(

PA-3400 Series firewalls only

) Fixed an issue where the firewall entered maintenance mode after enabling kernel data collection during the silent reboot.

Fixed an issue where push scope changes remained empty and

Edit selections > OK

did not work for admin-based users after upgrading Panorama.

(

VM-Series firewalls on Microsoft Azure environments only

) Fixed an issue where you were unable to log in to the firewall after a private data reset.

Added CPLD enhancement to capture external power issues.

Fixed an issue on the web interface where the

Virtual Router

and

Virtual System

configurations for the template incorrectly showed as

none

.

Fixed an issue where the all_pktproc process stopped responding, which caused the firewall to become unresponsive.

Fixed an issue where push operations took longer than expected to complete.

Fixed an issue where the GlobalProtect SSL VPN tunnel immediately disconnected due to a keep-alive timeout.

(

Panorama virtual appliances only

) Fixed an issue where the push scope CLI command took longer than expected, which caused the web interface to be slow.

Fixed an issue on the firewall where the dataplane went down due to a path monitor failure caused by an OOM condition related to the pan_task process.

Fixed an issue where a

Push to Device

operation remained at the state

None

when performing a selective push to device groups and templates that included both connected and disconnected firewalls.

Fixed an issue where the sleep time for a suspended pan_task process caused configuration and policy updates to be blocked.

Fixed an issue on Panorama appliances in active/passive HA configurations where the firewalls entered an HA out-of-sync status and jobs failed on the passive appliance with the error message

Could not merged running config from file

.

(

VM-Series firewalls in Microsoft Azure environments only

) Fixed an issue where file descriptors were not closed due to invalid configurations.

Fixed an issue where the WF-500 appliance returned an error verdict for every sample in FIPS mode.

Fixed an issue where ports did not go down when moving from an active state to a suspended state.

Fixed an issue where turning off mprelay logging caused mprelay heartbeat failure.

A knob was introduced to toggle the default behavior of BGP in the Advanced Routing stack to not suppress duplicate updates. By default, the prefix updates are suppressed for optimization.

Fixed an issue where changes committed on Panorama were not reflected on the firewall after a successful push.

Fixed an issue where FIB repush did not work with Advanced Routing enabled.

Fixed an issue where ECMP sessions changed destination MAC addresses mid-session, which caused connections to be reset.

Fixed an issue where inconsistent FIB entries across the dataplane were not detected.

Fixed an issue where high Enhanced Application log traffic used excess system resources and caused processes to not work.

Fixed an issue where a higher byte count (s2c) was observed for DNS-Base application.

(

VM-Series firewalls in Microsoft Azure environments only

) Fixed a Data Plane Development Kit (DPDK) issue where interfaces remained in a link-down stage after an Azure hot plug event.

Fixed an issue where all_task stopped responding due to an invalid memory address.

Fixed a temporary hardware issue that caused PAN-SFP-PLUS-CU-5M to not be able to link up on PA-3400 and PA-1400 Series firewalls.

Fixed an issue where, when LSVPN serial numbers and IP address authentication were enabled, IPv6 address ranges and complete IPv6 addresses that were manually added to the IP address allow or exclude list were not usable after a restart of the gp_broker process or the firewall.

Fixed an issue where the NSSA default route from the firewall was not generated to advertise even though the backbone area default route was advertised during a graceful restart.

Fixed an issue where the log_index was suspended and corrupted BDX files flooded the index_log.

Fixed an issue where, when the physical interface went down, the SD-WAN Ethernet connection state still showed

UP/path-monitor

due to the Active URL SaaS monitor connection state remaining UP/path-monitor.

Fixed an issue with the Panorama virtual appliance where, after the mgmtsrvr restarted on the passive appliance, stale IP address tags were pushed to the connected firewalls with the message

clear all registered ip addresses

.

(

PA-3410 firewalls only

) Fixed an issue where the firewall did not boot up after upgrading due to a TPM lockout condition that persisted for over 24 hours.

Fixed an issue where the log collector sent fewer logs than expected to the syslog server.

Fixed an issue with 100% CPU utilization in the varrcvr process that occurred during an incremental WildFire update.

Fixed an issue on Panorama where the API command

request system disk add

failed.

Fixed an issue where the reportd process stopped and the firewall rebooted.

Fixed an issue where a proxy server was used for external dynamic list communication even when the dataplane interface was configured through service routes.

Fixed an issue where you were unable to select authentication profiles via the web interface.

Fixed an issue where static ND entries were not reachable after a reboot.

Fixed an issue where, when custom signatures and predefined signatures shared the same literal pattern part, the custom signature caused an incorrect calculation for the length of the predefined signature, which resulted in App-ID not detecting correctly.

Fixed an issue where a User Principle Name (UPN) was incorrectly required in the pre-logon machine certificate.

