PAN-OS 9.0.10 Addressed Issues
Table of Contents
Expand All
|
Collapse All
Next-Generation Firewall Docs
-
PAN-OS 11.1 & Later
- PAN-OS 11.1 & Later
- PAN-OS 11.0 (EoL)
- PAN-OS 10.2
- PAN-OS 10.1
- PAN-OS 10.0 (EoL)
- PAN-OS 9.1 (EoL)
- Cloud Management of NGFWs
-
- Management Interfaces
-
- Launch the Web Interface
- Use the Administrator Login Activity Indicators to Detect Account Misuse
- Manage and Monitor Administrative Tasks
- Commit, Validate, and Preview Firewall Configuration Changes
- Commit Selective Configuration Changes
- Export Configuration Table Data
- Use Global Find to Search the Firewall or Panorama Management Server
- Manage Locks for Restricting Configuration Changes
-
-
- Define Access to the Web Interface Tabs
- Provide Granular Access to the Monitor Tab
- Provide Granular Access to the Policy Tab
- Provide Granular Access to the Objects Tab
- Provide Granular Access to the Network Tab
- Provide Granular Access to the Device Tab
- Define User Privacy Settings in the Admin Role Profile
- Restrict Administrator Access to Commit and Validate Functions
- Provide Granular Access to Global Settings
- Provide Granular Access to the Panorama Tab
- Provide Granular Access to Operations Settings
- Panorama Web Interface Access Privileges
-
- Reset the Firewall to Factory Default Settings
-
- Plan Your Authentication Deployment
- Pre-Logon for SAML Authentication
- Configure SAML Authentication
- Configure Kerberos Single Sign-On
- Configure Kerberos Server Authentication
- Configure TACACS+ Authentication
- Configure TACACS Accounting
- Configure RADIUS Authentication
- Configure LDAP Authentication
- Configure Local Database Authentication
- Configure an Authentication Profile and Sequence
- Test Authentication Server Connectivity
- Troubleshoot Authentication Issues
-
- Keys and Certificates
- Default Trusted Certificate Authorities (CAs)
- Certificate Deployment
- Configure the Master Key
- Export a Certificate and Private Key
- Configure a Certificate Profile
- Configure an SSL/TLS Service Profile
- Configure an SSH Service Profile
- Replace the Certificate for Inbound Management Traffic
- Configure the Key Size for SSL Forward Proxy Server Certificates
-
- HA Overview
-
- Prerequisites for Active/Active HA
- Configure Active/Active HA
-
- Use Case: Configure Active/Active HA with Route-Based Redundancy
- Use Case: Configure Active/Active HA with Floating IP Addresses
- Use Case: Configure Active/Active HA with ARP Load-Sharing
- Use Case: Configure Active/Active HA with Floating IP Address Bound to Active-Primary Firewall
- Use Case: Configure Active/Active HA with Source DIPP NAT Using Floating IP Addresses
- Use Case: Configure Separate Source NAT IP Address Pools for Active/Active HA Firewalls
- Use Case: Configure Active/Active HA for ARP Load-Sharing with Destination NAT
- Use Case: Configure Active/Active HA for ARP Load-Sharing with Destination NAT in Layer 3
- HA Clustering Overview
- HA Clustering Best Practices and Provisioning
- Configure HA Clustering
- Refresh HA1 SSH Keys and Configure Key Options
- HA Firewall States
