PAN-OS 10.0.8 Addressed Issues
Table of Contents
Expand All
|
Collapse All
Next-Generation Firewall Docs
-
PAN-OS 11.1 & Later
- PAN-OS 11.1 & Later
- PAN-OS 11.0 (EoL)
- PAN-OS 10.2
- PAN-OS 10.1
- PAN-OS 10.0 (EoL)
- PAN-OS 9.1 (EoL)
- Cloud Management of NGFWs
-
- Management Interfaces
-
- Launch the Web Interface
- Use the Administrator Login Activity Indicators to Detect Account Misuse
- Manage and Monitor Administrative Tasks
- Commit, Validate, and Preview Firewall Configuration Changes
- Commit Selective Configuration Changes
- Export Configuration Table Data
- Use Global Find to Search the Firewall or Panorama Management Server
- Manage Locks for Restricting Configuration Changes
-
-
- Define Access to the Web Interface Tabs
- Provide Granular Access to the Monitor Tab
- Provide Granular Access to the Policy Tab
- Provide Granular Access to the Objects Tab
- Provide Granular Access to the Network Tab
- Provide Granular Access to the Device Tab
- Define User Privacy Settings in the Admin Role Profile
- Restrict Administrator Access to Commit and Validate Functions
- Provide Granular Access to Global Settings
- Provide Granular Access to the Panorama Tab
- Provide Granular Access to Operations Settings
- Panorama Web Interface Access Privileges
-
- Reset the Firewall to Factory Default Settings
-
- Plan Your Authentication Deployment
- Pre-Logon for SAML Authentication
- Configure SAML Authentication
- Configure Kerberos Single Sign-On
- Configure Kerberos Server Authentication
- Configure TACACS+ Authentication
- Configure TACACS Accounting
- Configure RADIUS Authentication
- Configure LDAP Authentication
- Configure Local Database Authentication
- Configure an Authentication Profile and Sequence
- Test Authentication Server Connectivity
- Troubleshoot Authentication Issues
-
- Keys and Certificates
- Default Trusted Certificate Authorities (CAs)
- Certificate Deployment
- Configure the Master Key
- Export a Certificate and Private Key
- Configure a Certificate Profile
- Configure an SSL/TLS Service Profile
- Configure an SSH Service Profile
- Replace the Certificate for Inbound Management Traffic
- Configure the Key Size for SSL Forward Proxy Server Certificates
-
- HA Overview
-
- Prerequisites for Active/Active HA
- Configure Active/Active HA
-
- Use Case: Configure Active/Active HA with Route-Based Redundancy
- Use Case: Configure Active/Active HA with Floating IP Addresses
- Use Case: Configure Active/Active HA with ARP Load-Sharing
- Use Case: Configure Active/Active HA with Floating IP Address Bound to Active-Primary Firewall
- Use Case: Configure Active/Active HA with Source DIPP NAT Using Floating IP Addresses
- Use Case: Configure Separate Source NAT IP Address Pools for Active/Active HA Firewalls
- Use Case: Configure Active/Active HA for ARP Load-Sharing with Destination NAT
- Use Case: Configure Active/Active HA for ARP Load-Sharing with Destination NAT in Layer 3
- HA Clustering Overview
- HA Clustering Best Practices and Provisioning
- Configure HA Clustering
- Refresh HA1 SSH Keys and Configure Key Options
- HA Firewall States
- Reference: HA Synchronization
-
- Use the Dashboard
- Monitor Applications and Threats
- Monitor Block List
-
- Report Types
- View Reports
- Configure the Expiration Period and Run Time for Reports
- Disable Predefined Reports
- Custom Reports
- Generate Custom Reports
- Generate the SaaS Application Usage Report
- Manage PDF Summary Reports
- Generate User/Group Activity Reports
- Manage Report Groups
- Schedule Reports for Email Delivery
- Manage Report Storage Capacity
- View Policy Rule Usage
