If you own Palo Alto Networks Next-Generation Firewalls and manage software updates, including Dynamic Updates, learn best practices and recommendations to ensure smooth deployment of weekly content from Palo Alto Networks.
We recommend that you use the "Threshold" capability to have a delayed rollout of Content Updates. To do this, configure each firewall to download and install Content Releases automatically with a delayed timer.
This can be configured under Device-> Dynamic Updates -> Application and Threat Updates -> Schedule
We recommend a value of 24 hours or more if you have mission critical applications in your environment.
In case you cannot delay the content install by 24 hours or more we recommend that you use a staggered approach to installing content on locations that have fewer users. You can install content automatically on less critical locations and/or environments with fewer users, but you should use the "threshold" option for other locations that have more users or have more critical applications or IT infrastructure.
You would like to test the impact of the modified and new App-ID’s on your network extensively before installing the Content Release and making security rule updates in your production environment. Follow these steps.
As a first step, of course, study the Release Notes to understand the changes.
The second step is to see the impact of these changes on your network traffic. To do this, you need a staging environment where you can test the changes without affecting production traffic. There are two options to create a staging environment.
The staging environment must at least contain all critical applications so that you can run the new Content Release and understand the impact on those critical applications. To do this, set up the environment, perform tests and analyze the results as follows.
Set up the environment
Route all the test clients’ network traffic through the test firewall.
Capture the traffic pattern using a custom report as shown in the screenshot below. This report captures the number of sessions for each application under each security rule. In this report, we have limited our view to the test clients’ traffic using a subnet filter on the address source. Run the report and save the results. For more information on how to set up, run and save reports, consult the Manage Reporting section in the PAN-OS Administrator’s Guide.
Now install the new Content Release on the test firewall. If needed, make any changes in your security rules based on the recommendations in the Release Notes.
Once again route all the test clients’ network traffic through the test firewall. Run the custom report again.
Analyze the results
Compare the custom report before and after installing the new Content Release. If the traffic pattern is the same, you have completed this step successfully. Refer to the section below titled “Installing and configuring the new Content Release in your production environment”.
If the traffic patterns are different, you have some work to do. Refer to the Release Notes for the new Content Release once again. Using the information on the Release Notes and the logs on the test firewall, figure out why the traffic patterns are different. For example, the new App-IDs are now classifying traffic differently, so do you need to insert new security rules containing the new App-IDs and allow that traffic? You may need to make changes to the security rules on your test firewall a few times and rerun the tests until one of the following happens:
An example of the latter scenario is that you decide to block consumer Office 365 traffic after installing the new Content Release.
This option is suitable for diverse deployments where firewall policy varies by location. Due to diverse traffic profiles, it is difficult to configure a few clients to mimic the entire set of applications in use across the organization. Follow these steps.
Set up the environment
Test as described under Option 1, with the difference that the traffic must be sent to the firewall using PCAPs instead of using the test clients. Create custom reports to capture the traffic pattern, again as described under Option 1.
Analyze the results
Again, follow the steps described under Option 1.
Now that you have tested the traffic in a test environment and are satisfied with the results, you are ready to deploy the new Content Release in your production environment.
You probably do not need an extensive preparation or testing phase. We recommend the following:
There are 3 ways to view what’s in each Content Release.
Release Notes are organized into the following sections.
This section includes general notes about the release, for example, the types of App-IDs introduced in this Content Release.
In addition, it also lists changes that may impact your existing policies, for example, new URL filtering categories. For such changes, it provides recommended policy modifications to take advantage of the changes.
In collaboration with our customers, we have adopted a policy of early notification for Content Release updates that may require a change to your security policy. This may happen when an App-ID’s dependencies change, or when a signature enhancement results in a significant change in coverage. Such updates are necessary to keep pace with the fast-changing applications and application functions.
To give you an insider peek into our processes, we hold a weekly internal review where any significant App-ID changes are scrutinized to determine if they meet the above criteria for early notification. If the answer is yes, we describe the upcoming change in two fora – the Release Notes and the Palo Alto Networks Live Community. For exceptionally significant changes, we also add placeholder App-IDs and decoders 4 weeks in advance of the actual change. This allows you to add these placeholders in your security rules ahead of the change.
Notes section of the release Notes
The Notes section of the Release Notes mentions such future updates. We also provide guidance about the action required on your firewall configuration. Here is an example of such an early notification, included for Content Release 597, on Jul 8, 2016. Since we considered this an exceptionally significant change, we not only described the upcoming change but also included placeholder App-IDs and decoders.
This content update includes the placeholder App-IDs ("office365-enterprise-access" & "office365-consumer-access") and placeholder decode context "http-req-ms-subdomain" for pattern match under custom application signatures. As of this update, these App-IDs and the decode context are strictly provided as a placeholder to aid policy migration, and will not affect any existing App-ID policies.
Palo Alto Networks strongly encourages customers to follow the FAQ on the Palo Alto Networks community at https://live.paloaltonetworks.com/t5/Management-Articles/FAQ-Office-365-Access-Control/ta-p/94949 to learn more about this change and its impact on existing firewall policies.
The week of August 29th, 2016, Palo Alto Networks plans to functionally enable these App-IDs and the decode context, intended to augment existing Office 365 App-ID capabilities, by providing access control for Microsoft Office 365.
Palo Alto Networks Live Community
The Palo Alto Networks Live Community contains frequently asked questions, videos and articles with use case examples. This helps you understand the configuration changes that might be required on your Palo Alto Networks next-generation firewall. Here is an example of one such notification:
Since the Live Community is interactive, it allows you to post comments and ask questions of other customers and Palo Alto Networks employees.
You followed the best practices, but due to an error, or something that was overlooked, or incorrect analysis of the staging environment test results, production traffic gets allowed or blocked in unintended ways.
In such an unlikely event, especially if business-critical traffic is being blocked and time is of the essence, go to the PAN-OS management interface, and navigate to Device > Dynamic Updates > Revert, as shown in the screenshot below. Clicking the Revert link will revert to the previously installed version.