- Reference: HA Synchronization
-
- Use the Dashboard
- Monitor Applications and Threats
- Monitor Block List
-
- Report Types
- View Reports
- Configure the Expiration Period and Run Time for Reports
- Disable Predefined Reports
- Custom Reports
- Generate Custom Reports
- Generate the SaaS Application Usage Report
- Manage PDF Summary Reports
- Generate User/Group Activity Reports
- Manage Report Groups
- Schedule Reports for Email Delivery
- Manage Report Storage Capacity
- View Policy Rule Usage
- Use External Services for Monitoring
- Configure Log Forwarding
- Configure Email Alerts
-
- Configure Syslog Monitoring
-
- Traffic Log Fields
- Threat Log Fields
- URL Filtering Log Fields
- Data Filtering Log Fields
- HIP Match Log Fields
- GlobalProtect Log Fields
- IP-Tag Log Fields
- User-ID Log Fields
- Decryption Log Fields
- Tunnel Inspection Log Fields
- SCTP Log Fields
- Authentication Log Fields
- Config Log Fields
- System Log Fields
- Correlated Events Log Fields
- GTP Log Fields
- Audit Log Fields
- Syslog Severity
- Custom Log/Event Format
- Escape Sequences
- Forward Logs to an HTTP/S Destination
- Firewall Interface Identifiers in SNMP Managers and NetFlow Collectors
- Monitor Transceivers
-
- User-ID Overview
- Enable User-ID
- Map Users to Groups
- Enable User- and Group-Based Policy
- Enable Policy for Users with Multiple Accounts
- Verify the User-ID Configuration
-
- App-ID Overview
- App-ID and HTTP/2 Inspection
- Manage Custom or Unknown Applications
- Safely Enable Applications on Default Ports
- Applications with Implicit Support
-
- Prepare to Deploy App-ID Cloud Engine
- Enable or Disable the App-ID Cloud Engine
- App-ID Cloud Engine Processing and Policy Usage
- New App Viewer (Policy Optimizer)
- Add Apps to an Application Filter with Policy Optimizer
- Add Apps to an Application Group with Policy Optimizer
- Add Apps Directly to a Rule with Policy Optimizer
- Replace an RMA Firewall (ACE)
- Impact of License Expiration or Disabling ACE
- Commit Failure Due to Cloud Content Rollback
- Troubleshoot App-ID Cloud Engine
- Application Level Gateways
- Disable the SIP Application-level Gateway (ALG)
- Maintain Custom Timeouts for Data Center Applications
-
- Policy Types
- Policy Objects
- Track Rules Within a Rulebase
- Enforce Policy Rule Description, Tag, and Audit Comment
- Move or Clone a Policy Rule or Object to a Different Virtual System
-
- External Dynamic List
- Built-in External Dynamic Lists
- Configure the Firewall to Access an External Dynamic List
- Retrieve an External Dynamic List from the Web Server
- View External Dynamic List Entries
- Exclude Entries from an External Dynamic List
- Enforce Policy on an External Dynamic List
- Find External Dynamic Lists That Failed Authentication
- Disable Authentication for an External Dynamic List
- Register IP Addresses and Tags Dynamically
- Use Dynamic User Groups in Policy
- Use Auto-Tagging to Automate Security Actions
- CLI Commands for Dynamic IP Addresses and Tags
- Application Override Policy
- Test Policy Rules
-
- Network Segmentation Using Zones
- How Do Zones Protect the Network?
