Upgrade to 6.1.1 and problem with Vulnerability Protection profile

[Oleksandr]

Hi guys,

I had a problem with Vulnerability Protection profile.

I created Custom Vulnerability signature with exception for only one (1) IP address. But after upgrading to 6.1.1 version (from 6.0.5) this exception stopped working... I had to copletelywrite a new rule to exempt this IP from scanning...

The signature was based on 40015 (SSH Brute-force).

Any ideas?

Thank you!

Alex

[pulukas]

Was the configuration still present but not working or was the customization of the signature lost in the upgrade?

Either way, you should probably create a support case with this information so a bug can be logged and the upgrade issue corrected in future releases.

[Oleksandr]

Thank you roe answer

Yes, the configuration was not changed after upgrade, but THAT signature started blocking valuable server, so I decided to change the rule.

Probably,  "exception" feature has changed the logic in new version?

[pulukas]

We have many exceptions setup in our signatures and it is NOT normal for the behavior to change in an upgrade.  Based on your description, this is most likely a software bug that should be reported with a ticket to Palo Alto support.