PAN-OS 8.1.5 Addressed Issues
Table of Contents
Expand All
|
Collapse All
Next-Generation Firewall Docs
-
-
- Cloud Management of NGFWs
- PAN-OS 10.0 (EoL)
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1 & Later
- PAN-OS 9.1 (EoL)
-
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1 & Later
-
-
-
- Cloud Management and AIOps for NGFW
- PAN-OS 10.0 (EoL)
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1
- PAN-OS 11.2
- PAN-OS 8.1 (EoL)
- PAN-OS 9.0 (EoL)
- PAN-OS 9.1 (EoL)
End-of-Life (EoL)
PAN-OS 8.1.5 Addressed Issues
PAN-OS® 8.1.5 addressed issues
Issue ID | Description |
---|---|
WF500-4811 | Fixed an issue where WF-500 appliances displayed
the wrong WildFire® content version show system info after
a WildFire content update. |
PAN-108805 | Fixed an intermittent issue on PA-3200 Series
firewalls where a process (all_pktproc_11) failed,
which caused an out of memory condition and the dataplane to restart. |
PAN-107791 | Fixed an issue where after upgrading from
PAN-OS® 8.1.3 to 8.1.4 the CLI two-factor administrator authentication
failed. |
PAN-107449 | Fixed an issue where firewalls failed to
establish IKE phase 1 or phase 2 when you specified Diffie-Hellman
(DH) group1. |
PAN-107365 | Fixed an issue on Panorama™ M-Series and
virtual appliances where after you make a change to a template and
attempt to push to a target device, the device does not appear in
the Push Scope Selection list (CommitPush to DevicesEdit SelectionsDevice Groups). |
PAN-107005 | Fixed an issue on PA-3200 Series firewalls
where packets dropped when a VSS-Monitoring Ethernet trailer was
being appended by an external device. |
PAN-106936 | Fixed an issue where PA-800 Series firewalls
intermittently restarted due to a kernel error. |
PAN-106829 | Fixed an issue on a PA-3200 Series firewall
where the dataplane failed due to an internal path monitoring failure. |
PAN-106502 | Fixed an issue where hardware packet buffers
gradually depleted when LLDP packets created locally were sent to
a down interface within an Aggregate Ethernet (AE) interface. |
PAN-106231 | Fixed an intermittent issue where newly
created IPSec Tunnels (NetworkIPSec TunnelsAdd)
did not activate. |
PAN-106016 | Fixed an issue on PA-800 Series firewalls
where a kernel memory spike caused the firewall to restart. |
PAN-105926 | Fixed an intermittent issue on Panorama
M-Series and virtual appliances where an address object referenced
in the address group was allowed to be deleted without a reference
error which caused commits to fail. |
PAN-105921 | Fixed an issue with Panorama where administrators
were unable to use the web interface to acquire a commit or configuration
lock for device groups. |
PAN-105842 | Fixed an issue on Panorama M-Series and
virtual appliances where the Dynamic Address Group lists did not
display and displayed the following error message: Command failed with no output. |
PAN-105695 | Fixed an intermittent issue where the dataplane
restarted while processing SMTP traffic. |
PAN-104876 | Fixed an issue on Panorama managed devices
where the green Template Values Exist indicator incorrectly displayed
after you closed any interface settings (DeviceSetupInterfaces)
even when you did not make any changes. |
PAN-104771 | Fixed an issue where the HTTP header insertion
entries caused the dataplane to restart. |
PAN-104764 | Fixed an issue on Panorama management server
when using Microsoft Azure or Amazon AWS where the management interface settings
(DeviceSetupInterfaceManagement)
is disabled. |
PAN-104668 | Fixed an issue where a GTP PDP update did
not update the GTP-U session which caused subsequent GTP traffic
to drop. |
PAN-104524 | Fixed an issue where the firewall logged
data in the packet-diag log for IP addresses that you
did not specify in the packet-capture filters when you enabled the tunnel:flow log
feature. |
PAN-104406 | Fixed an intermittent issue where the replace device CLI
command caused the configuration lock to stop responding. |
PAN-104163 | Fixed an issue where the show config audit base-version command
continuously increased the number of file descriptors and caused
the management server (mgmtsrvr) to exit and restart. |
PAN-104073 | Fixed an issue where the replace device old <serial number> new <serial number> command
caused the configuration process (configd) to stop
responding. |
PAN-103820 | Fixed and issue where the template stack
retains the dynamic update schedule information after you remove
it. |
PAN-103383 | Fixed an issue where a firewall blocked
SMTP traffic when processing ZIP files due to too many packet-process
loops. |
PAN-103346 | Fixed an issue where the LDAP Service Route
Configuration (DeviceSetupServicesService Route Configuration)
did not respond when Customize was selected
