PAN-OS 10.0.10 Addressed Issues
Table of Contents
Expand All
|
Collapse All
Next-Generation Firewall Docs
-
PAN-OS 11.1 & Later
- PAN-OS 11.1 & Later
- PAN-OS 11.0 (EoL)
- PAN-OS 10.2
- PAN-OS 10.1
- PAN-OS 10.0 (EoL)
- PAN-OS 9.1 (EoL)
- Cloud Management of NGFWs
-
- Management Interfaces
-
- Launch the Web Interface
- Use the Administrator Login Activity Indicators to Detect Account Misuse
- Manage and Monitor Administrative Tasks
- Commit, Validate, and Preview Firewall Configuration Changes
- Commit Selective Configuration Changes
- Export Configuration Table Data
- Use Global Find to Search the Firewall or Panorama Management Server
- Manage Locks for Restricting Configuration Changes
-
-
- Define Access to the Web Interface Tabs
- Provide Granular Access to the Monitor Tab
- Provide Granular Access to the Policy Tab
- Provide Granular Access to the Objects Tab
- Provide Granular Access to the Network Tab
- Provide Granular Access to the Device Tab
- Define User Privacy Settings in the Admin Role Profile
- Restrict Administrator Access to Commit and Validate Functions
- Provide Granular Access to Global Settings
- Provide Granular Access to the Panorama Tab
- Provide Granular Access to Operations Settings
- Panorama Web Interface Access Privileges
-
- Reset the Firewall to Factory Default Settings
-
- Plan Your Authentication Deployment
- Pre-Logon for SAML Authentication
- Configure SAML Authentication
- Configure Kerberos Single Sign-On
- Configure Kerberos Server Authentication
- Configure TACACS+ Authentication
- Configure TACACS Accounting
- Configure RADIUS Authentication
- Configure LDAP Authentication
- Configure Local Database Authentication
- Configure an Authentication Profile and Sequence
- Test Authentication Server Connectivity
- Troubleshoot Authentication Issues
-
- Keys and Certificates
- Default Trusted Certificate Authorities (CAs)
- Certificate Deployment
- Configure the Master Key
- Export a Certificate and Private Key
- Configure a Certificate Profile
- Configure an SSL/TLS Service Profile
- Configure an SSH Service Profile
- Replace the Certificate for Inbound Management Traffic
- Configure the Key Size for SSL Forward Proxy Server Certificates
-
- HA Overview
-
- Prerequisites for Active/Active HA
- Configure Active/Active HA
-
- Use Case: Configure Active/Active HA with Route-Based Redundancy
- Use Case: Configure Active/Active HA with Floating IP Addresses
- Use Case: Configure Active/Active HA with ARP Load-Sharing
- Use Case: Configure Active/Active HA with Floating IP Address Bound to Active-Primary Firewall
- Use Case: Configure Active/Active HA with Source DIPP NAT Using Floating IP Addresses
- Use Case: Configure Separate Source NAT IP Address Pools for Active/Active HA Firewalls
- Use Case: Configure Active/Active HA for ARP Load-Sharing with Destination NAT
- Use Case: Configure Active/Active HA for ARP Load-Sharing with Destination NAT in Layer 3
- HA Clustering Overview
- HA Clustering Best Practices and Provisioning
- Configure HA Clustering
- Refresh HA1 SSH Keys and Configure Key Options
- HA Firewall States
- Reference: HA Synchronization
-
- Use the Dashboard
- Monitor Applications and Threats
- Monitor Block List
-
- Report Types
- View Reports
- Configure the Expiration Period and Run Time for Reports
- Disable Predefined Reports
- Custom Reports
- Generate Custom Reports
- Generate the SaaS Application Usage Report
- Manage PDF Summary Reports
- Generate User/Group Activity Reports
- Manage Report Groups
- Schedule Reports for Email Delivery
- Manage Report Storage Capacity
- View Policy Rule Usage
