OpenConfig automatically installed with 10.2.11-hx upgrade

[1treelanedrv]

We installed 10.2.11-h6 on a pair of virtual firewalls and the OpenConfig plugin was automatically installed and a new Device Administrator user called __OpenConfig was added. Is this documented anywhere? I can't find it. 

And why do I need this plugin? 

[1treelanedrv]

The version is openconfig-2.0.2 with release date "Built-in". 

There's 141 possible plugins with 10.2.11. 

On my other pair running 10.2.9, there are only 4 available plug-ins. 

DLP and VM_Series being the only other 2 that are installed. 

So, yes it appears to be auto-installed with the 10.2.11 update, but I don't see documentation explaining this. Hope that helps someone. 

[1treelanedrv]

All that is said in OpenConfig 2.0.2 is "10.2.11 is now supported". 

https://docs.paloaltonetworks.com/plugins/vm-series-and-panorama-plugins-release-notes/pan-os-openco...

How about this list of CVEs that are fixed in 2.1.0. 

https://docs.paloaltonetworks.com/plugins/vm-series-and-panorama-plugins-release-notes/pan-os-openco...

[1treelanedrv]

TAC gave me this answer and article. Hopefully my follow up questions will help them add context to the article. 

"This is an expected behavior and it will not cause any impact on the firewall performance."

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000010yx8CAA

And here is the OpenConfig Admin Guide. 

https://docs.paloaltonetworks.com/openconfig/2-0/openconfig-admin/getting-started

"Using the plugin, you can manage configuration, generate streaming telemetry, and carry out operational services on the firewall. The OpenConfig plugin is supported on the hardware, VM-Series firewalls, and Panorama."

"The gMNI protocol uses a client-server messaging model. The OpenConfig plugin implements a gNMI server that listens for client requests and supports all of the gNMI request types: Set, Get, Subscribe, and Capabilities. The Set request carries out transaction based edit operations whether it be single or multiple requests."

"The PAN-OS OpenConfig plugin listens for requests on the management interface’s assigned IP address on port 9339."

If you remove the plug-in, also remove the user account.