- Use External Services for Monitoring
- Configure Log Forwarding
- Configure Email Alerts
-
- Configure Syslog Monitoring
-
- Traffic Log Fields
- Threat Log Fields
- URL Filtering Log Fields
- Data Filtering Log Fields
- HIP Match Log Fields
- GlobalProtect Log Fields
- IP-Tag Log Fields
- User-ID Log Fields
- Decryption Log Fields
- Tunnel Inspection Log Fields
- SCTP Log Fields
- Authentication Log Fields
- Config Log Fields
- System Log Fields
- Correlated Events Log Fields
- GTP Log Fields
- Audit Log Fields
- Syslog Severity
- Custom Log/Event Format
- Escape Sequences
- Forward Logs to an HTTP/S Destination
- Firewall Interface Identifiers in SNMP Managers and NetFlow Collectors
- Monitor Transceivers
-
- User-ID Overview
- Enable User-ID
- Map Users to Groups
- Enable User- and Group-Based Policy
- Enable Policy for Users with Multiple Accounts
- Verify the User-ID Configuration
-
- App-ID Overview
- App-ID and HTTP/2 Inspection
- Manage Custom or Unknown Applications
- Safely Enable Applications on Default Ports
- Applications with Implicit Support
-
- Prepare to Deploy App-ID Cloud Engine
- Enable or Disable the App-ID Cloud Engine
- App-ID Cloud Engine Processing and Policy Usage
- New App Viewer (Policy Optimizer)
- Add Apps to an Application Filter with Policy Optimizer
- Add Apps to an Application Group with Policy Optimizer
- Add Apps Directly to a Rule with Policy Optimizer
- Replace an RMA Firewall (ACE)
- Impact of License Expiration or Disabling ACE
- Commit Failure Due to Cloud Content Rollback
- Troubleshoot App-ID Cloud Engine
- Application Level Gateways
- Disable the SIP Application-level Gateway (ALG)
- Maintain Custom Timeouts for Data Center Applications
-
- Decryption Overview
-
- Keys and Certificates for Decryption Policies
- SSL Forward Proxy
- SSL Forward Proxy Decryption Profile
- SSL Inbound Inspection
- SSL Inbound Inspection Decryption Profile
- SSL Protocol Settings Decryption Profile
- SSH Proxy
- SSH Proxy Decryption Profile
- Profile for No Decryption
- SSL Decryption for Elliptical Curve Cryptography (ECC) Certificates
- Perfect Forward Secrecy (PFS) Support for SSL Decryption
- SSL Decryption and Subject Alternative Names (SANs)
- TLSv1.3 Decryption
- High Availability Not Supported for Decrypted Sessions
- Decryption Mirroring
- Configure SSL Forward Proxy
- Configure SSL Inbound Inspection
- Configure SSH Proxy
- Configure Server Certificate Verification for Undecrypted Traffic
- Post-Quantum Cryptography Detection and Control
- Enable Users to Opt Out of SSL Decryption
- Temporarily Disable SSL Decryption
- Configure Decryption Port Mirroring
- Verify Decryption
- Activate Free Licenses for Decryption Features
-
- Policy Types
- Policy Objects
- Track Rules Within a Rulebase
- Enforce Policy Rule Description, Tag, and Audit Comment
- Move or Clone a Policy Rule or Object to a Different Virtual System
-
- External Dynamic List
- Built-in External Dynamic Lists
- Configure the Firewall to Access an External Dynamic List
- Retrieve an External Dynamic List from the Web Server
- View External Dynamic List Entries
- Exclude Entries from an External Dynamic List
- Enforce Policy on an External Dynamic List
- Find External Dynamic Lists That Failed Authentication
- Disable Authentication for an External Dynamic List
- Register IP Addresses and Tags Dynamically
- Use Dynamic User Groups in Policy
- Use Auto-Tagging to Automate Security Actions
- CLI Commands for Dynamic IP Addresses and Tags
- Application Override Policy
- Test Policy Rules
-
- Network Segmentation Using Zones
- How Do Zones Protect the Network?