Fixed an issue where downloading files failed or was slower than expected due to malware scanning even when the session was matched to a Security policy rule with no Anti-Virus profile attached.

Fixed an issue on Panorama where

Push to Devices

or

Commit and Push

operations took longer than expected on the web interface.

Fixed an issue where the configd process stopped responding when a partial configuration revert operation was performed.

Fixed an issue where, when a VoIP call using dynamic IP and NAT was put on hold, the audio became one-way due to early termination of NAT ports.

Fixed an intermittent issue where MLAV and URL cloud connectivity were lost.

Fixed an issue where FIB entries were deleted due to a sysd process connection error.

Fixed an issue with session caching where the reportd process stopped responding due to null values.

Fixed an issue on firewalls on active/active HA configurations where packets dropped during commit operations when forwarding traffic via an HA3 link when an Aggregate Ethernet interface or data interface was used as an HA3 link.

Fixed an issue where

Preview Changes

and

Change Summary

when saving changes did not open a new window when clicked.

Fixed an issue where the combination signature aggregation criteria in a Vulnerability Protection profile was incorrectly blank even though a value was set.

Fixed an issue where Panorama was unable to push scheduled Dynamic Updates to firewalls with the error message

Failed to add deploy job. Too many (30) deploy jobs pending for device

.

Fixed an issue where support for CBC ciphers with some authentication algorithms was only available in FIPS mode.

Fixed an issue where the masterd process was unable to start or stop the sysd process.

Fixed an issue where the IP address-to-user mapping was not correct.

Fixed an issue where filtering Threat logs using any value under

THREAT ID/NAME

displayed the error

Invalid term

.

Fixed an issue where heartbeats to the brdagent process were lost, resulting in the process not responding, which caused the firewall to reboot.

Fixed an issue on Panorama where policy rulebase reordering under

View Rulebase by Groups

(

Policy > <policy-rulebase>

) did not persist if you reordered the policy rulebase by dragging and dropping individual policy rules and then moved the entire tag group.

Fixed an issue on the web interface where the Security policy rule hit count remained at 0 for some rules even though the Traffic logs showed live hits.

Fixed an issue where the following error message was seen frequently in the system logs:

Clearing snmpd.log due to log overflow

.

Fixed an issue where you were unable to uncheck firewalls in HA configurations from the device group when

Group HA Peers

was enabled.

(

PA-220 firewalls only

) Fixed an issue where the firewall CPU percentage was miscalculated, and the values that were displayed were incorrect.

Fixed an issue with missing logs when one log collector in a log Collector Group became unreachable.

Fixed an issue where GlobalProtect authentication failed when authentication was SAML with CAS and the portal was resolved with IPv6.

M-600 Appliances in Log Collector mode only

) Fixed an issue where Panorama continuously rebooted and became unresponsive, which consumed excessive logging disk space and prevented new log ingestion.

Fixed an issue where you were unable to export or download packet captures from the firewall when context switching from Panorama.

Fixed an issue where RADIUS authentication failed when the destination route of the service route was configured with an IPv4 address with more than 14 characters.

Fixed an issue with firewalls in active/passive HA configurations where the passive firewall MAC flapping occurred when the passive firewall was rebooted.

(

PA-3400 Series firewalls only

) Fixed an issue where silent packet drops were observed on interfaces.

Fixed an issue where dynamic IP address NAT with SIP intermittently failed to convert RTP Predict sessions.

Fixed an issue where the firewall sent incorrectly encoded the

supported_groups

extension in the Client Hello when acting as a forward proxy with decryption profile max version TLSv1.2.

Fixed an issue where

Preview Changes

under

Scheduled Pushes

did not launch the

Change Preview

window.

Fixed an issue where the ikemgr process stopped responding due to memory corruption, which caused VPN tunnels to go down.

Fixed an issue with HTTP2 traffic where downloading large files did not work when decryption was enabled.

Fixed an issue on the web interface where the BGP routing table did not display advertised routes.

Fixed an issue related to the configd process where Panorama displayed the error

Server not responding

when editing policy rules.

Fixed an issue with firewalls in active/passive HA configurations where GRE tunnels went down due to recursive routing when the passive firewall was booting up. When the passive firewall became active and no recursive routing was configured, the GRE tunnel remained down.

(

VM-Series firewalls only

) Fixed an issue where hostname validation failed due to the firewall not taking the hostname provided in

init.cfg

.

Fixed an issue on the web interface where Antivirus updates were not able to be downloaded and installed unless Apps and Threads updates were downloaded and installed first, and the Antivirus content list displayed as blank. The resulting error message from the update server was also not reflected in the web interface.

Fixed an issue where the firewall did not fetch group and user membership due to the Okta sync domain not matching the active directory sync domain.