Shadow Rule Warning after upgrade

[AndreaHuszka]

Hi All, 

We have a customer who has upgraded to 9.0 and they get shadow rule warnings since the upgrade.

All the shadowing rules are more generic with any/any for source and destination, but with source user restrictions.

The shadowed rules have more specific source/destination values.

Traffic is hitting the shadowed rules.

The same rules weren't triggering any warnings under 8.1

Has anyone experienced a similar issue?

Thanks,

Andrea

[kevin-lesne]

Hello,

Yes, I have the same thing with upgrade in 9.0.8 (from 8.1.x) but I haven't created a case yet

(For example: src.user ignored)

[panos]

Hi

any update on this ?

Thanks

[AndreaHuszka]

It appears to be a bug, a fix is targeted for 9.0.11 and 9.1.5

[TStiteler]

Do you have a reference for this being noted for 9.0.11?  Been doing some digging and not finding anything calling this out.

Thanks!

[HonoAl]

Do we have the bug ID provided by Palo Alto TAC for this issue? Ta.

[laurence64]

PAN-137663

Fixed a cosmetic issue where misleading App-ID and rule shadowing warnings populated after a commit.

Fixed in 9.0.11 hopefully this is the one.