PA VM in bazaar state… by Design – Zewwy's Info Tech Talks

So today I had some weird stuff happening (Fedora Download was downloading slow, 300 KB/s)… I thought it was the mirror, but no matter what mirror I picked I had the same results, I asked a buddy to verify my findings and they could download Fedora with speed… Long story short, I thought maybe it was my firewall, and my colleague mentioned the same. Since this is a Lab setup it would be nice to get a perpetual license for learning purposes, but PAN clearly don’t work like. I was pretty sure my license had expired, so decided to first quick finds out what happens when a license expires: What Happens When Licenses Expire? (paloaltonetworks.com)…

Threat Prevention	Alerts appear in the System Log indicating that the license has expired. You can still: Use signatures that were installed at the time the license expired, unless you install a new Applications-only content update either manually or as part of an automatic schedule. If you do, the update will delete your existing threat signatures and you will no longer receive protection against them. Use and modify Custom App-ID™ and threat signatures. You can no longer: Install new signatures. Roll signatures back to previous versions.

Good to know, nothing that would cause the issue I’m experiencing….

DNS Security	You can still: Use local DNS signatures if you have an active Threat Prevention license. You can no longer: Get new DNS signatures.

nope… and…

Advanced URL Filtering / URL Filtering	You can still: Enforce policy using custom URL categories. You can no longer: Get updates to cached PAN-DB categories. Connect to the PAN-DB URL filtering database. Get PAN-DB URL categories. Analyze URL requests in real-time using advanced URL filtering.
WildFire	You can still: Forward PEs for analysis. Get signature updates every 24-48 hours if you have an active Threat Prevention subscription. You can no longer: Get five-minute updates through the WildFire public and private clouds. Forward advanced file types such as APKs, Flash files, PDFs, Microsoft Office files, Java Applets, Java files (.jar and .class), and HTTP/HTTPS email links contained in SMTP and POP3 email messages. Use the WildFire API. Use the WildFire appliance to host a WildFire private cloud or a WildFire hybrid cloud.
AutoFocus	You can still: Use an external dynamic list with AutoFocus data for a grace period of three months. You can no longer: Access the AutoFocus portal. View the AutoFocus Intelligence Summary for Monitor log or ACC artifacts.
Cortex Data Lake	You can still: Store log data for a 30-day grace period, after which it is deleted. Forward logs to Cortex Data Lake until the end of the 30-day grace period.
GlobalProtect	You can still: Use the app for endpoints running Windows and macOS. Configure single or multiple internal/external gateways. You can no longer: Access the Linux OS app and mobile app for iOS, Android, Chrome OS, and Windows 10 UWP. Use IPv6 for external gateways. Run HIP checks. Use Clientless VPN. Enforce split tunneling based on destination domain, client process, and video streaming application.

All a bunch of nope…

VM-Series	See the VM-Series Deployment Guide.
Support	You can no longer: Receive software updates. Download VM images. Benefit from technical support.

This is a VM series yes… so what does that link mean….

VM-Series	You can still: You can continue to configure and use the firewall you deployed prior to the license expiring with no change in session capacity. The firewall won’t reboot automatically and cause a disruption in traffic. However, if the firewall reboots for any reason, the firewall enters an unlicensed state. While unlicensed, a firewall supports a maximum of 1,200 sessions. No other management plane features or configuration options are restricted.

OK… Maybe… but I’m sure a download of a single file doesn’t take over 1,200 sessions… while I did reboot the unit (cloned, power off OG, power on clone, etc)

All other things are the same as posted above… Then I noticed some really weird things….

Checking for updates doesn’t state anything about license status, just tries and quietly fails.
Checking support status shows “Device not found on this update server”
Dynamic Updates do not show a “currently installed” version.
1. The current version installed with Review Policies, and review apps under action.
2. The previous installed one will have the same plus a revert action.
3. Downloaded one will have an install action.
4. All others seen since last communication to PAN will have download
Retrieving licenses from licenses server returns “Failed to install features. The device is not found.
Finally the smoking gun… Serial Number on the Dashboard will be listed as unknown.

So, I ended Googling this and found not one, but TWO KB’s!!!

Serial number becomes “unknown” after changing the instance typ… – Knowledge Base – Palo Alto Networks

and

Serial number becomes “unknown” upon rebooting PA-VM – Knowledge Base – Palo Alto Networks

After reading these, it all made sense… and it’s all rather dumb… to paraphrase it simply….

It’s due to DRM, how the DRM works is it derives the serial number from two ID’s CPUID and UUID… and when you migrate a PAN VM the CPU is different cause of the different host it resides… this in turn breaks the licensing.

*Standing Ovation*

What’s PAN solution… Open a support ticket… that’s right.. instead of coming up with a technical solution to make DRM work while still retaining the ability to migrate the VM (The most important and valuable reason why you want to run it as a VM anyway)….

Instead of having a way to edit the CPUID and UUID in the PAN portal to fix this yourself…..

No they want you to waste their tech support personals time….

This ….. IS……. DUMB!!!!!

Leave a Reply Cancel reply