and non-management interfaces were enabled. |
PAN-103248 | Fixed an issue where the process (routed) infinitely
looped due to a corrupt internal OSPF database (DB) which caused
OSPF adjacencies to be dropped. |
PAN-103132 | A security-related fix was made to address
the FragmentSmack vulnerability (CVE-2018-5391 / PAN-SA-2018-0012). |
PAN-102975 | Fixed an issue where SSL enabled applications
accessed through a GlobalProtect™ Clientless VPN caused buffer leaks. |
PAN-102743 | (PA-5250, PA-5260, “PA-5280-8.1-only”,
PA-5000 Series, and PA-7000 Series firewalls only) Fixed an
intermittent issue where GlobalProtect SSL sessions that were enforcing
client certificate authentication failed to resume and caused an
authentication failure. |
PAN-102337 | Fixed an issue on Panorama virtual appliances
in a high availability (HA) configuration where the elastic search
script failed to identify the master node due to case sensitivity
in the serial number that caused log-replication failures when you
enabled log redundancy. |
PAN-101981 | Fixed an issue where installing path monitoring
for static route on a satellite in a Large Scale VPN (LSVPN) infrastructure
failed. |
PAN-101819 | Fixed an issue where the Panorama Controller
did not display all commit-all jobs
for Panorama Nodes (PanoramaInterconnectTasks)
and the Panorama Controller did not push those missing jobs during
a Push to Devices action when the associated Panorama Node was running
a PAN-OS 8.1 release. |
PAN-101604 | Fixed an issue where the firewall did not
correctly process OSPF link-state updates which caused the firewall
to send incorrect updates externally, which resulted in ARP broadcasts
that contained incorrect source MAC and source IP addresses. |
PAN-101585 | (The following PA-7000 Series NPCs only:
PA-7000-20G-NPC, PA-7000-20GQ-NPC, PA-7000-20GXM-NPC, PA-7000-20GQXM-NPC) Fixed
an issue where an egress buffer overflow that impacted internal packet
path monitoring caused a high availability (HA) failover. Additionally, enhancements were
made to flow control communication between the traffic manager and
flow engine components to improve system stability during periods
of heavy traffic. |
PAN-101525 | Fixed an issue where the EDL and FQDN address
objects in the security and NAT policies displayed 0.0.0.0, which
caused traffic to fail to match the policy. |
PAN-101492 | Fixed an issue on Panorama M-Series and
virtual appliances where after you configured the Authentication
fields (PanoramaAuthentication
ProfileAddAuthentication)
for the GlobalProtect gateway template stack, the saved configuration
did not get applied. |
PAN-101425 | Fixed an issue where after a redistribution
profile was added, the OSPF configured with an authentication profile
flapped. |
PAN-101378 | Fixed an issue with firewalls in a high
availability (HA) active/passive configuration where the firewall
processed traffic in a suspended state. |
PAN-101368 | Fixed an issue where SNMP polling displayed
incorrect values, which caused authentication failures each time
you restarted the firewall. |
PAN-101328 | Fixed an intermittent issue where SSL decryption
caused Content-ID™ to block files received over SMTP. |
PAN-101124 | Fixed an issue where User Principal Names
(UPN) which begin with the "at" ( @ ) character caused User-ID™
to fail. |
PAN-100862 | Fixed an intermittent issue where a commit
error occurred when an Aggregate Ethernet (AE) sub-interface was
configured as the destination interface in a QoS policy rule. |
PAN-100719 | Fixed an issue where Dynamic Updates pushed
from Panorama to the Firewall displayed an incorrect None scheduled
value. |
PAN-100613 | Fixed an issue on a PA-5200 Series firewall
in a high availability (HA) active/active configuration with a virtual
wire (vwire) subinterface where session setup packets sent to peer
firewalls were sent back as HA2/HA3 race conditions, which caused
an increase in packet descriptors and traffic to stop responding. |
PAN-100538 | Fixed an issue where exporting a device
state (DeviceSetupOperations) from Panorama failed
to import to the firewall. |
PAN-100448 | Fixed an issue where a scheduled external
dynamic list refresh displayed incorrect update values. |
PAN-100447 | (VM-Series firewalls in a high availability
(HA) configuration only) Fixed an issue when the management
interface used DHCP Client-IP assignment where the automatic commits
failed after multiple PAN-OS upgrade and downgrade cycles. |
PAN-100443 | Fixed an issue on Panorama M-Series and
virtual appliances in a high availability (HA) active/passive configuration
where the passive firewall failed to connect to a newly deployed
firewall with the following error message:vm-cfg: failed to process registration from svm device. vm-state: active. |
