About AlexNC

Hi Guys   Any News on this? I am Upgrading Panorama from 11.0.5-h1 to 11.1.2-x (which failed with the exact same message. I tried h11 / h9 directly. What was working was 11.0.5-h1 to 11.1.0 (base image) but now I am still failing to upgrade to anything else so far (11.1.2-h9/11 ro 11.1.4-h1) We got a bunch of PA1400 so we needed to go for 11.x and 11.0 as mentioned goes End-Off by Nov 2024 regards Alex ... View more

PAN-OS 11.1.0 just got released. PAN-221126 https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/pan-os-11-1-0-known-and-addressed-issues/pan-os-11-1-0-known-issues But it is not fixed in this release, what a shame. ... View more

Do we know when this will be fixed in the 11.x Release?   Cheers Alex ... View more

Well that is more then frustrating. Do you have a BugID for that?  Seems like Palo Alto is digging deep into Bugaggedon territory here. ... View more

Hi JeffryN Thanks for the info on the targeted fixed releases. Yeah must customers we service are on 10.2.x or going to upgrade to 10.2.x we had some Customers with PA-14xx that hit some hard..... really hard bugs with 11.0.x We are waiting for some other guinea pigs  to be sent to the slaughter house before we upgrade to the 11 release. Cheers Alex ... View more

I found a workaround to the BugID Search within the PAN-OS Release Notes. If you search for the BugID PAN-221126 like this, it will not show any results see below.   But if you search for PAN-221126/ > yes adding a / at the end, I do get some results back (it's more then what I want and searched for, but the first hits do show the correct releases). ... View more

I totally agree with you and also other vendors suffer the same issues with some bugs are beeing internal and some are public. But the sheer amount of simple bugs (we're not talking high severity bugs that leave you with your pants down) are not listed. Also if there are simple..... I am talking about DEAD simple workarounds to fix an issue/bug. I've seen my fare share of Jiira and that there is to much information put into it, that would expose the customer that actually opened the first case for a given issue 🙂 But com'on add some fields for a sanitized version. Start creating all new TAC Cases/Jiira Issues with the new mask. higher some fresh from from school coders that automate the sanitizing of all existing Jira entries, then have a few senior TAC Engineers that know the product to review quicky and make sure no confidential information is leaked/visible. Even if the cleanup/split is not perferct (just look at some other Vendor BugIDs with their descryption/symptoms/workaround/solution part. BTW: Just a couple of weeks ago. I was able to take a BugID e.g PAN-221126 and add it to the general "search" bar on the top right. This way I could find all the PAN-OS Versions that the Bug is listed. This does not work anymore 😞 ... View more

I can confirm. we upgraded from 10.2.4 > 10.2.5 and it is broken now. It was working fine in 10.2.4 Seriously and what is the BugID for this? I cannot find it under Open/Known issues for 10.2.5 UPDATE: searching within 11.0.1 Know Issues, one can find the BugID PAN-221126 Email server profiles ( Device Server Profiles Email and Panorama Server Profiles Email ) to forward logs as email notifications are not forwarded in a readable format. Workaround: Use a Custom Log Format to forward logs as email notifications in a readable format. I do use a custom LogFormat, but all line breaks still won't work, which makes the email not readable   When will Palo Alto finally give us a useable bug search tool, the current possibilities are just utter useless. Also having BugIDs not published > Manual GP Gateway selection for Gateways behind NAT devices does not work. Was not published because its a duplicate of "Certificate auth not working when GP Gateway behind NAT device". Guys please why do we even bother going through release notes at all anymore?   Sorry just had to let it out. It's the second time within weeks that stuff like that happens. So much to 10.2.5 being the holy grail of 10.2.x releases that finally fixes many issues we are facing. ... View more

@Alabrir  Indeed, we heavily use Expedition for migrating from other vendors and also for M Learning and other Tasks. There are a few things desired in Expedition but we understand that Exp. 1.0 won't get much love in regards to new features and functions. So yes! Expedition 2.0 is highly anticipated by us. Not getting any info is indeed worrying, specially since there once was the download and install available a longish time ago and then got pulled. Cheers Alex ... View more

We are facing the same issue after upgrading to 10.2.3 But in our case the Spyware profiles do not match. Spy-Alert-Only = crit,high,med to Alert (rest is default) Spy-Outbound ) crit,high  to reset-both / med,low,inf to Alert So the profiles are not the same, but still we get the working that our Alert Profile is a duplicate of our Outbound. Is that also expected buggy behaviour    Cheers Alex ... View more

Hi PavelK   Yes I've just read it this morning. Guess their creative licensing department realised what a big stir fry they caused with their decision to reduce the number of security-zones from the top model downwards.    Glad to see we are back to previous PA3200 specs when it comes to security-zones. Now all they need to do is get off their subscription chaos bandwagon and come back to earth again. ... View more

@Alabrir   I sure hope not that Expedition 2.0 or for that matter MineMeld (local install, or they give us a SaaS EDL Manager that covers MineMeld) is one of them. I see many competitors beefing up their migration tool efforts in a way to gain customers and make the transition as easy as possible. Now not all migrations are good migrations and a **bleep** ASA config will end up a **bleep** PAN config.  But if done right tools like Expedition can be a huge selling point to get a customer to go for Palo and not just lifecycle up with his existing vendor. Not to speak of doing house cleaning of existing or old PAN installations out there. Specially since PAN-OS and Panorama are lacking a HUUUGE amount of security-rule manageability. I remember how last year the Expedition 2.0 pan.dev page even had the instructions how to install it and use it with what was working back then. Now it is dead silent and no work about it anymore.  It does worry one a bit.   Anyhow I do appreciate the effort that's been put into 1.0 and 2.0 so far and I greatly enjoyed using the 1.x version so far. Palo Alto needs to make it an official and fully supported tool in their arsenal or tools. This way it might also get you guys the necessary time and funding to move forward more efficiently.   best regards Alex ... View more

Yes I hope they can fix this in the future and at least give us the 200 form the 3200 Series. Also the comparison tool and summary spec sheet are still not updated to show the new PA-1400 Firewalls UPDATE: I stand corrected: the new PA-1400 and the new PA-415/445 are now in the comparison tool finally: https://www.paloaltonetworks.com/products/product-comparison?chosen=pa-3410,pa-3430,pa-3420,pa-1410,pa-1420,pa-415,pa-445      It's great that we can order them already, but I'd appreciate if I'd now what I buy before I pull the trigger. Especially since we learned from the PA-3400 Series, we might get a cutback in specs compared to the previous models. So knowing what we are actually spending our money on becomes even more important. ... View more

Dear Sharan   Right now the snooze is not usefull the way it is implemented, but I am looking forward to the roadmap and the change you mentioned. Being able to permanently disable/snooze an alert for a specific profile will be very welcome.   Thank you and best regards Alex ... View more