PAN-OS 8.1.5 Addressed Issues
Focus
Focus

PAN-OS 8.1.5 Addressed Issues

Table of Contents
End-of-Life (EoL)

PAN-OS 8.1.5 Addressed Issues

PAN-OS® 8.1.5 addressed issues
Issue ID
Description
WF500-4811
Fixed an issue where WF-500 appliances displayed the wrong WildFire® content version show system info after a WildFire content update.
PAN-108805
Fixed an intermittent issue on PA-3200 Series firewalls where a process (all_pktproc_11) failed, which caused an out of memory condition and the dataplane to restart.
PAN-107791
Fixed an issue where after upgrading from PAN-OS® 8.1.3 to 8.1.4 the CLI two-factor administrator authentication failed.
PAN-107449
Fixed an issue where firewalls failed to establish IKE phase 1 or phase 2 when you specified Diffie-Hellman (DH) group1.
PAN-107365
Fixed an issue on Panorama™ M-Series and virtual appliances where after you make a change to a template and attempt to push to a target device, the device does not appear in the Push Scope Selection list (CommitPush to DevicesEdit SelectionsDevice Groups).
PAN-107005
Fixed an issue on PA-3200 Series firewalls where packets dropped when a VSS-Monitoring Ethernet trailer was being appended by an external device.
PAN-106936
Fixed an issue where PA-800 Series firewalls intermittently restarted due to a kernel error.
PAN-106829
Fixed an issue on a PA-3200 Series firewall where the dataplane failed due to an internal path monitoring failure.
PAN-106502
Fixed an issue where hardware packet buffers gradually depleted when LLDP packets created locally were sent to a down interface within an Aggregate Ethernet (AE) interface.
PAN-106231
Fixed an intermittent issue where newly created IPSec Tunnels (NetworkIPSec TunnelsAdd) did not activate.
PAN-106016
Fixed an issue on PA-800 Series firewalls where a kernel memory spike caused the firewall to restart.
PAN-105926
Fixed an intermittent issue on Panorama M-Series and virtual appliances where an address object referenced in the address group was allowed to be deleted without a reference error which caused commits to fail.
PAN-105921
Fixed an issue with Panorama where administrators were unable to use the web interface to acquire a commit or configuration lock for device groups.
PAN-105842
Fixed an issue on Panorama M-Series and virtual appliances where the Dynamic Address Group lists did not display and displayed the following error message: Command failed with no output.
PAN-105695
Fixed an intermittent issue where the dataplane restarted while processing SMTP traffic.
PAN-104876
Fixed an issue on Panorama managed devices where the green Template Values Exist indicator incorrectly displayed after you closed any interface settings (DeviceSetupInterfaces) even when you did not make any changes.
PAN-104771
Fixed an issue where the HTTP header insertion entries caused the dataplane to restart.
PAN-104764
Fixed an issue on Panorama management server when using Microsoft Azure or Amazon AWS where the management interface settings (DeviceSetupInterfaceManagement) is disabled.
PAN-104668
Fixed an issue where a GTP PDP update did not update the GTP-U session which caused subsequent GTP traffic to drop.
PAN-104524
Fixed an issue where the firewall logged data in the packet-diag log for IP addresses that you did not specify in the packet-capture filters when you enabled the tunnel:flow log feature.
PAN-104406
Fixed an intermittent issue where the replace device CLI command caused the configuration lock to stop responding.
PAN-104163
Fixed an issue where the show config audit base-version command continuously increased the number of file descriptors and caused the management server (mgmtsrvr) to exit and restart.
PAN-104073
Fixed an issue where the replace device old <serial number> new <serial number> command caused the configuration process (configd) to stop responding.
PAN-103820
Fixed and issue where the template stack retains the dynamic update schedule information after you remove it.
PAN-103383
Fixed an issue where a firewall blocked SMTP traffic when processing ZIP files due to too many packet-process loops.
PAN-103346
Fixed an issue where the LDAP Service Route Configuration (DeviceSetupServicesService Route Configuration) did not respond when Customize was selected and non-management interfaces were enabled.
PAN-103248
Fixed an issue where the process (routed) infinitely looped due to a corrupt internal OSPF database (DB) which caused OSPF adjacencies to be dropped.
