Michael McNamara

technology, networking, virtualization and IP telephony

Palo Alto PAN-OS 8.0 Upgrade Failure

by

It turns out that in the year 2022 upgrading from PAN-OS 8.0.x requires a TAC case and an older content update file that’s not readily available on Palo Alto’s Support website.. Hopefully this will save someone else the down the road.

I recently needed to press an older PA-220 that had been in laying around in a lab into a production environment due to the supply chain debacle that we’re all currently living in. I reached out to my reseller and had the firewall fully licensed and was able to apply those licenses to the hardware. In preparation of the deployment I tried to bring the PA-220 up to PAN-OS 9.1.14. And was unable to upgrade past 8.0.20 even with the device being fully licensed.

When I tried to upgrade from 8.0.20 to 8.1.23 I would get an error during the software install, “Failed to install 8.1.23 with the following errors. SW version is 8.1.23 Error: Upgrading from 8.0.20 to 8.1.23 requires a content version of 769 of greater and found 655-3816. Failed to install version 8.1.23 type panos“

Even though the device was fully licensed there were no Dynamic Updates available to download or install. I even tried to manually download them from the Palo Alto support website and install them and that was met with a different error when trying to commit the change.

I opened a case with Palo Alto Support and eventually they provided me content update 8424-6791 which I was able to manually install and apply, after which I was successfully able to upgrade to 8.1.23. I was then able to download and apply the latest and greatest greatest content updates from the webUI and eventually upgrade the firewall to 9.1.14.

Cheers!

PanOS 9.1.12 breaks GlobalProtect VPN

by

When possible it’s always a good idea to test any software upgrades, because you just never know what your going to get. That was the case recently when I upgraded our test PA-220 from 9.1.7 to 9.1.12-h3 and seemingly breaks all GlobalProtect VPN functionality. The portal doesn’t respond on TCP/443 at all, so it looks like the firewall itself is dropping the traffic.

The issue turned out to be Strict IP Address Check which was just “resolved” or enabled in 9.1.12.

AN-175934 Fixed an issue where packed-based zone protectio settings (such as
Strict IP Address Check) were not applied to return traffic.

When I disabled Strict IP Address Check on the zp_untrusted zone protection profile GlobalProtect started working again.

What is Strict IP Address Check?
Check that both of the following conditions are true:

  • The source IP address is not the subnet broadcast IP address of the ingress interface.
  • The source IP address is routable over the exact ingress interface.

If either condition is not true, discard the packet.

Looks like a bug to me.

Cheers!

HPE/Aruba Instant Access Points – mixing models on the same virtual controller

by

In the past if you wanted to mix an Aruba IAP-100 series and an Aruba IAP-200 series in the same network and virtual controller you had to make sure that both APs were running the same software/firmware revision prior to trying to pair them together. If you didn’t you’d end up with one AP becoming the virtual controller and the other one would just continually reboot trying to join the virtual controller because it was unable to upgrade itself as the software image between classes/models is different.

I recently discovered that this is no longer an issue… APs that are not managed by Airwave (AMP) will reach out to the Internet (Aruba Central? or Aruba Activate?) and upgrade themselves without issue to whatever version the virtual controller is running. And APs that are managed by Airwave will also upgrade themselves so long as the upgrade image is downloaded and installed into AMP for the APs to retrieve.

This is a really nice feature, and helps simplify break-fix issues when older APs die and need to be replaced but you don’t have any IAP-135s available. Now you can use IAP-215s or any 200 series APs and whether or not you have Airwave your AP will be upgraded to the correct software to work properly.

You can mix and match APs based on software release…. IAP-135s and IAP-215s running 6.4.x software work well together, as will IAP-215s, IAP-315s and even IAP-515s running 8.6.x software.

Cheers!

Update: Friday November 11, 2021

The is a known issue with older software releases that will break the ability to upgrade from the cloud. The AP in question needs to be on a “newer” release in order to establish an SSL session to the cloud. Additional details can be found in Aruba Support Advisory ARUBA-SA-20191219-PLVL08 titled Aruba Instant Certificate Expiry Issue.

Aruba Instant Certificate Expiry Issue – rogue DHCP server discovery

by

HPE/Aruba recently released advisory ARUBA-SA-20191219-PLVL08 which states the following;

There is a software defect that may impact Aruba Instant Access Points (IAP) and its accessibility through Aruba Central, Activate, and AirWave. This bug is tied to an SSL certificate in the Trust Anchor (TA) file of Instant OS, and may result in the loss of connectivity to management platforms unless the recommended action is taken prior to February 07, 2020. This is not a security vulnerability, but a software defect that may cause loss of connectivity to management plane.

<center>Aruba Central</center>

Like many organizations we leverage Aruba Airware Management Platform (AMP) and we’re looking at possibly leveraging Aruba Central in the near future so we took the opportunity to update our IAP-135s, IAP-215s and IAP-315s.

Thankfully AMP makes the process pretty simple and straightforward although out of some 550+ upgrades we had one where the Aruba Virtual Controller didn’t recover after upgrading. Unfortunately I’ve seen this behavior before – when you run 550+ individual LANs you are bound to see just about everything and anything. In this specific case I could see the Instant Access Points (IAPs) were pulling power but weren’t pulling a DHCP IPv4 address from the local router. So I shutdown everything on that VLAN, disabling all the switch ports, with the exception of the IAPs and then rebooted each of them by cycling the PoE state on each switch port. Within a few minutes all the IAPs had recovered and were up and running. What was the issue? There was a rogue DHCP server on that network which was handing out bad IPv4 addresses. The IAPs were grabbing these ‘bad’ DHCP IPv4 addresses and were the ultimately unable to communicate with the rest of the network. Unfortunately the kit that we currently have in the vast number of locations doesn’t provide DHCP snooping or the ability to filter DHCP responses from trusted/untrusted ports.

Cheers!

Home Desktop Upgrade 2017

by

I honestly wasn’t planing a desktop upgrade, but you know what happens when hardware dies… time for an upgrade.

Unfortunately the wife’s computer recently died so I gave her my desktop (swapping SSDs and hard drives) and went about putting together a new desktop for myself from the following purchases;

I decided to stay with Intel for now and passed on AMD Ryzen and Threadripper. I also decided that I’d be more than happy with an Intel Core i7 series processor, no need to look at the recently released Intel Core i9 processors. I did decide that the old Antec P180 case needed to be put into the scrap pile so I ordered a Corsair Crystal Series 570X RGB case. Since I swapped the SSDs and hard drives I ran into the dreaded Windows activation issue since the original product keys were OEM versions. I didn’t want to go through the time and effort of re-installing Windows 10 so I purchased 2 retail copies of Windows 10 Professional and applied those product keys. While the hardware supports overclocking, I’ll probably run it at stock until I need more performance or I find the time to start testing the overclocking potential of the hardware.

Now I need to spend sometime finding a replacement for Crashplan. Any recommendations?

Cheers!

Recent Posts

Categories

SUBSCRIBE BY EMAIL