topic Re: R81.20 feedback in General Topics

R81.20 feedback

the_rock — Mon, 21 Nov 2022 23:35:50 GMT

Hey guys,

Figured would share my feedback so far on brand new distributed install of R81.20 in esxi lab. I really do like zero phishing feature, though for that to work, https inspection has to be on, so may try that out some time this week.

In all honesty, I dont see any drastic changes from R81.10 as far as policy layout, log filtering, IPS...

Also, not sure if this is just my lab, but I made few rule changes and for some reason, accelerated policy push never takes an effect, though its not disabled.

Just my 100% honest feedback, looks good so far, but the real test would be to see it in busy production environment.

Anyway, thats all I can think of for now. Will add more things as I do more testing : - )

Re: R81.20 feedback

the_rock — Tue, 22 Nov 2022 01:59:00 GMT

Accelerated policy push works, just took some time to "kick in". Will try autonomous threat prevention this week and see how it performs.

Re: R81.20 feedback

the_rock — Tue, 22 Nov 2022 18:34:20 GMT

This also seems to be cosmetic, as SIC works fine and ips is up to date:

Re: R81.20 feedback

Don_Paterson — Tue, 22 Nov 2022 19:35:03 GMT

Did you notice the WHAT'S NEW page still says Coming soon 2022 R81.20 ? 🙂

Re: R81.20 feedback

the_rock — Tue, 22 Nov 2022 19:42:18 GMT

Yes sir :). Im just posting things as I see them in my lab...this is more for anything thinking of upgrading and if any questions. Im happy to test anything in the lab, because quite frankly, no one will cry if that lab breaks, haha. We will just build brand new one, takes 2-3 hours.

Re: R81.20 feedback

Don_Paterson — Tue, 22 Nov 2022 19:43:04 GMT

Nice to see the Changes view in the title bar. PNG attached.

Won't spam you here (thanks 🙂 ), but a good thread to share anything specifically interesting in R81.20.

Re: R81.20 feedback

Don_Paterson — Tue, 22 Nov 2022 19:44:43 GMT

Cool. I have an opportunity to test it with R80.40 VSX over the next few days (also in a lab), and will try a VSX upgrade.

Re: R81.20 feedback

the_rock — Tue, 22 Nov 2022 19:56:40 GMT

No spamming brother, all good, haha...Im happy to hear any feedback, thats what whole community is about. Anyway, I also attached an example of that, yes, indeed, VERY NICE.

Andy

Re: R81.20 feedback

Don_Paterson — Wed, 23 Nov 2022 12:32:20 GMT

Mmmm...

I got a Granularity Validation error. Searched 'granularity' in the RN and SMS Admin Guide but didn't see anything specific.
It went away when I removed logging from the cleanup rule (in Standard).
I had added a bunch of rules (via API command) and then manually deleted them and then it would not let me publish until I turned Track to None.
A few other changes and then I set it back to Log and it Publishes fine...

Re: R81.20 feedback

the_rock — Wed, 23 Nov 2022 12:35:16 GMT

Are you saying this was the error when ONLY implicit clean up rule was there?

Re: R81.20 feedback

Don_Paterson — Wed, 23 Nov 2022 12:46:21 GMT

It is about the default Cleanup rule (explicit)...

...and what I think it comes down to is this API command is maybe some-how working differently (to manual setting) in R81.20, and that is with regards to the settings of the Log (Track > Log) option. Meaning that if you set the Cleanup rule with the command below and then try to publish it may fail.

And yet, I cannot see a difference (see attached) when doing Track > Log manually or API-lly

(shrugs)

set access-rule layer "Network" name "Cleanup rule" track "Log" install-on Corp-GW

NOTE:
This site is anoying when it won't let me paste screenshots in (CTRL + V) and spits out errors about other things too.
"Your post has been changed because invalid HTML was found in the message body. The invalid HTML has been removed. Please review the message and submit the message when you are satisfied."

Re: R81.20 feedback

Don_Paterson — Wed, 23 Nov 2022 12:45:44 GMT

Yes.

Short answer 😉

Re: R81.20 feedback

Don_Paterson — Wed, 23 Nov 2022 12:48:13 GMT

I can't reproduce it now (in Standard). May have to try in a brand new policy (or on a clean build (some other time))..

Re: R81.20 feedback

the_rock — Wed, 23 Nov 2022 12:56:26 GMT

I will try it in a bit in my lab. Will change current policy for clean up rule to be like yours and see what happens and then test with new policy with clean up rule only. Btw, I said implicit, as I meant implicit as last rule all the way at the bottom, vs explicit clean up rule, meaning clean up at bottom of every inline layer (if one existed), thats all : - )

Anywho, will update shortly.

Andy

Re: R81.20 feedback

the_rock — Wed, 23 Nov 2022 13:43:16 GMT

Just tested it, no issues on my end. Not sure if its something to do with VSX vs regular gateway...its possible. I mean, I dont see why it would, but not 100% certain.

Re: R81.20 feedback

Don_Paterson — Thu, 24 Nov 2022 07:43:07 GMT

ACK

I did the API config on the clean build (using a dummy SG object (no SIC) to let the API script put it in the rules (Stealth and Install on)).

VSX Cluster addition came later.

Will try to reproduce when the opportunity presents again soon 🙂

Re: R81.20 feedback

the_rock — Fri, 25 Nov 2022 14:10:41 GMT

One other feedback I have for anyone in R&D who sees my post is this...I wish CP would FINALLY fix the issue with hit count on NAT rules. We were told even back in R81 and this would work (it did NOT) and then R81.10 (again, it did not, or it was very inconsistent, to put it bluntly) and I even had TAC case opened for this, as customer was curious and guy said he was going to investigate and literally came back next day saying R&D informed him that this was "work in progress". I mean, not sure why this is so hard to fix, because it would be nice if customers could see the hit count on their nat rulebase. Same exact issue in R81.20, it simply does not work...very disappointing, sorry guys.

Re: R81.20 feedback

the_rock — Sat, 26 Nov 2022 16:09:07 GMT

For anyone thinking of installing R81.20 as standalone...my advice, DO NOT do it : - ). I tried it 3 times...1st time, everything was so messed up, literally nothing worked. 2nd time, I got it installed, but internal CA was missing (???!!!), how, dont ask, I have no clue in the world. 3rd time, it worked, BUT, after about 30 mins, could not open default policy package, tried cloning, creating new one, nothing...so I totally gave up on it. Distributed seems to work well so far...some minor glitches here and there, but pretty solid I would say.

Re: R81.20 feedback

Hen_Hertz — Sun, 27 Nov 2022 07:20:40 GMT

Hi @the_rock , thanks for your feedback.
Can you please share more details on your standalone machine , ( appliance type , memory , disk space , any other configuration you can share ? )

I would like to check this issue internally.

Best Regards,

Hen.

Re: R81.20 feedback

Martin_Hofbauer — Sun, 27 Nov 2022 09:51:39 GMT

I wonder why you didn't invest your testing time (but now you do) in an EA install and give your feedback there so some/all of these issues could have been addressed there - before this version came out...