PAN-103132
A security-related fix was made to address the FragmentSmack vulnerability (CVE-2018-5391 / PAN-SA-2018-0012).
PAN-102975
Fixed an issue where SSL enabled applications accessed through a GlobalProtect™ Clientless VPN caused buffer leaks.
PAN-102743
(PA-5250, PA-5260, “PA-5280-8.1-only”, PA-5000 Series, and PA-7000 Series firewalls only) Fixed an intermittent issue where GlobalProtect SSL sessions that were enforcing client certificate authentication failed to resume and caused an authentication failure.
PAN-102337
Fixed an issue on Panorama virtual appliances in a high availability (HA) configuration where the elastic search script failed to identify the master node due to case sensitivity in the serial number that caused log-replication failures when you enabled log redundancy.
PAN-101981
Fixed an issue where installing path monitoring for static route on a satellite in a Large Scale VPN (LSVPN) infrastructure failed.
PAN-101819
Fixed an issue where the Panorama Controller did not display all commit-all jobs for Panorama Nodes (PanoramaInterconnectTasks) and the Panorama Controller did not push those missing jobs during a Push to Devices action when the associated Panorama Node was running a PAN-OS 8.1 release.
PAN-101604
Fixed an issue where the firewall did not correctly process OSPF link-state updates which caused the firewall to send incorrect updates externally, which resulted in ARP broadcasts that contained incorrect source MAC and source IP addresses.
PAN-101585
(The following PA-7000 Series NPCs only: PA-7000-20G-NPC, PA-7000-20GQ-NPC, PA-7000-20GXM-NPC, PA-7000-20GQXM-NPC) Fixed an issue where an egress buffer overflow that impacted internal packet path monitoring caused a high availability (HA) failover. Additionally, enhancements were made to flow control communication between the traffic manager and flow engine components to improve system stability during periods of heavy traffic.
PAN-101525
Fixed an issue where the EDL and FQDN address objects in the security and NAT policies displayed 0.0.0.0, which caused traffic to fail to match the policy.
PAN-101492
Fixed an issue on Panorama M-Series and virtual appliances where after you configured the Authentication fields (PanoramaAuthentication ProfileAddAuthentication) for the GlobalProtect gateway template stack, the saved configuration did not get applied.
PAN-101425
Fixed an issue where after a redistribution profile was added, the OSPF configured with an authentication profile flapped.
PAN-101378
Fixed an issue with firewalls in a high availability (HA) active/passive configuration where the firewall processed traffic in a suspended state.
PAN-101368
Fixed an issue where SNMP polling displayed incorrect values, which caused authentication failures each time you restarted the firewall.
PAN-101328
Fixed an intermittent issue where SSL decryption caused Content-ID™ to block files received over SMTP.
PAN-101124
Fixed an issue where User Principal Names (UPN) which begin with the "at" ( @ ) character caused User-ID™ to fail.
PAN-100862
Fixed an intermittent issue where a commit error occurred when an Aggregate Ethernet (AE) sub-interface was configured as the destination interface in a QoS policy rule.
PAN-100719
Fixed an issue where Dynamic Updates pushed from Panorama to the Firewall displayed an incorrect None scheduled value.
PAN-100613
Fixed an issue on a PA-5200 Series firewall in a high availability (HA) active/active configuration with a virtual wire (vwire) subinterface where session setup packets sent to peer firewalls were sent back as HA2/HA3 race conditions, which caused an increase in packet descriptors and traffic to stop responding.
PAN-100538
Fixed an issue where exporting a device state (DeviceSetupOperations) from Panorama failed to import to the firewall.
PAN-100448
Fixed an issue where a scheduled external dynamic list refresh displayed incorrect update values.
PAN-100447
(VM-Series firewalls in a high availability (HA) configuration only) Fixed an issue when the management interface used DHCP Client-IP assignment where the automatic commits failed after multiple PAN-OS upgrade and downgrade cycles.
PAN-100443
Fixed an issue on Panorama M-Series and virtual appliances in a high availability (HA) active/passive configuration where the passive firewall failed to connect to a newly deployed firewall with the following error message:vm-cfg: failed to process registration from svm device. vm-state: active.
