Filter

Expand All | Collapse All

Enterprise DLP Docs

Administration
Release Notes

Focus

Enterprise DLP

Enterprise DLP Limitations

Table of Contents

Known Issues in Enterprise DLP Plugin 1.0.1

Enterprise DLP
Limitations

Review the

Enterprise Data Loss Prevention (E-DLP)

cloud service and plugin limitations.

The following are limitations associated with

Enterprise Data Loss Prevention (E-DLP)

cloud service and plugin.

Issue ID	Description
—	When using Enterprise DLP on Hub 1.0, the DLP app on the hub supports only Superuser administrative privileges. Role based access control for Enterprise DLP is supported on Hub 2.0 only.
—	A custom block response page for matched traffic blocked by Enterprise DLP is not supported for NGFW and Prisma Access managed by Strata Cloud Manager or Panorama .
WIF-1127	For PA-3250 firewalls running PAN-OS 10.2.4 or PAN-OS 10.2.5, .zip file uploads to the Zendesk application cannot be successfully blocked by Enterprise DLP and do not generate a DLP Incident on Panorama or the NGFW ( Monitor Logs Data Filtering ).
WIF-484	Detection of floating images is not supported when Optical Character Recognition on Panorama or Prisma Access (Managed by Strata Cloud Manager) is enabled.
WIF-215	On Panorama , the original connection to the Service URL FQDN is terminated before the connection to the new Service URL FQDN can be established after reconfiguring the Service URL Setting ( Device Setup Content-ID ).
PLUG-12944	After you upgrade Panorama and managed NGFW to PAN-OS 11.0.2, the Panorama plugin for Enterprise DLP 4.0.1 you downloaded on Panorama prior to upgrade does not automatically install. Workaround: After you successfully upgrade Panorama to PAN-OS 11.0.2, manually install the downloaded Enterprise DLP plugin ( Panorama Plugins ).
PLUG-12756 `This limitation is addressed in Enterprise DLP version 3.0.4.`	Predefined data filtering profile ( Objects DLP Data Filtering Profiles ) File Direction displays Default instead of Upload .
PLUG-11837	On Panorama , downgrading from the following PAN-OS releases does not restore the default Upload File Direction for data filtering profiles ( Objects DLP Data Filtering Profiles ). Downgrading from PAN-OS 11.0.1 to PAN-OS 11.0.0. Downgrading from PAN-OS 10.2.4 to PAN-OS 10.2.3 or earlier release.
PLUG-10323	After you downgrade Panorama and NGFW to PAN-OS 10.2.0 and Enterprise DLP plugin 3.0.0, the Non-File Based ( Objects DLP Data Filtering Profiles ) setting for a data filtering profile configured for non-file traffic data inspection erroneously displays as enabled on the managed firewall CLI. Workaround: Disable the Non-File Based setting on the data filtering profile before downgrading to PAN-OS 10.2.0 and Enterprise DLP plugin 3.0.0. Log in to the Panorama web interface. Select Objects DLP Data Filtering Profiles . Configure the Non-File Based setting as No and click OK . Commit and push your configuration changes to your managed firewalls leveraging Enterprise DLP . Select Commit Commit to Panorama and Commit . Select Commit Push to Devices and Edit Selections . Select Device Groups and Include Device and Network Templates . Push your configuration changes to your managed firewalls leveraging Enterprise DLP .
PLUG-10252	Renaming an existing data profile on the DLP app on the hub creates an entirely new data filtering profile ( Objects DLP Data Filtering Profiles ) on Panorama .
PLUG-10172	On Panorama , the commit fails if the same profile ( Objects DLP Data Filtering Profiles ) is being edited on Panorama and the DLP app at the same time. Workaround: If you experience a commit failure when editing the data filtering profile on Panorama , you must discard the edits, reset the Enterprise DLP plugin, and reconfigure the data filtering profile. Log in to the Panorama CLI. Reset the Enterprise DLP plugin. admin> request plugins dlp reset Log in to the Panorama web interface. Update the data filtering profile on Panorama.
PLUG-6159	On the Panorama , all Enterprise DLP data profiles ( Objects DLP Data Filtering Profiles ) are not displayed if you Remove Config ( Panorama Plugins ) for the Enterprise DLP plugin and install the Cloud Services plugin. Workaround: After you successfully Enterprise DLP plugin configuration, log in to the Panorama CLI and reset the Enterprise DLP plugin to display the DLP data profiles. admin> request plugins dlp reset
PLUG-6121	On Panorama , Enterprise DLP data patterns and profiles do not function as expected after you load or revert a firewall configuration. Workaround: After you successfully load or revert a NGFW configuration, log in to the Panorama CLI and reset the Enterprise DLP plugin. admin> request plugins dlp reset
PAN-215405	File uploads to the Box application exceeding 20MB create multiple sessions if the data filtering profile ( Objects DLP Data Filtering Profile Action is set to Block . This results in the Box application requiring multiple retries before the file upload is successfully attempted and blocked by the DLP cloud service.
PAN-211913	Enterprise DLP does not support maintaining a session connection to continue inspection if a file download is paused. The DLP cloud service inspection is terminated for the file if the download operation is paused.
PAN-206877	The Gmail file attachment operation may sometimes get stuck or fail after multiple attempts if the DLP cloud service already scanned and blocked the file.
PAN-142785	Enterprise DLP does not support custom response pages on Panorama and uses the default File Blocking Block Page response page ( Device Response Pages ).
PAN-140057	Enterprise DLP and IoT logs share log severity levels and cannot be configured individually.
DIT-27539	(`Enterprise DLP 3.0.3 only`) Increasing the max file size for the Enterprise DLP data filtering settings to 21 MB or greater is supported only from the Panorama CLI. Log in to the Panorama CLI. Enter configuration mode. admin> configure Set the max file size data filtering setting. admin# set template <template_name> config shared dlp-settings max-file-size <1 - 100>

Known Issues in Enterprise DLP Plugin 1.0.1