-
PAN-OS 11.1 & Later
- PAN-OS 11.1 & Later
- PAN-OS 11.0 (EoL)
- PAN-OS 10.2
- PAN-OS 10.1
-
- Tap Interfaces
-
- Layer 2 and Layer 3 Packets over a Virtual Wire
- Port Speeds of Virtual Wire Interfaces
- LLDP over a Virtual Wire
- Aggregated Interfaces for a Virtual Wire
- Virtual Wire Support of High Availability
- Zone Protection for a Virtual Wire Interface
- VLAN-Tagged Traffic
- Virtual Wire Subinterfaces
- Configure Virtual Wires
- Configure a PPPoE Client on a Subinterface
- Configure an IPv6 PPPoE Client
- Configure an Aggregate Interface Group
- Configure Bonjour Reflector for Network Segmentation
- Use Interface Management Profiles to Restrict Access
-
- DHCP Overview
- Firewall as a DHCP Server and Client
- Firewall as a DHCPv6 Client
- DHCP Messages
- Dynamic IPv6 Addressing on the Management Interface
- Configure an Interface as a DHCP Server
- Configure an Interface as a DHCPv4 Client
- Configure an Interface as a DHCPv6 Client with Prefix Delegation
- Configure the Management Interface as a DHCP Client
- Configure the Management Interface for Dynamic IPv6 Address Assignment
- Configure an Interface as a DHCP Relay Agent
-
- DNS Overview
- DNS Proxy Object
- DNS Server Profile
- Multi-Tenant DNS Deployments
- Configure a DNS Proxy Object
- Configure a DNS Server Profile
- Use Case 1: Firewall Requires DNS Resolution
- Use Case 2: ISP Tenant Uses DNS Proxy to Handle DNS Resolution for Security Policies, Reporting, and Services within its Virtual System
- Use Case 3: Firewall Acts as DNS Proxy Between Client and Server
- DNS Proxy Rule and FQDN Matching
-
- NAT Rule Capacities
- Dynamic IP and Port NAT Oversubscription
- Dataplane NAT Memory Statistics
-
- Translate Internal Client IP Addresses to Your Public IP Address (Source DIPP NAT)
- Create a Source NAT Rule with Persistent DIPP
- PAN-OS
- Strata Cloud Manager
- Enable Clients on the Internal Network to Access your Public Servers (Destination U-Turn NAT)
- Enable Bi-Directional Address Translation for Your Public-Facing Servers (Static Source NAT)
- Configure Destination NAT with DNS Rewrite
- Configure Destination NAT Using Dynamic IP Addresses
- Modify the Oversubscription Rate for DIPP NAT
- Reserve Dynamic IP NAT Addresses
- Disable NAT for a Specific Host or Interface
-
- Network Packet Broker Overview
- How Network Packet Broker Works
- Prepare to Deploy Network Packet Broker
- Configure Transparent Bridge Security Chains
- Configure Routed Layer 3 Security Chains
- Network Packet Broker HA Support
- User Interface Changes for Network Packet Broker
- Limitations of Network Packet Broker
- Troubleshoot Network Packet Broker
-
- Enable Advanced Routing
- Logical Router Overview