-
PAN-OS 11.1 & Later
- PAN-OS 11.1 & Later
- PAN-OS 11.0 (EoL)
- PAN-OS 10.2
- PAN-OS 10.1
-
- Tap Interfaces
-
- Layer 2 and Layer 3 Packets over a Virtual Wire
- Port Speeds of Virtual Wire Interfaces
- LLDP over a Virtual Wire
- Aggregated Interfaces for a Virtual Wire
- Virtual Wire Support of High Availability
- Zone Protection for a Virtual Wire Interface
- VLAN-Tagged Traffic
- Virtual Wire Subinterfaces
- Configure Virtual Wires
- Configure a PPPoE Client on a Subinterface
- Configure an IPv6 PPPoE Client
- Configure an Aggregate Interface Group
- Configure Bonjour Reflector for Network Segmentation
- Use Interface Management Profiles to Restrict Access
-
- DHCP Overview
- Firewall as a DHCP Server and Client
- Firewall as a DHCPv6 Client
- DHCP Messages
- Dynamic IPv6 Addressing on the Management Interface
- Configure an Interface as a DHCP Server
- Configure an Interface as a DHCPv4 Client
- Configure an Interface as a DHCPv6 Client with Prefix Delegation
- Configure the Management Interface as a DHCP Client
- Configure the Management Interface for Dynamic IPv6 Address Assignment
- Configure an Interface as a DHCP Relay Agent
-
- DNS Overview
- DNS Proxy Object
- DNS Server Profile
- Multi-Tenant DNS Deployments
- Configure a DNS Proxy Object
- Configure a DNS Server Profile
- Use Case 1: Firewall Requires DNS Resolution
- Use Case 2: ISP Tenant Uses DNS Proxy to Handle DNS Resolution for Security Policies, Reporting, and Services within its Virtual System
- Use Case 3: Firewall Acts as DNS Proxy Between Client and Server
- DNS Proxy Rule and FQDN Matching
-
- NAT Rule Capacities
- Dynamic IP and Port NAT Oversubscription
- Dataplane NAT Memory Statistics
-
- Translate Internal Client IP Addresses to Your Public IP Address (Source DIPP NAT)
- Create a Source NAT Rule with Persistent DIPP
- PAN-OS
- Strata Cloud Manager
- Enable Clients on the Internal Network to Access your Public Servers (Destination U-Turn NAT)
- Enable Bi-Directional Address Translation for Your Public-Facing Servers (Static Source NAT)
- Configure Destination NAT with DNS Rewrite
- Configure Destination NAT Using Dynamic IP Addresses
- Modify the Oversubscription Rate for DIPP NAT
- Reserve Dynamic IP NAT Addresses
- Disable NAT for a Specific Host or Interface
-
- Network Packet Broker Overview
- How Network Packet Broker Works
- Prepare to Deploy Network Packet Broker
- Configure Transparent Bridge Security Chains
- Configure Routed Layer 3 Security Chains
- Network Packet Broker HA Support
- User Interface Changes for Network Packet Broker
- Limitations of Network Packet Broker
- Troubleshoot Network Packet Broker
-
- Enable Advanced Routing
- Logical Router Overview
- Configure a Logical Router
- Create a Static Route
- Configure BGP on an Advanced Routing Engine
- Create BGP Routing Profiles
- Create Filters for the Advanced Routing Engine
- Configure OSPFv2 on an Advanced Routing Engine
- Create OSPF Routing Profiles
- Configure OSPFv3 on an Advanced Routing Engine
- Create OSPFv3 Routing Profiles
- Configure RIPv2 on an Advanced Routing Engine
- Create RIPv2 Routing Profiles
- Create BFD Profiles
- Configure IPv4 Multicast
- Configure MSDP
- Create Multicast Routing Profiles
- Create an IPv4 MRoute
-
-
PAN-OS 9.0 (EoL)
- PAN-OS 11.2
- PAN-OS 11.1
- PAN-OS 11.0 (EoL)
- PAN-OS 10.2
- PAN-OS 10.1