PAN-100395
Fixed an intermittent issue on a firewall where Dead Peer Detection (DPD) (NetworkIKE GatewaysAdd) was enabled and failed during IKE negotiations.
PAN-100256
Fixed and issue on a firewall where a Device Group was selected, the App Scope Network Monitor report (MonitorApp Scope >Network Monitor) failed to display data.
PAN-100244
Fixed an issue where a failed commit or commit validation followed by a non-user-committed event (such as an FQDN refresh, an external dynamic list refresh, or an antivirus update) resulted in an unexpected change to the configuration that caused the firewall to drop traffic.
PAN-100238
Fixed an issue where obsolete IPv6 host entries were not purged and remained in a REACHABLE state, which caused new entries to fail.
PAN-100228
Fixed an intermittent issue on a PA-7000 Series firewall where auto-commits prematurely executed before all Network Processing Cards (NPCs) were detected and ready.
PAN-100144
Fixed an issue on PA-7000 Series firewalls in a high availability (HA) active/active configuration where after a HA failover event the IP address rule list continuously duplicated entries and resulted in slow response times from the firewall and, eventually, caused the Network Processing Cards (NPCs) to restart.
PAN-100049
Fixed an issue on Panorama M-Series and virtual appliances where Push Scope Selection (CommitPush to Devices) selected firewalls not in the hierarchy of the firewall you selected.
PAN-99966
Fixed an issue where Commit and Push (CommitCommit and Push) failed and displayed the following validation error: log-settings profiles match-list send-email is not a valid reference when you attempted to import a firewall configuration to Panorama.
PAN-99965
Fixed an issue where SNMP Object identifier queries for hrStorageAllocationUnits returned negative values.
PAN-99861
Fixed an issue where SaaS application usage reports were empty when you used special characters in naming zones.
PAN-99860
Fixed an issue on a PA-7000 Series firewall where the Network Processing Card (NPC) rebooted due to a memory allocation issue.
PAN-99643
Fixed an issue where a change in user-mapping information prevented the host information profile (HIP) from updating.
PAN-99582
Fixed an issue where a firewall in a high availability (HA) active/passive configuration did not send the Bidirectional Forwarding Detection (BFD) administrator down status after a manual failover.
PAN-99525
Fixed an issue where the destination NAT (DNAT) using a dynamic IP address caused the dataplane to fail.
PAN-99483
(PA-5250, PA-5260, and PA-5280 firewalls only) Fixed an issue where, when you deployed the firewall in a network that uses Dynamic IP and Port (DIPP) NAT translation with PPTP, client systems were limited to using a translated IP address-and-port pair for only one connection.
See Limitations for PA-7000 Series firewalls
PAN-99211
Fixed an issue in a high availability (HA) active/passive configuration where the hardware offload feature attempted to reinstall IPSec sessions for individual packets, which caused additional dataplane CPU loads on both the active and passive firewalls.
PAN-99204
Fixed an issue on Panorama M-Series and virtual appliances where a qualifier configured for a custom application signature displayed the following error message: Unauthorized request.
PAN-99161
Fixed an issue where the Captive Portal configured with RADIUS authentication failed when a username contained the "at" ( @ ) character.
PAN-99085
Fixed an issue where firewalls did not purge files automatically as expected, which caused WildFire updates to fail.
PAN-98978
Fixed an intermittent issue on Panorama M-Series and virtual appliances where GlobalProtect Gateway Configuration (NetworkGlobalProtectGatewaysAuthentication) responded with the following message: Malformed Request.
PAN-98683
Fixed an issue where the firewall dropped IPv6 ping packets, which caused high availability (HA) path monitoring to fail.
PAN-98475
Fixed an issue on a firewall configured with RADIUS where the default timeout setting failed after an administrator entered credentials through the web interface.
PAN-98375
Fixed an issue when you configured service objects (ObjectsServices) a process (all_pktproc) failed and caused the dataplane to restart.
PAN-98332
Fixed an issue where the firewall incorrectly forwarded packets to upstream devices when it had no ARP entry for the destination IP address, which resulted in traffic outages caused by source MAC addresses that did not get updated as expected.
