Enterprise DLP Limitations
Focus
Focus
Enterprise DLP

Enterprise DLP Limitations

Table of Contents

Enterprise DLP
Limitations

Review the
Enterprise Data Loss Prevention (E-DLP)
cloud service and plugin limitations.
The following are limitations associated with
Enterprise Data Loss Prevention (E-DLP)
cloud service and plugin.
Issue ID
Description
When using
Enterprise DLP
on Hub 1.0, the DLP app on the hub supports only Superuser administrative privileges. Role based access control for
Enterprise DLP
is supported on Hub 2.0 only.
A custom block response page for matched traffic blocked by
Enterprise DLP
is not supported for
NGFW
and
Prisma Access
managed by
Strata Cloud Manager
or
Panorama
.
WIF-1127
For PA-3250 firewalls running
PAN-OS
10.2.4 or
PAN-OS
10.2.5,
.zip
file uploads to the Zendesk application cannot be successfully blocked by
Enterprise DLP
and do not generate a DLP Incident on
Panorama
or the
NGFW
(
Monitor
Logs
Data Filtering
).
WIF-484
Detection of floating images is not supported when Optical Character Recognition on Panorama or Prisma Access (Managed by Strata Cloud Manager) is enabled.
WIF-215
On
Panorama
, the original connection to the Service URL FQDN is terminated before the connection to the new Service URL FQDN can be established after reconfiguring the Service URL Setting (
Device
Setup
Content-ID
).
PLUG-12944
After you upgrade
Panorama
and managed
NGFW
to
PAN-OS
11.0.2, the
Panorama
plugin for
Enterprise DLP
4.0.1 you downloaded on
Panorama
prior to upgrade does not automatically install.
Workaround:
After you successfully upgrade
Panorama
to
PAN-OS
11.0.2, manually install the downloaded
Enterprise DLP
plugin (
Panorama
Plugins
).
PLUG-12756
This limitation is addressed in
Enterprise DLP
version 3.0.4.
Predefined data filtering profile (
Objects
DLP
Data Filtering Profiles
)
File Direction
displays
Default
instead of
Upload
.
PLUG-11837
On
Panorama
, downgrading from the following
PAN-OS
releases does not restore the default
Upload
File Direction
for data filtering profiles (
Objects
DLP
Data Filtering Profiles
).
  • Downgrading from
    PAN-OS
    11.0.1 to
    PAN-OS
    11.0.0.
  • Downgrading from
    PAN-OS
    10.2.4 to
    PAN-OS
    10.2.3 or earlier release.
PLUG-10323
After you downgrade
Panorama
and
NGFW
to
PAN-OS
10.2.0 and
Enterprise DLP
plugin 3.0.0, the
Non-File Based
(
Objects
DLP
Data Filtering Profiles
) setting for a data filtering profile configured for non-file traffic data inspection erroneously displays as enabled on the managed firewall CLI.
Workaround:
Disable the Non-File Based setting on the data filtering profile before downgrading to
PAN-OS
10.2.0 and
Enterprise DLP
plugin 3.0.0.
  1. Log in to the
    Panorama
    web interface.
  2. Select
    Objects
    DLP
    Data Filtering Profiles
    .
  3. Configure the Non-File Based setting as
    No
    and click
    OK
    .
  4. Commit and push your configuration changes to your managed firewalls leveraging
    Enterprise DLP
    .
    1. Select
      Commit
      Commit to Panorama
      and
      Commit
      .
    2. Select
      Commit
      Push to Devices
      and
      Edit Selections
      .
    3. Select
      Device Groups
      and
      Include Device and Network Templates
      .
    4. Push
      your configuration changes to your managed firewalls leveraging
      Enterprise DLP
      .
PLUG-10252
Renaming an existing data profile on the DLP app on the hub creates an entirely new data filtering profile (
Objects
DLP
Data Filtering Profiles
) on
Panorama
.
PLUG-10172
On
Panorama
, the commit fails if the same profile (
Objects
DLP
Data Filtering Profiles
) is being edited on
Panorama
and the DLP app at the same time.
Workaround:
If you experience a commit failure when editing the data filtering profile on
Panorama
, you must discard the edits, reset the
Enterprise DLP
plugin, and reconfigure the data filtering profile.
PLUG-6159
On the
Panorama
, all
Enterprise DLP
data profiles (
Objects
DLP
Data Filtering Profiles
) are not displayed if you
Remove Config
(
Panorama
Plugins
) for the
Enterprise DLP
plugin and install the Cloud Services plugin.
Workaround:
After you successfully
Enterprise DLP
plugin configuration, log in to the Panorama CLI and reset the
Enterprise DLP
plugin to display the DLP data profiles.
admin>
request plugins dlp reset
PLUG-6121
On
Panorama
,
Enterprise DLP
data patterns and profiles do not function as expected after you load or revert a firewall configuration.
Workaround:
After you successfully load or revert a
NGFW
configuration, log in to the Panorama CLI and reset the
Enterprise DLP
plugin.
admin>
request plugins dlp reset
PAN-215405
File uploads to the Box application exceeding 20MB create multiple sessions if the data filtering profile (
Objects
DLP
Data Filtering Profile
Action is set to
Block
. This results in the Box application requiring multiple retries before the file upload is successfully attempted and blocked by the DLP cloud service.
PAN-211913
Enterprise DLP
does not support maintaining a session connection to continue inspection if a file download is paused. The DLP cloud service inspection is terminated for the file if the download operation is paused.
PAN-206877
The Gmail file attachment operation may sometimes get stuck or fail after multiple attempts if the DLP cloud service already scanned and blocked the file.
PAN-142785
Enterprise DLP
does not support custom response pages on
Panorama
and uses the default File Blocking Block Page response page (
Device
Response Pages
).
PAN-140057
Enterprise DLP
and IoT logs share log severity levels and cannot be configured individually.
DIT-27539
(
Enterprise DLP
3.0.3 only
) Increasing the max file size for the Enterprise DLP data filtering settings to 21 MB or greater is supported only from the
Panorama
CLI.
  1. Enter configuration mode.
    admin>
    configure
  2. Set the max file size data filtering setting.
    admin#
    set template <template_name> config shared dlp-settings max-file-size <1 - 100>

Recommended For You