Pan-OS 10.2.13-h4 known issues

[pavel.sharypov]

Hello everyone, 

Can I ask if anyone already installed Pan-OS 10.2.13-h4 on their firewalls? Any issues with this hotfix? 

I am hesitant to install it after reading reddit comments about the 10.2.13-h3 and how it breaks IPv6. 

[Shadmin]

Just upgrade to 10.2.13h4 from 10.2.12h2 over the weekend, firewall locked up, I am running AWS version still trying to figure out what the issue was. 

[ozheng · Accepted solution]

Hello @pavel.sharypov ,

I would suggest you to upgrade one device and monitor first if any side effect.

As its name implies, it is a hotfix version, it has its associated risks compared to a normal release.

Regarding the feedback from third party, I would suggest for you to take it "as is" ("zero trust" mindset, always verify the facts).

Olivier

[pavel.sharypov]

I upgraded several firewalls and I am noticing an issue with Azure SAML when the authentication page shows as blank. If I restart Windows or pangp service on the affected laptops, then the authentication page shows normal. 

Found this article but adding additional azure authentication portals into fqdn exception list doesn't seem to fix the issue.

Globalprotect SAML Authentication login screen does not load an... - Knowledge Base - Palo Alto Netw...

Enforce GP Connection feature is on. I didn't see this issue at all before installing pan-os 10.2.13-h4. GP logs also don't show any blocked fqdn so now I am hesitant to apply 10.2.13-h4 on every firewall to be honest. 

[pavel.sharypov]

I am using an embedded browser for SAML authentication. It turns out that it is something related to the window size. When I stretched it a bit, the login page appeared without any issues 😑

[ozheng]

this is a GP client issue, not PAN-OS issue 😉