

Try this as a work around until the bug is fixed:

Under Device > User Identification >Group Mapping Settings > Group Include List > Included Groups

If you have groups here, delete them all.

Commit and refresh/reset group mapping if needed.

[Hithead]

Had a remote session with PaloAlto Support.

They found out, that there is a problem/bug with the translation of the group names : Policy was entered the name "Domain\Group name" but the mapping has just the "cn= .... " format.

To "solve" the problem temporary, use the cn=.... format in the Policies.

A bug fix is the development.

[JosueFernando]

check this link, other users experiment a data plane crashing in version 6.0.3

HA broken after upgrading to 6.0.3

[hvcomputech]

what known bug is this?

[mharding]

What I found during our update was the PAN-OS 6.0 upgrade was treating the groups like users. Once I went through an deleted the old group and re-added them I found the the configuration line was referencing the entire LDAP search string.

We didn't have that many groups in policy so it only took an hour or so to fix.