PAN-98263
Fixed an issue on a PA-5000 Series firewall where SNMP values for received and transmitted bytes for Aggregate Ethernet (AE) subinterfaces returned incorrect values.
PAN-98249
Fixed an issue where General Information (Dashboard) did not display the date information for Application Version, Threat Version, and Antivirus Version line items.
PAN-98115
Fixed an issue on Panorama M-Series and virtual appliances in a high availability (HA) active/passive configuration where after you delete a plugin from both firewalls the configuration synchronization failed.
PAN-98110
(PAN-OS 8.0.8 and later releases only) Fixed an issue where administrator setting did not change when appropriate after you imported a configuration.
PAN-97928
Fixed an issue where you could not set the Captive Portal session timeout (DeviceSetupSession) to 60 seconds or longer without causing a browser redirect.
PAN-97879
Fixed an issue on Panorama management server in a high availability (HA) active/passive configuration where a Commit (CommitCommit to Panorama) caused the firewalls to restart.
PAN-97853
Fixed an issue Panorama M-Series and virtual appliances with the characteristic Data Breaches (ObjectsApplication Filters) enabled caused all Device Groups entries not to display.
PAN-97698
Fixed an issue where the firewall took longer than expected to update a URL category.
PAN-97495
Fixed an issue on a PA-5000 Series firewall in a QoS configuration where the setting did not re-apply after the dataplane restarted.
PAN-97199
A security-related fix was made to the way the Linux kernel handles exceptions associated with MOV to SS and POP to SS instructions (CVE-2018-8897).
PAN-96877
Fixed an issue where license keys with special characters caused rebooting to fail.
PAN-96696
A security-related fix was made to prevent modification of attributes in a SAML Response packet.
PAN-96548
Fixed an issue where the command delete report custom scope shared report-name <report name> file-name did not delete the files in the directory and displayed the following error message: Server error : unable to remove directory for <report-name>.
PAN-96522
Fixed an intermittent issue where the firewall did not rotate error logs correctly, which caused disk space issues.
PAN-96462
Fixed an intermittent issue where a null pointer exception caused the configuration (configd) process to stop responding.
PAN-96440
Fixed an issue where the static route was not reinstalled if you modified the path-monitoring hold time while the timer was active.
PAN-96391
Fixed an issue on Panorama M-Series and virtual appliances where one template is selected to display a list of templates displayed.
PAN-96299
Fixed an issue on VM-Series firewalls where the bootstrap in GCP failed when a software image was provided, which caused GCP to time out before media availability was provided.
PAN-96283
Fixed an issue where administrators with predefined roles and permission to save configuration changes were not able to save their changes.
PAN-95935
Fixed an intermittent issue on a PA-7000 Series firewall where the GlobalProtect LSVPN tunnel monitoring failed during re-key, which caused satellites to disconnect.
PAN-95819
Fixed an issue where a firewall did not apply the configured NAT policy during a predicted RTSP session.
PAN-95613
Fixed an issue where Commits failed when custom role-based administrators made changes to Managed Collectors (Panorama).
PAN-95454
Fixed an intermittent issue on a VM-Series firewall in a VMware NSX environment where the firewall stopped passing traffic.
PAN-95131
Fixed an issue where administrators with Device Group and Template access were not able to modify the QoS interface (NetworkQoS).
PAN-95024
Fixed an issue on a Panorama M-Series and virtual appliances where firewalls redeployed to a NSX environment, the Device State (PanoramaManaged DevicesSummary) displayed a Deactivated status due to the firewalls being deployed with previously assigned authorization codes.
Firewall gets the same serial number after getting redeployed in NSX environment where Panorama still think that newly deployed firewalls are de-activated because of it has a serial number used in the past.
PAN-94532
Fixed an issue where a memory leak caused an out-of-memory (OOM) error.
PAN-93456
Fixed an intermittent issue where VPN tunnels terminated due to IKE manager failures.
PAN-92694
Fixed an intermittent issue where the threat log displayed unrelated URLs in the file name column.
PAN-87152
Fixed an issue where the show running ippool command stopped responding due to a conflict with packet processing and caused the Aggregate Ethernet (AE) interface to flap.
PAN-86426
A security-related fix was made to SAML authentication.