PAN-100395 | Fixed an intermittent issue on a firewall
where Dead Peer Detection (DPD) (NetworkIKE GatewaysAdd)
was enabled and failed during IKE negotiations. |
PAN-100256 | Fixed and issue on a firewall where a Device
Group was selected, the App Scope Network Monitor report (MonitorApp Scope >Network Monitor) failed to
display data. |
PAN-100244 | Fixed an issue where a failed commit or
commit validation followed by a non-user-committed event (such as
an FQDN refresh, an external dynamic list refresh, or an antivirus
update) resulted in an unexpected change to the configuration that
caused the firewall to drop traffic. |
PAN-100238 | Fixed an issue where obsolete IPv6 host
entries were not purged and remained in a REACHABLE state, which
caused new entries to fail. |
PAN-100228 | Fixed an intermittent issue on a PA-7000
Series firewall where auto-commits prematurely executed before all
Network Processing Cards (NPCs) were detected and ready. |
PAN-100144 | Fixed an issue on PA-7000 Series firewalls
in a high availability (HA) active/active configuration where after
a HA failover event the IP address rule list continuously duplicated
entries and resulted in slow response times from the firewall and,
eventually, caused the Network Processing Cards (NPCs) to restart. |
PAN-100049 | Fixed an issue on Panorama M-Series and
virtual appliances where Push Scope Selection (CommitPush to Devices) selected firewalls
not in the hierarchy of the firewall you selected. |
PAN-99966 | Fixed an issue where Commit and Push (CommitCommit and Push)
failed and displayed the following validation error: log-settings profiles match-list send-email is not a valid reference when
you attempted to import a firewall configuration to Panorama. |
PAN-99965 | Fixed an issue where SNMP Object identifier
queries for hrStorageAllocationUnits returned negative
values. |
PAN-99861 | Fixed an issue where SaaS application usage
reports were empty when you used special characters in naming zones. |
PAN-99860 | Fixed an issue on a PA-7000 Series firewall
where the Network Processing Card (NPC) rebooted due to a memory
allocation issue. |
PAN-99643 | Fixed an issue where a change in user-mapping
information prevented the host information profile (HIP) from updating. |
PAN-99582 | Fixed an issue where a firewall in a high
availability (HA) active/passive configuration did not send the
Bidirectional Forwarding Detection (BFD) administrator down status
after a manual failover. |
PAN-99525 | Fixed an issue where the destination NAT
(DNAT) using a dynamic IP address caused the dataplane to fail. |
PAN-99483 | (PA-5250, PA-5260, and PA-5280 firewalls
only) Fixed an issue where, when you deployed the firewall
in a network that uses Dynamic IP and Port (DIPP) NAT translation
with PPTP, client systems were limited to using a translated IP
address-and-port pair for only one connection. See Limitations for PA-7000 Series firewalls |
PAN-99211 | Fixed an issue in a high availability (HA)
active/passive configuration where the hardware offload feature
attempted to reinstall IPSec sessions for individual packets, which
caused additional dataplane CPU loads on both the active and passive
firewalls. |
PAN-99204 | Fixed an issue on Panorama M-Series and
virtual appliances where a qualifier configured for a custom application
signature displayed the following error message: Unauthorized request. |
PAN-99161 | Fixed an issue where the Captive Portal
configured with RADIUS authentication failed when a username contained
the "at" ( @ ) character. |
PAN-99085 | Fixed an issue where firewalls did not purge
files automatically as expected, which caused WildFire updates to
fail. |
PAN-98978 | Fixed an intermittent issue on Panorama
M-Series and virtual appliances where GlobalProtect Gateway Configuration (NetworkGlobalProtectGatewaysAuthentication)
responded with the following message: Malformed Request. |
PAN-98683 | Fixed an issue where the firewall dropped
IPv6 ping packets, which caused high availability (HA) path monitoring
to fail. |
PAN-98475 | Fixed an issue on a firewall configured
with RADIUS where the default timeout setting failed after an administrator
entered credentials through the web interface. |
PAN-98375 | Fixed an issue when you configured service
objects (ObjectsServices)
a process (all_pktproc) failed and caused the dataplane
to restart. |
PAN-98332 | Fixed an issue where the firewall incorrectly
forwarded packets to upstream devices when it had no ARP entry for
the destination IP address, which resulted in traffic outages caused
by source MAC addresses that did not get updated as expected. |
PAN-98263 | Fixed an issue on a PA-5000 Series firewall
where SNMP values for received and transmitted bytes for Aggregate
