Warning: Disabled applications in vsys1

[Kerri.Stahl]

Hi,

For a while when committing we would see the message below because the applications were disabled. We have since enabled all of these applications, but are still seeing the same warning. Curious if anyone else has encountered this, and whether there is a fix for it?

Warning:

Disabled applications in vsys1: assembla-base assembla-uploading cellcrypt cloudforge-base cloudforge-uploading fortnite glassdoor-base glassdoor-downloading glassdoor-editing glassdoor-posting glassdoor-uploading google-expeditions gqueues hootsuite-posting hootsuite-sharing hootsuite-uploading jamf matlab ms-store mtconnect paloalto-directory-sync paloalto-logging-service papercut qliksense-cloud-base qliksense-cloud-downloading qliksense-cloud-editing qliksense-cloud-sharing qliksense-cloud-uploading quora-posting quora-uploading rally-software-downloading rally-software-editing rally-software-sharing rally-software-uploading showmax-base showmax-streaming sourceforge-downloading sourceforge-uploading tableau-downloading tableau-editing tableau-uploading watchdox-downloading watchdox-editing watchdox-sharing watchdox-uploading yammer-downloading yammer-editing yammer-sharing yammer-uploading

[qdimclark]

We've had this happening for a bit now.

Runing this command in the CLI showed no disabled app-ids.

request get-disabled-applications

Running this command, however, did show disabled app-ids.

show running application disabled

According to support this is only a cosmetic issue. They also said that it was fixed in 8.1.14, which we installed and found its still happening now.

They suggested this article, which we've not implemented yet.

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-new-features/app-id-features/app-id-ease-of-use/...

[qdimclark]

Forgot to mention that we ran this on the disabled app-ids and it made no difference for us.

request set-application-status-recursive enable-dependent-apps yes application <appplication-name> status enabled

[Kerri.Stahl · Accepted solution]

We use a Panorama to manage our firewalls, and while we enabled all the applications on the firewalls, we had not done the same on the Panorama. There is nowhere in the GUI to do this and we didn't know it was required since we have to manage the application status on each FW. I ran the following command on the Panorama for each application we received the message for and this resolved our issue.

request set-application-status-recursive status enabled application assembla-base

[qdimclark]

With only 4 firewalls, we're not using Panorama.

Working with support we ran the command you mentioned. And then ran "commit force." That worked for the passive peer of our HA pair. We're scheduling a window to failover to that for testing. Part of this issue was that the new app-threat updates would break a sec policy. When we reviewed the apps against our policies it didn't match with what broke. A new app-id would only affect security policy A according to the review. When it was enabled it broke policy B.

The latest thinking is that content updates are corrupted. But more testing will reveal that.

Thanks for replying!