System alerts

[Joshan_Lakhani]

Hello Team,

I am getting system alerts in my firewall below is the error:-

PAN OS - 9.0.6

Disabled applications in vsys1: cip-ethernet-ip-disable-io cip-ethernet-ip-disable-sfc cip-ethernet-ip-enable-io cip-ethernet-ip-enable-sfc cip-ethernet-ip-read-mod-write cip-ethernet-ip-read-tag cip-ethernet-ip-read-tag-frag cip-ethernet-ip-run cip-ethernet-ip-stop cip-ethernet-ip-test-mode cip-ethernet-ip-write-tag cip-ethernet-ip-write-tag-frag dingtalk-file-transfer jandi pfcp philips-ecg retrospect-backup siemens-s7-comm-plus-download siemens-s7-comm-plus-upload.

NOTE: I have checked the all application are disable in Application DB 

Below is the current Version for Content ID

Application Version	8305-6248 (08/14/20)
Threat Version	8305-6248 (08/14/20)
Antivirus Version	3441-3952 (08/15/20)

Could you please give any suggestion on this.

[MP18]

@Joshan_Lakhani 

To fix this you need to go to Device,Log Setting, System 

Create  a filter for example

(severity eq high) and (eventid neq Disabled apps)

or 

not ( description contains 'Disabled applications')

It is your log forwarding profile which is sending you the system alerts.

Regards

[Joshan_Lakhani]

@MP18 

I didnt configure the log forwarding , it is showing alerts in systems
Any issue if i ignore this or i need to take some action.
Please suggest.

[MP18]

You can ignore this these alerts.

[BPry]

@Joshan_Lakhani,

Whoever setup your firewall has them setup so that the new app-ids are disabled when you download a new content update. While this can prevent issues rising from new app-ids being identified, it's something that you would eventually want to bring in so that your firewall can identify all of the new applications PAN has added. 

So while these alerts can be ignored, I would definitely make the new signatures active in your next maintenance window and simply verify that the new applications don't cause any issues in your current rulebase.