Ethernet (AE) subinterfaces returned incorrect values. |
PAN-98249 | Fixed an issue where General Information (Dashboard)
did not display the date information for Application Version, Threat
Version, and Antivirus Version line items. |
PAN-98115 | Fixed an issue on Panorama M-Series and
virtual appliances in a high availability (HA) active/passive configuration
where after you delete a plugin from both firewalls the configuration
synchronization failed. |
PAN-98110 | (PAN-OS 8.0.8 and later releases only)
Fixed an issue where administrator setting did not change when appropriate
after you imported a configuration. |
PAN-97928 | Fixed an issue where you could not set the
Captive Portal session timeout (DeviceSetupSession)
to 60 seconds or longer without causing a browser redirect. |
PAN-97879 | Fixed an issue on Panorama management server
in a high availability (HA) active/passive configuration where a
Commit (CommitCommit
to Panorama) caused the firewalls to restart. |
PAN-97853 | Fixed an issue Panorama M-Series and virtual
appliances with the characteristic Data Breaches (ObjectsApplication Filters)
enabled caused all Device Groups entries not to display. |
PAN-97698 | Fixed an issue where the firewall took longer
than expected to update a URL category. |
PAN-97495 | Fixed an issue on a PA-5000 Series firewall
in a QoS configuration where the setting did not re-apply after
the dataplane restarted. |
PAN-97199 | A security-related fix was made to the way
the Linux kernel handles exceptions associated with MOV to SS and
POP to SS instructions (CVE-2018-8897). |
PAN-96877 | Fixed an issue where license keys with special
characters caused rebooting to fail. |
PAN-96696 | A security-related fix was made to prevent
modification of attributes in a SAML Response packet. |
PAN-96548 | Fixed an issue where the command delete report custom scope shared report-name <report name> file-name did
not delete the files in the directory and displayed the following
error message: Server error : unable to remove directory for <report-name>. |
PAN-96522 | Fixed an intermittent issue where the firewall
did not rotate error logs correctly, which caused disk space issues. |
PAN-96462 | Fixed an intermittent issue where a null
pointer exception caused the configuration (configd)
process to stop responding. |
PAN-96440 | Fixed an issue where the static route was
not reinstalled if you modified the path-monitoring hold time while
the timer was active. |
PAN-96391 | Fixed an issue on Panorama M-Series and
virtual appliances where one template is selected to display a list
of templates displayed. |
PAN-96299 | Fixed an issue on VM-Series firewalls where
the bootstrap in GCP failed when a software image was provided,
which caused GCP to time out before media availability was provided. |
PAN-96283 | Fixed an issue where administrators with
predefined roles and permission to save configuration changes were
not able to save their changes. |
PAN-95935 | Fixed an intermittent issue on a PA-7000
Series firewall where the GlobalProtect LSVPN tunnel monitoring
failed during re-key, which caused satellites to disconnect. |
PAN-95819 | Fixed an issue where a firewall did not
apply the configured NAT policy during a predicted RTSP session. |
PAN-95613 | Fixed an issue where Commits failed when
custom role-based administrators made changes to Managed Collectors (Panorama). |
PAN-95454 | Fixed an intermittent issue on a VM-Series
firewall in a VMware NSX environment where the firewall stopped
passing traffic. |
PAN-95131 | Fixed an issue where administrators with
Device Group and Template access were not able to modify the QoS
interface (NetworkQoS). |
PAN-95024 | Fixed an issue on a Panorama M-Series and
virtual appliances where firewalls redeployed to a NSX environment,
the Device State (PanoramaManaged DevicesSummary)
displayed a Deactivated status due
to the firewalls being deployed with previously assigned authorization
codes. Firewall gets the same serial number after getting
redeployed in NSX environment where Panorama still think that newly
deployed firewalls are de-activated because of it has a serial number
used in the past. |
PAN-94532 | Fixed an issue where a memory leak caused
an out-of-memory (OOM) error. |
PAN-93456 | Fixed an intermittent issue where VPN tunnels
terminated due to IKE manager failures. |
PAN-92694 | Fixed an intermittent issue where the threat
log displayed unrelated URLs in the file name column. |
PAN-87152 | Fixed an issue where the show running ippool command
stopped responding due to a conflict with packet processing and
caused the Aggregate Ethernet (AE) interface to flap. |
PAN-86426 | A security-related fix was made to SAML
authentication. |