- Configure a Logical Router
- Create a Static Route
- Configure BGP on an Advanced Routing Engine
- Create BGP Routing Profiles
- Create Filters for the Advanced Routing Engine
- Configure OSPFv2 on an Advanced Routing Engine
- Create OSPF Routing Profiles
- Configure OSPFv3 on an Advanced Routing Engine
- Create OSPFv3 Routing Profiles
- Configure RIPv2 on an Advanced Routing Engine
- Create RIPv2 Routing Profiles
- Create BFD Profiles
- Configure IPv4 Multicast
- Configure MSDP
- Create Multicast Routing Profiles
- Create an IPv4 MRoute
-
-
PAN-OS 10.0 (EoL)
- PAN-OS 11.2
- PAN-OS 11.1
- PAN-OS 11.0 (EoL)
- PAN-OS 10.2
- PAN-OS 10.1
- PAN-OS 10.0 (EoL)
- PAN-OS 9.1 (EoL)
- PAN-OS 9.0 (EoL)
- PAN-OS 8.1 (EoL)
- Cloud Management and AIOps for NGFW
-
-
- Enterprise Data Loss Prevention Features
- IoT Security Features
- Content Inspection Features
- Decryption Features
- GlobalProtect Features
- Management Features
- Certificate Management Features
- Panorama Features
- Networking Features
- User-ID Features
- Policy Features
- Authentication Features
- WildFire Features
- Virtualization Features
- SD-WAN Features
- Mobile Infrastructure Security Features
- New Hardware Introduced with PAN-OS 10.0
- Changes to Default Behavior
- Associated Software and Content Versions
- Limitations
-
-
- PAN-OS 10.0.12 Known Issues
- PAN-OS 10.0.11 Known Issues
- PAN-OS 10.0.10 Known Issues
- PAN-OS 10.0.9 Known Issues
- PAN-OS 10.0.8 Known Issues
- PAN-OS 10.0.7 Known Issues
- PAN-OS 10.0.6 Known Issues
- PAN-OS 10.0.5 Known Issues
- PAN-OS 10.0.4 Known Issues
- PAN-OS 10.0.3 Known Issues
- PAN-OS 10.0.2 Known Issues
- PAN-OS 10.0.1 Known Issues
- Known Issues for the CN-Series on Version 10.0
-
-
-
- PAN-OS 10.0.12-h6 Addressed Issues
- PAN-OS 10.0.12-h5 Addressed Issues
- PAN-OS 10.0.12-h4 Addressed Issues
- PAN-OS 10.0.12-h3 Addressed Issues
- PAN-OS 10.0.12-h1 Addressed Issues
- PAN-OS 10.0.12 Addressed Issues
- PAN-OS 10.0.11-h4 Addressed Issues
- PAN-OS 10.0.11-h3 Addressed Issues
- PAN-OS 10.0.11-h1 Addressed Issues
- PAN-OS 10.0.11 Addressed Issues
- PAN-OS 10.0.10-h1 Addressed Issues
- PAN-OS 10.0.10 Addressed Issues
- PAN-OS 10.0.9 Addressed Issues
- PAN-OS 10.0.8-h11 Addressed Issues
- PAN-OS 10.0.8-h10 Addressed Issues
- PAN-OS 10.0.8-h8 Addressed Issues
- PAN-OS 10.0.8-h4 Addressed Issues
- PAN-OS 10.0.8 Addressed Issues
- PAN-OS 10.0.7 Addressed Issues
- PAN-OS 10.0.6 Addressed Issues
- PAN-OS 10.0.5 Addressed Issues
- PAN-OS 10.0.4 Addressed Issues
- PAN-OS 10.0.3 Addressed Issues
- PAN-OS 10.0.2 Addressed Issues
- PAN-OS 10.0.1 Addressed Issues
- PAN-OS 10.0.0 Addressed Issues
End-of-Life (EoL)
PAN-OS 10.0.8 Addressed Issues
PAN-OS® 10.0.8 addressed issues.