- Use External Services for Monitoring
- Configure Log Forwarding
- Configure Email Alerts
-
- Configure Syslog Monitoring
-
- Traffic Log Fields
- Threat Log Fields
- URL Filtering Log Fields
- Data Filtering Log Fields
- HIP Match Log Fields
- GlobalProtect Log Fields
- IP-Tag Log Fields
- User-ID Log Fields
- Decryption Log Fields
- Tunnel Inspection Log Fields
- SCTP Log Fields
- Authentication Log Fields
- Config Log Fields
- System Log Fields
- Correlated Events Log Fields
- GTP Log Fields
- Audit Log Fields
- Syslog Severity
- Custom Log/Event Format
- Escape Sequences
- Forward Logs to an HTTP/S Destination
- Firewall Interface Identifiers in SNMP Managers and NetFlow Collectors
- Monitor Transceivers
-
- User-ID Overview
- Enable User-ID
- Map Users to Groups
- Enable User- and Group-Based Policy
- Enable Policy for Users with Multiple Accounts
- Verify the User-ID Configuration
-
- App-ID Overview
- App-ID and HTTP/2 Inspection
- Manage Custom or Unknown Applications
- Safely Enable Applications on Default Ports
- Applications with Implicit Support
-
- Prepare to Deploy App-ID Cloud Engine
- Enable or Disable the App-ID Cloud Engine
- App-ID Cloud Engine Processing and Policy Usage
- New App Viewer (Policy Optimizer)
- Add Apps to an Application Filter with Policy Optimizer
- Add Apps to an Application Group with Policy Optimizer
- Add Apps Directly to a Rule with Policy Optimizer
- Replace an RMA Firewall (ACE)
- Impact of License Expiration or Disabling ACE
- Commit Failure Due to Cloud Content Rollback
- Troubleshoot App-ID Cloud Engine
- Application Level Gateways
- Disable the SIP Application-level Gateway (ALG)
- Maintain Custom Timeouts for Data Center Applications
-
- Decryption Overview
-
- Keys and Certificates for Decryption Policies
- SSL Forward Proxy
- SSL Forward Proxy Decryption Profile
- SSL Inbound Inspection
- SSL Inbound Inspection Decryption Profile
- SSL Protocol Settings Decryption Profile
- SSH Proxy
- SSH Proxy Decryption Profile
- Profile for No Decryption
- SSL Decryption for Elliptical Curve Cryptography (ECC) Certificates
- Perfect Forward Secrecy (PFS) Support for SSL Decryption
- SSL Decryption and Subject Alternative Names (SANs)
- TLSv1.3 Decryption
- High Availability Not Supported for Decrypted Sessions
- Decryption Mirroring
- Configure SSL Forward Proxy
- Configure SSL Inbound Inspection
- Configure SSH Proxy
- Configure Server Certificate Verification for Undecrypted Traffic
- Post-Quantum Cryptography Detection and Control
- Enable Users to Opt Out of SSL Decryption
- Temporarily Disable SSL Decryption
- Configure Decryption Port Mirroring
- Verify Decryption
- Activate Free Licenses for Decryption Features
-
- Policy Types
- Policy Objects
- Track Rules Within a Rulebase
- Enforce Policy Rule Description, Tag, and Audit Comment
- Move or Clone a Policy Rule or Object to a Different Virtual System
-
- External Dynamic List
- Built-in External Dynamic Lists
- Configure the Firewall to Access an External Dynamic List
- Retrieve an External Dynamic List from the Web Server
- View External Dynamic List Entries
- Exclude Entries from an External Dynamic List
- Enforce Policy on an External Dynamic List
- Find External Dynamic Lists That Failed Authentication
- Disable Authentication for an External Dynamic List
- Register IP Addresses and Tags Dynamically
- Use Dynamic User Groups in Policy
- Use Auto-Tagging to Automate Security Actions
- CLI Commands for Dynamic IP Addresses and Tags
- Application Override Policy
- Test Policy Rules
-
- Network Segmentation Using Zones
- How Do Zones Protect the Network?