- PAN-OS 10.0 (EoL)
- PAN-OS 9.1 (EoL)
- PAN-OS 9.0 (EoL)
- PAN-OS 8.1 (EoL)
- Cloud Management and AIOps for NGFW
-
- Changes to Default Behavior
- Associated Software and Content Versions
- Limitations
-
-
- PAN-OS 9.0.17 Known Issues
- PAN-OS 9.0.16 Known Issues
- PAN-OS 9.0.15 Known Issues
- PAN-OS 9.0.14 Known Issues
- PAN-OS 9.0.13 Known Issues
- PAN-OS 9.0.12 Known Issues
- PAN-OS 9.0.11 Known Issues
- PAN-OS 9.0.10 Known Issues
- PAN-OS 9.0.9 Known Issues
- PAN-OS 9.0.8 Known Issues
- PAN-OS 9.0.7 Known Issues
- PAN-OS 9.0.6 Known Issues
- PAN-OS 9.0.5 (and 9.0.5-h3) Known Issues
- PAN-OS 9.0.4 Known Issues
- PAN-OS 9.0.3 (and 9.0.3-h2 and 9.0.3-h3) Known Issues
- PAN-OS 9.0.2 (and 9.0.2-h4) Known Issues
- PAN-OS 9.0.1 Known Issues
- Known Issues Specific to the WildFire Appliance
-
-
- PAN-OS 9.0.17-h5 Addressed Issues
- PAN-OS 9.0.17-h4 Addressed Issues
- PAN-OS 9.0.17-h1 Addressed Issues
- PAN-OS 9.0.17 Addressed Issues
- PAN-OS 9.0.16-h7 Addressed Issues
- PAN-OS 9.0.16-h6 Addressed Issues
- PAN-OS 9.0.16-h5 Addressed Issues
- PAN-OS 9.0.16-h3 Addressed Issues
- PAN-OS 9.0.16-h2 Addressed Issues
- PAN-OS 9.0.16 Addressed Issues
- PAN-OS 9.0.15 Addressed Issues
- PAN-OS 9.0.14-h4 Addressed Issues
- PAN-OS 9.0.14-h3 Addressed Issues
- PAN-OS 9.0.14 Addressed Issues
- PAN-OS 9.0.13 Addressed Issues
- PAN-OS 9.0.12 Addressed Issues
- PAN-OS 9.0.11 Addressed Issues
- PAN-OS 9.0.10 Addressed Issues
- PAN-OS 9.0.9-h1 Addressed Issues
- PAN-OS 9.0.9 Addressed Issues
- PAN-OS 9.0.8 Addressed Issues
- PAN-OS 9.0.7 Addressed Issues
- PAN-OS 9.0.6 Addressed Issues
- PAN-OS 9.0.5-h3 Addressed Issues
- PAN-OS 9.0.5 Addressed Issues
- PAN-OS 9.0.4 Addressed Issues
- PAN-OS 9.0.3-h3 Addressed Issues
- PAN-OS 9.0.3-h2 Addressed Issues
- PAN-OS 9.0.3 Addressed Issues
- PAN-OS 9.0.2-h4 Addressed Issues
- PAN-OS 9.0.2 Addressed Issues
- PAN-OS 9.0.1 Addressed Issues
- PAN-OS 9.0.0 Addressed Issues
End-of-Life (EoL)
PAN-OS 9.0.10 Addressed Issues
PAN-OS® 9.0.10 addressed issues.
Issue ID | Description |
---|---|
PAN-152699 | Fixed an issue where the firewall added
a redundant 0\r\n packet while processing Clientless
VPN traffic. |
PAN-151197 | Fixed an issue where a process (authd)
restarted when an administrator authenticated to the firewall with
an Active Directory (AD) account. This issue occurred when LDAP
was configured with FQDN, used DHCP instead of a static management
IP address, and used the management interface to connect to the
LDAP server. |
PAN-150172 | Fixed an issue where dataplane processes
restarted when attempting to access websites that had the NotBefore attribute
less than or equal to Unix Epoch Time in the server certificate
with forward proxy enabled. |
PAN-150170, PAN-150013, and PAN-149822 | A fix was made to address an OS command
injection and memory corruption vulnerability in the PAN-OS management
web interface that allowed authenticated administrators to disrupt
system processes and execute arbitrary code and OS commands with
root privileges (CVE-2020-2000). |
PAN-149839 | (PA-7000 Series firewalls only)
Added CLI commands to enable/disable resource-control groups and
CLI commands to set an upper memory limit of 8G on a process (mgmtsrvr).
To enable resource-control groups, use debug software resource-control enable and
to disable them, use debug software resource-control disable.