Issue ID | Description |
---|---|
WF500-5561 | Fixed an issue where high disk use occurred
due to an inadequate rotation of log files in php_error.log, sdownload_error.log, sdownload_access.log and nginx_error.log |
PAN-178672 | Fixed an issue where a process (useridd) stopped
responding due to buffer overflow. |
PAN-178047 | (CN-Series firewalls only) Fixed
an issue where propagating IP address tag mappings to the firewall
took longer than expected, which resulted in traffic not matching
Security policy rules with Dynamic Address Groups. |
PAN-177941 | Fixed an issue where the bcm.log and brdagent_stdout.log-<datestamp> files
filled up the root disk space. |
PAN-177409 | Fixed an issue where, when the quarantine
feature was enabled, every hostid lookup
created a new entry in the cache memory instead of having a single
cache entry for each IP address, which led to memory exhaustion. |
PAN-176661 | Fixed an issue in Simple Certificate Enrollment
Protocol (SCEP) (CVE-2021-3060). |
PAN-176655 and PAN-158334 | A fix was made to address an OS command
injection vulnerability in the PAN-OS CLI that enabled an authenticated
administrator with access to the CLI to execute arbitrary OS commands
to escalate privileges (CVE-2021-3061). |
PAN-176653 | A fix was made to address an OS command
injection vulnerability in the PAN-OS web interface that enabled
an authenticated administrator with permissions to use XML API to
execute arbitrary OS commands to escalate privileges (CVE-2021-3058). |
PAN-176618 | A fix was made to address an OS command
injection vulnerability in PAN-OS that existed when performing dynamic
updates (CVE-2021-3059). |
PAN-176433 | Fixed an issue where the Zero Touch Provisioning
(ZTP) plugin on Panorama was unable to sync with the ZTP service
and displayed the following error message: Failed to fetch sync status. |
PAN-176283 | (PA-7000 Series firewalls with Data
Processing Cards (DPCs) only) Fixed an issue where packet loss
occurred when quality of service was enabled on an aggregate interface. |
PAN-176277 | Fixed a timing issue that impacted tunnel
renegotiation and monitoring. |
PAN-176118 | Fixed an issue where firewalls configured
with a mixed mode of interfaces stopped processing Layer-3-tagged
traffic. |
PAN-175509 | Fixed an issue where a deadlock on CONFIG_LOCK caused
both the web interface and CLI commands to time out until the mgmtsrvr process
was restarted. |
PAN-175403 | (VM-Series firewalls only) Fixed
an issue where the firewall did not display any logs except for
system logs. |
PAN-175233 | Fixed an issue where commits failed when
an AES-GCM crypto profile was used for IKEv1 mode. |
PAN-175169 | Fixed an issue on Panorama where, in URL Filtering (Device
> Setup > Content-ID), Hold client request for category lookup configuration
changes were not pushed to managed firewalls running PAN-OS 9.1
release versions. |
PAN-175121 | Fixed a rare issue where, when two nodes
started IKE_SA negotiations at the same time, which resulted in
duplicate IKE SAs. |
PAN-174448 | Fixed an issue where ZTP configurations
weren’t removed after disabling them, which resulted in predefined
configurations being loaded after a reboot. |
PAN-174326 | A fix was made to address an OS command
injection vulnerability in the PAN-OS web interface that enabled
an authenticated administrator to execute arbitrary OS commands
to escalate privileges (CVE-2021-3050). |
PAN-173903 | Fixed an issue where clicking a hyperlink
on a web page caused the web browser to download a file instead. |
PAN-173893 | Fixed a memory leak issue related to the (useridd)
process that occurred when group mapping is enabled. |
PAN-173828 | (PA-7000 Series firewalls with 20GQ
Network Processing Cards (NPCs) only) Fixed an issue on high
availability active/passive configurations where data ports on the
passive firewall sent out packets, which caused a MAC flap on upstream
firewalls. |
PAN-173216 | Fixed an issue where the firewall incorrectly
handled HTML pages when accessed via the GlobalProtect Clientless
VPN. |
PAN-172853 | Fixed an issue where Panorama appliances
running a PAN-OS 10.0 release did not push the Security policy options no-hip and quarantine to
firewalls running PAN-OS 9.1. |
PAN-172834 | Fixed a memory leak issue related to the useridd process
that occurred when processing IP-address-to-username mappings. |
PAN-172768 | Fixed an issue where HIP report generation
caused a memory leak on a process (useridd). |