-
PAN-OS 11.1 & Later
- PAN-OS 11.1 & Later
- PAN-OS 11.0 (EoL)
- PAN-OS 10.2
- PAN-OS 10.1
-
- Tap Interfaces
-
- Layer 2 and Layer 3 Packets over a Virtual Wire
- Port Speeds of Virtual Wire Interfaces
- LLDP over a Virtual Wire
- Aggregated Interfaces for a Virtual Wire
- Virtual Wire Support of High Availability
- Zone Protection for a Virtual Wire Interface
- VLAN-Tagged Traffic
- Virtual Wire Subinterfaces
- Configure Virtual Wires
- Configure a PPPoE Client on a Subinterface
- Configure an IPv6 PPPoE Client
- Configure an Aggregate Interface Group
- Configure Bonjour Reflector for Network Segmentation
- Use Interface Management Profiles to Restrict Access
-
- DHCP Overview
- Firewall as a DHCP Server and Client
- Firewall as a DHCPv6 Client
- DHCP Messages
- Dynamic IPv6 Addressing on the Management Interface
- Configure an Interface as a DHCP Server
- Configure an Interface as a DHCPv4 Client
- Configure an Interface as a DHCPv6 Client with Prefix Delegation
- Configure the Management Interface as a DHCP Client
- Configure the Management Interface for Dynamic IPv6 Address Assignment
- Configure an Interface as a DHCP Relay Agent
-
- DNS Overview
- DNS Proxy Object
- DNS Server Profile
- Multi-Tenant DNS Deployments
- Configure a DNS Proxy Object
- Configure a DNS Server Profile
- Use Case 1: Firewall Requires DNS Resolution
- Use Case 2: ISP Tenant Uses DNS Proxy to Handle DNS Resolution for Security Policies, Reporting, and Services within its Virtual System
- Use Case 3: Firewall Acts as DNS Proxy Between Client and Server
- DNS Proxy Rule and FQDN Matching
-
- NAT Rule Capacities
- Dynamic IP and Port NAT Oversubscription
- Dataplane NAT Memory Statistics
-
- Translate Internal Client IP Addresses to Your Public IP Address (Source DIPP NAT)
- Create a Source NAT Rule with Persistent DIPP
- PAN-OS
- Strata Cloud Manager
- Enable Clients on the Internal Network to Access your Public Servers (Destination U-Turn NAT)
- Enable Bi-Directional Address Translation for Your Public-Facing Servers (Static Source NAT)
- Configure Destination NAT with DNS Rewrite
- Configure Destination NAT Using Dynamic IP Addresses
- Modify the Oversubscription Rate for DIPP NAT
- Reserve Dynamic IP NAT Addresses
- Disable NAT for a Specific Host or Interface
-
- Network Packet Broker Overview
- How Network Packet Broker Works
- Prepare to Deploy Network Packet Broker
- Configure Transparent Bridge Security Chains
- Configure Routed Layer 3 Security Chains
- Network Packet Broker HA Support
- User Interface Changes for Network Packet Broker
- Limitations of Network Packet Broker
- Troubleshoot Network Packet Broker
-
- Enable Advanced Routing
- Logical Router Overview
- Configure a Logical Router
- Create a Static Route
- Configure BGP on an Advanced Routing Engine
- Create BGP Routing Profiles
- Create Filters for the Advanced Routing Engine
- Configure OSPFv2 on an Advanced Routing Engine
- Create OSPF Routing Profiles
- Configure OSPFv3 on an Advanced Routing Engine
- Create OSPFv3 Routing Profiles
- Configure RIPv2 on an Advanced Routing Engine
- Create RIPv2 Routing Profiles
- Create BFD Profiles
- Configure IPv4 Multicast
- Configure MSDP
- Create Multicast Routing Profiles
- Create an IPv4 MRoute
-
-
PAN-OS 10.0 (EoL)
- PAN-OS 11.2
- PAN-OS 11.1
- PAN-OS 11.0 (EoL)
- PAN-OS 10.2
- PAN-OS 10.1
- PAN-OS 10.0 (EoL)
- PAN-OS 9.1 (EoL)
- PAN-OS 9.0 (EoL)
- PAN-OS 8.1 (EoL)
- Cloud Management and AIOps for NGFW
-
-
- Enterprise Data Loss Prevention Features
- IoT Security Features
- Content Inspection Features
- Decryption Features
- GlobalProtect Features
- Management Features
- Certificate Management Features
- Panorama Features
- Networking Features
- User-ID Features
- Policy Features
- Authentication Features
- WildFire Features
- Virtualization Features
- SD-WAN Features
- Mobile Infrastructure Security Features
- New Hardware Introduced with PAN-OS 10.0
- Changes to Default Behavior
- Associated Software and Content Versions
- Limitations
-
-
- PAN-OS 10.0.12 Known Issues
- PAN-OS 10.0.11 Known Issues
- PAN-OS 10.0.10 Known Issues
- PAN-OS 10.0.9 Known Issues
- PAN-OS 10.0.8 Known Issues
- PAN-OS 10.0.7 Known Issues
- PAN-OS 10.0.6 Known Issues
- PAN-OS 10.0.5 Known Issues
- PAN-OS 10.0.4 Known Issues
- PAN-OS 10.0.3 Known Issues
- PAN-OS 10.0.2 Known Issues
- PAN-OS 10.0.1 Known Issues
- Known Issues for the CN-Series on Version 10.0
-
-
-
- PAN-OS 10.0.12-h6 Addressed Issues
