About markjx

I wanted to start a quick discussion regarding Known Issues Lists, Release Notes, and documentation. Mainly, I want to pass on what we were told by our TAM (Technical Account Manager). In short: The way to find out the Known Issues for 3.1.8 is to read the Release Notes for 3.1.9. Whatever is listed as fixed in 3.1.9 was obviously broken in 3.1.8. In other words, if support tells you to upload to version x; don't do it. Read the Release Notes for x+1. If it isn't out yet, then wait. But, certainly don't upgrade just because Support tells you to. Again, this isn't me speaking, this is the guidance we got from our TAM. Here's how this came about: We were having an issue where a PA-4020 stopped passing all traffic, causing a business interruption. The advice from support was to upgrade to 3.1.8. Of course, there are (now) well known issues with 3.1.8 breaking URL Filtering. We expressed outrage at being told to upgrade to a version of code which contained obvious, and huge bugs. We were told that we shouldn't have upgraded to 3.1.8 without first reading the 3.1.9 Release Notes. Kind of a, "If support told you to jump off a bridge, would you?" argument. It was an incredible argument from a vendor to a customer. Needless to say, as of July 1, 2011, we're not paying for a TAM. MJ ... View more

This is more of an FYI than a question. I want to share what my company is going through so we can all learn from each other. We monitor our network by sending out pings every 500ms. We have multiple ping sources going to scores of endpoints. Then, we correlate and report on the data. We've been doing this for years. We've got a good understanding of what "normal" looks like on the network. We upgraded a PA-4020 (Threat Protection & URL Filtering, two vwires) from 3.1.4 to 3.1.8. Within hours, that firewall started experiencing "incidents". In each incident, the device would stop passing traffic for up to 15 seconds. Of course, the logs and counters don't show anything abnormal. Every few hours, the system would experience an incident. Sometimes at 03:00, but usually during business hours. It did seem to be somewhat load related. (High load on this box is a few hundred Mbit/sec) Support didn't seem to believe us that this was a problem. After about a week / ten days, we gave up on getting support engaged to understand the problem, and we rolled back to 3.1.4. Everything has been fine since then. Since then, we've got support engaged and looking at the problem. They're saying that there haven't been any fixes in 3.1.9 for issues like this. In other words, they're recommending we avoid 3.1.9 as we'll likely have the same problem. Is anyone else running these versions of code? Do you have good monitoring like this? If I gave you some scripts, would you let me know how it goes? We do have 3.1.8 on over a dozen other 4020's and it is working fine. Very different traffic loads on those devices and no URL filtering. We played with 4.0 for a bit... and then went back to 3.1 for stability. Don't even get me started on 4060's: The solution to one of my tickets is "Just keep rebooting until it works". If you're seeing silent packet drops in 3.1.8 or 3.1.9, you're not the only one. This is cross posted to http://markjx.blogspot.com/2011/07/pan-silent-packet-drops-in-318.html ... View more