PAN-172726 | Fixed an issue where the policy-based forwarding
(PBF) ID was overwritten by the EMCP ID, which caused PBF to stop
working. |
PAN-172580 | Fixed an intermittent issue where commits
failed after a commit validation and were modified for custom URL
category objects. |
PAN-172490 | Fixed an issue on firewalls in HA configuration
where HA-2 links continuously flapped on HSCI interfaces after upgrading
to PAN-OS 8.1.19. |
PAN-172464 | Fixed an issue where unicast DHCP discover
or request packets were silently dropped. |
PAN-172295 | Fixed an issue where a HIP database cache
loop caused high CPU utilization on a process (useridd)
and caused IP address-to-user mapping redistribution failure. |
PAN-172179 | (PA-7000b firewalls only) Fixed
an issue where, when GPRS tunneling protocol (GTP-U) tunnel acceleration
was enabled but Mobile Network Protection was not enabled on the
corresponding policy, GTP-U traffic was dropped. |
PAN-171290 | Fixed an issue where Panorama deployed in
Google Cloud Platform (GCP) failed to the renew management server
DHCP IP. |
PAN-171241 | |
PAN-171174 | Console debug output was enhanced to address
issues that led to a loss of SSH and web interface access. |
PAN-170932 | Fixed an issue in Telemetry settings where
the OK button was disabled when Telemetry
Region was set to None. |
PAN-170926 | Fixed an issue where the threat name was
not displayed on an Antivirus Block Page when using the threatname variable. |
PAN-170574 | (Panorama appliances on Microsoft Azure
and Amazon Web Services (AWS) only) Fixed an issue where Panorama
sent 127.0.0.1 as the NAS-IP-Address
in RADIUS messages. |
PAN-170297 | Fixed an issue where ACCThreat activity did not include
the threat name after upgrading to a PAN-OS 10.0 release. |
PAN-170103 | Fixed an issue where a process (ikemgr)
stopped responding while making configuration changes. This issue
occurred if Site-to-Site IPSec was using certification-based authentication. |
PAN-169793 | Fixed an issue where using cookies to authenticate
MacOS users didn't work due to the client agent not providing the phpsessionid set
from the sent GlobalProtect messages during the connection. As a
result, the firewall was unable to find and include the portal authentication
cookie in the response message. |
PAN-169687 | Fixed an issue where SNMP returned an improper
status for an unsupported interface type. |
PAN-169600 | Fixed an issue where pan_sdwan_get_fec_encp queried
the SD-WAN module for whether FEC/PD was to be triggered even when SD-WAN
was not configured. |
PAN-169105 | Fixed an issue on the Panorama web interface
where a Network File System (NFS) storage partition displayed the
incorrect storage size. |
PAN-168921 | Fixed an issue on firewalls in HA active/active
configuration where traffic with complete packets showed up as incomplete
and was disconnected due to a non-session owner closing the session prematurely. |
PAN-168903 | Fixed an issue where deleting licenses on
the firewall incorrectly set the GlobalProtect gateway license node
to false. The firewall displayed the following
error message during a GlobalProtect application connection: Could not connect to the gateway. The device or feature requires a GlobalProtect subscription license,
even though the gateway firewall had a valid gateway license. |
PAN-168890 | A CLI command was added to address an issue
where a configured proxy server for a service route was automatically
applied to the email server service route. |
PAN-168221 | (Panorama appliances deployed in Microsoft
Azure instances without temporary disks) Fixed an issue where
Panorama displayed an incorrect number of drives. |
PAN-167858 | Fixed an issue where a DNS Security inspection
identified a TCP DNS request that had two requests in one segment
as a malformed packet and dropped the packet. |
PAN-167805 | Fixed an intermittent issue where traffic
ingressing through a VPN tunnel failed to match predict session,
which resulted in child sessions failing. |
PAN-167329 | Fixed an issue where ZTP flow did not complete. |
PAN-167266 | Fixed an issue on multi-dataplane firewalls
with high CPU use on dataplane 0 that caused an internal loop of
forward/host sessions on the firewall. |
PAN-167115 | Fixed an issue where, after upgrading to
PAN-OS 10.0.3, admin sessions on Panorama were not logged out after
the idle timeout expired. |
PAN-166557 | Fixed an issue where ElasticSearch didn't
register to the masterd process when setting up a new
