Source Address - Show ipv4

[kevin.shain]

I just upgraded from a PA 500 to a PA 820 and something is throwing me for a loop.  In all of my reports and in the monitoring section under App Scope the firewall is reporting what appears to be ipv6 addresses, they are in the format of: "::678b:540:ffff:0".  I'd prefer to see the ipv4 address as it is much simpler to hunt down the offending user, etc.  Any way I can disable ipv6 reporting on the PA 820?  I am in PAN OS 10.1.

I should mention that the traffic logs are showing the ipv4 address.

Thanks.

[LAYER_8 · Accepted solution]

This is a known issue, PAN-167327 & PAN-167870 are P1 by engineering and resolved in the next release of 10.1.x.

Some of the IPv4 get rendered as IPv6 addresses, and other times the addresses are in hexadecimal opposed to decimal. Important note, this does not affect data plane processing, just rendering on the MGT plane.

Please note at this time 10.1.0 does not have a preferred or recommended status by Palo Alto's TAC (bookmark this page). 

Prior to upgrade of software, please review known issues & upgrade considerations, too. 

Best shot would be to downgrade to a preferred release like 10.0.6 to get reporting features back to full functionality until 10.1 earns the preferred status.

[kevin.shain]

Thanks.  Not going to downgrade as we are currently in our downtime here (school) so will hope something gets released in 10.1.x that will be preferred status before we start back up.

[LAYER_8]

No guarantees here, but, typically this occurs 1-3 months post release. Go-live date was June 4th, so we may be able to sneak something in before schools return 🙂  

[palokb57]

10.1.2 still not solved 😞

[Keith6783]

ver 10.1.2, as was mentioned by @palokb57 has not yet corrected the problem.

An IPv4 address of A.B.C.D will be written backwards, in hex.

Example, the report shows: ::dcdc:43d0:ffff:0

DC = 220, DC 220, 43 = 67, D0=208 and the tail of :ffff:0 we can toss.

Those octets of the IP are flipped, so the actual IP address in the report is:

208.67.220.220

[LAYER_8]

I'm not seeing any current JIRA tickets open for the same issues, perhaps escalate to your account team to see if your territory SE possess alternative guidance. Please note at this time, PAN-OS 10.1.x is still not TAC preferred.

[palokb57]

Hi Slick, I dont' get your "JIRA tickets open..." It's just annoying

[LAYER_8]

I work at Palo and am relaying that our engineering team (JIRA) doesn't have tickets open on this issue at this time. Which likely means it is resolved in a maintenance release of 10.1.x, I just am unable to see which. 

[palokb57]

I am very disappointed that even in new version10.1.3 IP v6 addresses are still displayed instead of IP v4. Why is something so essential simply ignored for months? Am I in the wrong place with my complaint?

[LAYER_8]

Best avenue to pursue is syncing with your account SE and seeing if you can't get a session with product management, both to ensure your complaint is delivered as unaltered as possible, and to hear their response likewise. 

[Artemiusm]

Man I fully accept with you, so much time we have a trouble with this. Why i updated to 10.X my biggest mistake. Already on 10.1.3 and with this issue.

[tjwilliams]

PA-820, 10.1.3, problem still exists.  Was really excited to see this marked as "fixed" in 10.1.3. notes.  Imagine my surprise...(or maybe 800 does not mean 800 series, even though 7000 is marked as "series" 🤔)

[Craig5]

PAN-175149 Fix it already. 10.1.3 and the erroneous addresses still exist.

[Craig5]

10.1.3 is listed as a preferred release with this bug in it. How is this not a bigger deal than just for a handful of us? Nobody generates reports or uses ACC?