- PAN-OS 10.0.12-h5 Addressed Issues
- PAN-OS 10.0.12-h4 Addressed Issues
- PAN-OS 10.0.12-h3 Addressed Issues
- PAN-OS 10.0.12-h1 Addressed Issues
- PAN-OS 10.0.12 Addressed Issues
- PAN-OS 10.0.11-h4 Addressed Issues
- PAN-OS 10.0.11-h3 Addressed Issues
- PAN-OS 10.0.11-h1 Addressed Issues
- PAN-OS 10.0.11 Addressed Issues
- PAN-OS 10.0.10-h1 Addressed Issues
- PAN-OS 10.0.10 Addressed Issues
- PAN-OS 10.0.9 Addressed Issues
- PAN-OS 10.0.8-h11 Addressed Issues
- PAN-OS 10.0.8-h10 Addressed Issues
- PAN-OS 10.0.8-h8 Addressed Issues
- PAN-OS 10.0.8-h4 Addressed Issues
- PAN-OS 10.0.8 Addressed Issues
- PAN-OS 10.0.7 Addressed Issues
- PAN-OS 10.0.6 Addressed Issues
- PAN-OS 10.0.5 Addressed Issues
- PAN-OS 10.0.4 Addressed Issues
- PAN-OS 10.0.3 Addressed Issues
- PAN-OS 10.0.2 Addressed Issues
- PAN-OS 10.0.1 Addressed Issues
- PAN-OS 10.0.0 Addressed Issues
End-of-Life (EoL)
PAN-OS 10.0.10 Addressed Issues
PAN-OS® 10.0.10 addressed issues.
Issue ID | Description |
---|---|
PAN-190175 and PAN-190223 | A fix was made to address an OpenSSL infinite
loop vulnerability in the PAN-OS software (CVE-2022-0778). |
PAN-189665 | (FIPS-CC enabled firewalls only)
Fixed an issue where the firewall was unable to connect to log collectors
after an upgrade due to missing cipher suites. |
PAN-185616 | Fixed an issue where the firewall sent fewer
logs to the system log server than expected. With this fix, the
firewall accommodates a larger send queue for syslog forwarding
to TCP syslog receivers. |
PAN-185163 | Fixed an issue where the distributord process
hit the FD limit, which caused User-ID redistribution to not function properly. |
PAN-184693 | Fixed an issue that caused the slotd process
to stop responding due to an incorrect response from etcd lock API. |
PAN-183862 | Fixed an issue where, after a CN-NGFW pod
failed-over to the second CN-MGMT pod, the configuration was not
synchronized between the new CN-MGMT pod and the CN-NGFW pod. |
PAN-183774 | Fixed an memory leak issue in the mgmtsrvr process,
which resulted in an out-of-memory (OOM) condition and high availability
(HA) failover. |
PAN-183239 | Fixed an issue where the firewall randomly
disconnected from the WildFire URL cloud. |
PAN-182903 | Fixed an issue where SD-WAN failover on
a hub or branch in full mesh took longer than expected. |
PAN-181839 | Fixed an issue where Panorama Global Search
reported No Matches found while still returning
results for matching entries on large configurations. |
PAN-181039 | Fixed an issue with DNS cache depletion
that caused continuous DNS retries. |
PAN-181031 | Fixed an issue where the CN-NGFW (DP) folder
on the CN-MGMT pod eventually consumed a large amount of space in
the /var/log/pan because the old registered stale next-generation
firewall logs were not being cleared. |
PAN-180916 | Fixed an issue where DNS security caused
the TTL (time-to-live) value of the pointer record (PTR) to be overwritten
with a value of 30 seconds. |
PAN-179982 | Fixed an issue where an OOM condition occurred
due to quarantine list redistribution. |
PAN-179976 | Fixed an issue where the WildFire Inline
Machine Learning (ML) did not detect mlav-test-pe-file.exe when
traffic was decrypted. |
PAN-179703 | Fixed an issue where dataplane interfaces
weren't released when the secured application pods were deleted. |
PAN-179413 | Fixed an issue where GRE tunnels flapped
during commit jobs. |
PAN-179321 | A validation error was added to inform an
administrator when a policy field contained the value any. |
PAN-179274 | Fixed an issue on high availability configurations
where, after upgrading to PAN-OS 9.1.10, PAN-OS 10.0.6, or PAN-OS
10.1.0, the HA1 and HA1-Backup link stayed down. This issue occurred
when the peer firewall IP address was in a different subnet. |
PAN-179164 | Fixed an issue where a web-proxy port number
was added to the destination URL when captive portal authentication
was run. |
PAN-179059 | Fixed an issue where you were unable to
delete dynamic address groups one at a time using XML API. |
PAN-178947 | Fixed an issue where the useridd process stopped
responding when a NULL reference attempted to be dereferenced. This
issue occurred to IP address users being added. |
PAN-177907 | Fixed an issue where, after rebooting the
firewall, FQDN address objects referred in rules in a virtual system
(vsys) did not resolve when the vsys used a custom DNS proxy. |
PAN-177878 | Fixed an issue where a role-based admin
with Operational Requests enabled under the