Log Collector configuration. |
PAN-166081 | Fixed an issue where a Role Based admin
user with tag disabled was unable to view
applications (Objects > Applications). |
PAN-165913 | Fixed an issue on United States GlobalProtect
portals where HTTP health checks failed and no authentication events
occurred for about 10 minutes. |
PAN-165843 | Fixed an issue on the firewalls where generating
SCEP Certificates did not work when the value of a Relative Distinguished
Name (RDN) in the subject string contained a space. |
PAN-165433 | Fixed an intermittent issue where Cortex
Data Lake failed to reconnect after a disconnect if a management
IP address used for logging had an IP address assignment type of
DHCP. |
PAN-165179 | Fixed an issue where Panorama missed address
group objects during a template configuration due to Panorama not
sending the required strings for a query. |
PAN-165120 | Fixed an issue where the Application Command
Center (ACC) did not display data when the Device Group was set
with VSYS in its name. |
PAN-164941 | Fixed an issue where multiple duplicate No
Valid DNS Security License warning messages were generated during
a successful commit. |
PAN-164450 | Fixed an intermittent issue where the firewall
dropped GTPv2 Create Session Response packets with the cause Partially Accepted. |
PAN-164422 | (VM-Series firewalls only) A fix
was made to address improper access control that enabled an attacker
with authenticated access to GlobalProtect portals and GlobalProtect
gateways to connect to the EC2 instance metadata endpoint for VM-Series
firewalls hosted on Amazon Web Services (AWS) (CVE-2021-3062). |
PAN-164429 | Fixed an issue where the Panorama web interface
displayed an unavailable setting. |
PAN-164402 | A CLI command was added to immediately disable
or enable restarting the syslog-ng connection during an FQDN refresh
IP address change. |
PAN-164335 | Fixed an issue that caused false positives
on GTPv2 vulnerability signatures. |
PAN-163695 | Fixed an issue where multiple dataplane
process (all_task, flow_mgmt, flow_ctrl,
and pktlog_forwarding) stopped responding and caused
the dataplane to restart. This issue occurred when the firewall
received unexpected packets during an SSL handshake when SSL inbound
inspection was configured. |
PAN-163692 | Fixed an issue where the firewall did not
create new GTP-C sessions when a Create Session Request message
was retransmitted and a completely new Create Session Response message
was returned. |
PAN-163606 | Fixed an intermittent issue where URLs in
an External Dynamic List (EDL) with the valid format <domain>:<port> were
listed as invalid. |
PAN-163448 | Fixed an issue when using ixgb drivers with
SR-IOV and DPDK that caused OSPF multicast traffic to be filtered
by the physical function driver. |
PAN-162939 | Fixed an issue where a process (devsrvr)
ran out of file descriptors, which resulted in the PAN-DB URL Filtering
license being incorrectly labeled as expired. |
PAN-162936 | Fixed an issue where the all_pktproc process stopped
responding on GTP-U session traffic when attempting to send out
packets held in software buffers. |
PAN-162884 | Fixed a rare issue where an external dynamic
list (EDL) entry became corrupt due to an erroneous string being
inserted while generating the list. |
PAN-162374 | Fixed an issue where the firewall rebooted
unexpectedly and displayed the following message: Reboot SYSTEM REBOOT Masterd Initiated. |
PAN-162174 | Fixed an issue where, when the firewall
received a configuration from Panorama with no URL category, it
was automatically configured as Any. |
PAN-161940 | Fixed an issue where the firewall did not
honor the peer RX interval timeout in a Bidirectional Forwarding
Detection (BFD) INIT state. |
PAN-161617 | Fixed an intermittent issue where the NTP
status displayed the message NTP not synched when
using an FQDN that resolved to both an IPv4 and an IPv6 address. |
PAN-161544 | Fixed an issue where the Device Name field
was missing when GlobalProtect logs were exported to CSV from the Panorama
management server. |
PAN-161208 | Fixed an issue where the Service
Route Configuration (Device > Setup > Services >
Service Route Configuration) was unchangeable when the
web interface language was set to a language other than English. |
PAN-161111 | Fixed an issue where TLS 1.3 Forward Proxy
Decryption failed with a malloc failure error. This issue was caused
by the server certificate being very large. |