To set the memory limit, use debug management-server limit-memory enable,
and to remove the limit, use debug management-server limit-memory disable.
For the memory limit change to take effect, the firewall must be
rebooted. |
PAN-149813 | Fixed an issue where the reply to an XML
API call from Panorama was in a different format after upgrading
to PAN-OS 8.1.14-h1 and later releases, which caused automated systems
to fail the API call. |
PAN-149325 | Fixed an issue on Panorama where the web
interface took more time than expected to load changes when the
virtual router was large or when there was a large configuration
change request from the web interface. |
PAN-149005 | Fixed an issue where XML API failed to fetch
logs larger than 10MB. |
PAN-148806 | A fix was made to address an uncontrolled
resource consumption vulnerability in PAN-OS that allowed for a
remote unauthenticated user to upload temporary files through the
management web interface that were not properly deleted after the
request was finished. An attacker could disrupt the availability
of the management web interface by repeatedly uploading files until
available disk space was exhausted (CVE-2020-2039). |
PAN-148676 | Fixed an issue where the panlogs directory
reached 100% utilization on the firewall due to early calculation
of the .size file. |
PAN-148522 | Fixed an issue for PAN-DB where certain
situations caused performance issues. |
PAN-147996 | (PA-7000b Series firewalls only)
Fixed a buffer overflow issue. |
PAN-147424 | Fixed an issue with internal buffer and
file sizes where logs were discarded due to slow log purging when
the incoming log rate was high. |
PAN-147399 | Fixed an issue where Panorama in Legacy
mode rebooted due to multiple process (reportd) restarts. |
PAN-147258 | Fixed an issue with one-way audio for inbound
voice calls due to incorrect source port translation. |
PAN-147203 | Fixed an issue where API calls did not return
the output for the operational command for running configurations. |
PAN-146837 | A fix was made to address a vulnerability
involving information exposure through log files where sensitive
fields were recorded in the configuration log without masking on
PAN-OS software when the after-change-detail custom
syslog field was enabled for configuration logs and the sensitive
field appeared multiple times in one log entry. The first instance
of the sensitive field was masked but subsequent instances were
left in clear text (CVE-2020-2043). |
PAN-146624 | Fixed an issue where exporting logs from
the web interface did not generate a system log entry. |
PAN-145942 | After upgrading to certain PAN-OS 8.1 and
9.0 versions, for certain configurations using dynamic routing without
graceful restart and with Bidirectional Forwarding Detection (BFD)
enabled, there was a longer traffic hit after a high availability
(HA) failover compared to previous versions. This was due to BFD
incorrectly timing admin-down messages for the failover event. |
PAN-145929 | Fixed an issue where, after upgrading the
passive firewall, the stream control transmission protocol (SCTP)
sessions synced from the active firewall did not retain the rule
information, and, after failover, SCTP stateful inspection did not
work. |
PAN-145507 | Fixed an issue on the firewalls where traffic
originating from a GlobalProtect user did not match host information
profile (HIP) based Security policies using the cached HIP report.