XML API section was unable to set the License Deactivation API key. |
PAN-177626 | Fixed an issue where aggressive situations
caused on-chip descriptor exhaustion. |
PAN-177551 | A fix was made to address a vulnerability
that enabled an authenticated network-based administrator to upload
a specifically created configuration that disrupted system processes
and was able to execute arbitrary code with root privileges when
the configuration was committed (CVE-2022-0024). |
PAN-177187 | Fixed an issue where reports using the decryption
summary database and Panorama as data sources returned no results. |
PAN-177170 | Fixed an issue on Panorama where a log collector
group commit deleted the proxy settings configured on dedicated
log collectors. |
PAN-176889 | Fixed an issue where the log collector continuously
disconnected from Panorama due to high latency and a high number
of packets in Send-Q. |
PAN-176703 | Fixed an issue that occurred after upgrading
to a PAN-OS 9.0 or later release where commits to the firewall configuration
failed with the following error message: statistics-service is invalid. |
PAN-176348 | Fixed an issue where scheduled email alerts
were not forwarded to all recipients in the override list. |
PAN-175716 | Fixed an issue where sorting address groups
by name, address, or location did not work on a device group that
was part of a nested device group. |
PAN-175628 | (PA-5200 Series firewalls only)
Fixed an issue where the firewall was unable to monitor AUX1 and
AUX2 interfaces through SNMP. |
PAN-175259 | Fixed an issue where a Security policy configured
with App-ID and set to web-browsing and application-default
service allowed clear-text web-browsing on tcp/443. |
PAN-175161 | Fixed an issue where changing SSL connection
validation settings for system logs caused the mgmtsrvr process
to stop responding. |
PAN-174809 | Fixed an issue where a process (all_pktproc) restarted. |
PAN-174607 | Fixed an intermittent issue where, when
Security profiles were attached to a policy, files that were downloaded
across TLS sessions decrypted by the firewall were malformed. |
PAN-174587 | Fixed an issue where, in the case of multiple
AWS Partner Network (APN) connections, the GPRS tunneling protocol
(GTPv2) Create Session Requests were sent to the firewall within
a short interval, which caused the firewall to create the GTP-sessions
incorrectly. |
PAN-174011 | Fixed an issue where Panorama failed to
update shared policies during partial commits when a new device
group was created but not yet committed. |
PAN-171345 | Fixed an issue where firewalls experienced
high packet descriptor usage due to internal communication associated
with WildFire. |
PAN-171181 | Fixed an issue where the IPSec tunnel configuration
didn't load when a double quotation mark was added to the comment
section of the IPSec tunnel General tab. |
PAN-171104 | Fixed an issue where a race-condition check
returned a false negative, which caused a process (all_task)
to stop responding and generate a core file. |
PAN-170952 | Fixed script issues that caused diagnostic
data to not be collected after path monitor failure. |
PAN-168400 | Fixed an issue where, after installing Cloud
Services plugin 10.2, the Plugin cloud_services status (Dashboard
> High Availability) displayed as Mismatch. |
PAN-168286 | Fixed a memory leak issue in the mgmtsrvr process
that was caused by failed commit all operations. |
PAN-167849 | Fixed an issue where URL Filtering incorrectly
identified the firewall serial number in the certificate Common Name field
as the IP address. |
PAN-164871 | (VM-Series firewalls only) Fixed
an intermittent issue where deactivating the firewall via XML API
using manual mode failed. This occurred because the size of the
license token file was incorrect. |
PAN-163245 | Fixed an issue where a commit-all or push
to the firewall from Panorama failed with the following error message: client routed requesting last config in the middle of a commit/validate. Aborting current commit/validate. |
PAN-161297 | Fixed an interoperability issue with other
vendors when IKEv2 used SHA2-based certificate authentication. |
PAN-155448 | Fixed an issue where credential detection
didn't work in IP address-to-username mapping mode because the firewall
compared the unnormalized IP-address-to-username mapping format
to the normalized username extracted from the payload where the
username and password were submitted. |