PAN-160708 | Fixed an issue where the dataplane restarted
after configuring a deny_all policy. |
PAN-160544 | Fixed an issue where a user was able to
clone, edit, and commit a configuration that had been locked by
another user. |
PAN-160238 | Fixed an issue where intermittent VXLAN
packet drops occurred if the TCI was not configured for inspecting
VXLAN traffic. This issue occurred when traffic was migrated from
a firewall running a PAN-OS version earlier than PAN-OS 9.0 to a
firewall running PAN-OS 9.0 or later. |
PAN-159954 | Fixed an issue where scheduled configuration
bundle exports via Secure Copy (SCP) displayed following error message
in the system log: Failed to export config bundle after
already displaying a Success message
in the log. |
PAN-159922 | Fixed an issue where, when the DNS Security
feature was enabled, Linux clients experienced a delay in resolving
domain names if the clients simultaneously attempted A and AAAA
resolution. |
PAN-159502 | Fixed an issue on Panorama where attempting
to partially revert multiple changes to a Security profile group
name that were not committed caused the Security profile group to
be removed. |
PAN-159153 | Fixed an issue where commit failures occurred
without error messages due to the DLP plugin, even when the DLP
configuration was not present on the firewall. |
PAN-158958 | Fixed an issue where the debug sslmgr view crl command
failed when ampersand (&) character was included in the URL
for the certificate revocation list (CRL). |
PAN-158753 | ($$Panorama virtual appliances in Legacy
mode only$$) Fixed an issue where GlobalProtect logs were not forwarded
to the external syslog server over TCP. |
PAN-158439 | Fixed a memory leak on the management server
process on Firewall. |
PAN-158431 | Fixed an issue where a local authentication
profile type changed to SAML after overriding
the profile in the template stack. |
PAN-158043 | Fixed an issue where the firewall dropped
packets due to a race condition. |
PAN-157725 | Fixed an issue on firewalls where URL category
responses were not processed by the dataplane in a timely fashion,
which adversely affected web-browsing traffic. |
PAN-157459 | Fixed an issue where, after updating an
address in an Address Group, a commit did not update GlobalProtect
split tunnel access routes. |
PAN-156893 | Fixed an issue where commits failed when
the Username field in the certificate profile
was set to None and the GlobalProtect portal
and/or gateway certificate authentication profiles were configured
with either the user credential or the client certificate request
authentication type. |
PAN-156482 | Fixed a packet buffer issue where HTTP2
packets were held for category lookup and the HTTP request was across
multiple packets. |
PAN-155715 | (VM-Series firewalls only) Fixed
an issue on the web interface where Operational Commands (Device
> High Availability) did not display. |
PAN-154876 | Fixed an issue where the web interface did
not display Release Date when updating the
dynamic updates manually. |
PAN-153308 | Fixed an issue which caused the mouse cursor
to remove focus from the search bar when hovering over a hyperlink
inside of a cell menu (e.g., source zone, source address, destination
zone, destination address, etc.). |
PAN-149911 | Fixed an issue where URL filtering logs
for credential phishing displayed a slash character ( / ) in the
URL field. |
PAN-144340 | (PA-7000 Series firewalls only)
Fixed an issue where some slots in the firewall did not get registered
as up in a process (useridd), which caused the process
to ignore IP address-to-user mappings to those slots. |
PAN-143930 | Fixed an issue where a process (routed) restarted
due to the number of BGP peers exceeding the supported configuration. |
PAN-141454 | Fixed an issue where the output of the CLI
command show running resource-monitor ingress-backlogs displayed
an incorrect total utilization value. |
PAN-136961 | Fixed an issue where during QoS config generation
the Aggregate Ethernet (AE) subnets were incorrectly calculated
cumulatively across all AEs instead of calculating just the total
subnets of an AE. |
PAN-130003 | Fixed an issue where the show logging-status CLI
command did not display any output on the firewall even though the
firewall was connected to Panorama and was successfully forwarding
logs. |
PAN-114127 | Fixed an issue in Panorama where the footer
bar in the Devices dialog box (Collector Groups
> Device Log Forwarding) was not visible. |