Palo Alto updates mails

[soporteseguridad]

Hi,

My customer recently had problems with Palo alto apps&threats updates. They had SMB connections being allowed but with the last content update these connections were cataloged like "SMB brute force" and connectios were dropped. 

The best way would be to install manually these apps&threats updates, right?? 

We receive the palo alto updates mails with the changes they do with apps&threats but my customer doesnt have a Palo Alto account, how could they receive these mails?

[Brandon_Wertz]

I'm guessing your customer got affected by Content-ID 596?  Is your customer running PAN-OS 7.1.X?

"The best way would be to install manually these apps&threats updates, right?? "

Well the "best way" is subjective.  What's the "right way" for your customer?  What are there needs, what are there requirements?  

This package is usually updated on Wednesdays.  You can have your customer set it to automatically updated every week on a Friday.  This would hopefully provide enough of a window where if the content released on Wednesday had a similar issue in the future the package could be removed before it was pushed to them.

There are a bunch of different implementation scenarios, but all require someone thinking about what's best for their enviornment.

[soporteseguridad]

How could they receive the Palo Alto mails???

[reaper]

you need a support account to be able to receive those emails:

Ideally, the customer should create a support account when they receive their device (register with the serial number etc) and then add you, as a partner, to their assets so you can manage (you can also do this for them), and then they will also be able to subscribe to the emails notifications.

If the serial numbers have already been registered under your own account, your customer won't be able to create a support account (due to the serial already being used by yourself). In this case you'd need to open a case with support so they can set your customers up with support access

[Brandon_Wertz]

when you have an account on the Palo Support site you can enable your account to receive e-mails.

If for one reason or another they aren't getting / can't get the e-mails you can always set up a rule of your e-mail client to forward anything from "updates@paloaltonetworks.com" to your customer.

[BPry]

We actually had this issue on our 3020 and it has to do with update 595. From what I have heard not many people were actually effected by it because most networks don't have the internal SMB traffic pass through the firewall. The only reason we noticed the issue was because of a seperate zone that we use for AnyConnect and these were the only users to my knowledge that were ever affected by it.