Instead, the traffic was denied until the GlobalProtect agent submitted
a new HIP report about 20 seconds later. |
PAN-145422 | Fixed an issue where a process (all_pktproc) restarted
while processing SSL VPN sessions. |
PAN-145305 | Fixed an issue where an inconsistent PAN-DB
cloud connection caused the firewall to negotiate the incorrect
version and decode the cloud responses with the incorrect format. |
PAN-145302 | Fixed an issue where the HA peer device
did not preserve its import configuration when the mode was active/active
and VR sync was disabled. |
PAN-145142 | Fixed an issue where Panorama running 9.0.8
allowed a user with the admin role Device Group and Template to
create templates and template stacks. |
PAN-145041 | Fixed an issue on the firewalls where a
process (all_task) stopped responding. |
PAN-144804 | Fixed an issue where the firewall generated
GPRS tunneling protocol (GTP) logs for invalid GTP packets. This
fix also implements a counter, flow_gtp_invalid_ver, where
the invalid packets are counted. |
PAN-144670 | Fixed an issue where the multi-factor authentication
(MFA) timestamp was not redistributed across the virtual system
(vsys) when the IP address-to-user mapping type was UIA. |
PAN-144613 | Fixed an issue where, when previewing device
group configurations from Panorama, the following error message
was returned: Parameter device group missing. |
PAN-144492 | Fixed an issue where traffic matched an
incorrect URL filtering profile due to a similarity in the MD5 hashes
between the URL filtering profiles. |
PAN-144232 | Fixed an issue where, when any change was
made to an authentication profile, the LDAP server or local user
database in a shared context removed the user group mapping information
from the firewall. |
PAN-143686 | Fixed an issue where a firewall running
in FIPS mode was unable to download the GlobalProtect datafile even
when a GlobalProtect license was installed and valid. |
PAN-143644 | Fixed an issue in multi-vsys firewalls where
traffic did not match an FQDN address group based policy. |
PAN-143493 | Fixed an memory issue associated with a
process (mgmtsrvr) due to a large number of ACK packets
in logs on Panorama or the log collector. |
PAN-143442 | Fixed an issue where Amazon Web Services
(AWS) Nitro System based VM-Series firewalls unexpectedly rebooted
due to input/output (I/O) errors caused by improper NMVE I/O timeout
settings. |
PAN-142927 | Fixed an issue where the locked users list
grew too large, which caused 100% CPU usage on a process (authd).
With this fix, locked users will be purged hourly if the lockout
time for that user has expired. |
PAN-142853 | Fixed an issue on Panorama where commits
failed, referring to a portion of the configuration that was not
changed. |
PAN-142674 | Fixed an issue where a process (brdagent)
failed in an HA configuration using High Speed Chassis Interconnect
(HSCI) ports due to a memory leak. |
PAN-142363 | Fixed an issue where a process (*mprelay*)
stopped responding and invoked an out-of-memory (OOM) killer condition
and displayed the following error messages: `tcam full` and `pan_plfm_fe_cp_arp_delete`. |
PAN-142302 | Fixed an issue where the firewalls faced
connection issues with Cortex Data Lake. |
PAN-142089 | Fixed an internal logging issue for a daemon (authd). |
PAN-141844 | Fixed an issue where promiscuous VLAN mode
did not work with the new host drivers being used on the ESXi and
single-root input/output virtualization (SR-IOV) with VLAN tagging
did not work as expected. Both Data Plane Development Kit and packet
mmap mode did not work. |
PAN-141239 | Fixed an issue where dataplane free memory
was depleted, which affected new GlobalProtect connections to the
firewall. |
PAN-141221 | Fixed an issue where a commit or content
update operation with an error was not prevented from executing
in the dataplane, which caused corruption in the dataplane policy
cache. |
PAN-141099 | Fixed an issue where the HTTP/2 stream method
was no longer valid after overloading the same pointer to point
to either the HTTP/2 stream or the proxy flow. |
PAN-140982 | (PA-7000 Series firewalls only)
Fixed an issue where a process (mprelay) on the control
plane was restarted due to an internal heartbeat miss. |
PAN-140747 | Fixed an issue where the firewall failed
to establish SFTP firewall-server connections when SSH decryption
was enabled. |
PAN-140389 | Fixed an issue on Panorama in Legacy mode
where configuring Network File System (NFS) log storage (Device
> Setup > Operations) caused all plugin installations
to fail. |
PAN-140375 | Fixed an issue where a process (logrcvr)
exited due to a race condition. |
PAN-139365 | (PA-7000 Series firewalls only)
Enhanced latency-sensitive protocols processing. With this fix,
the following latency-sensitive control traffic will be prioritized:
BGP, BFD, LACP, OSPF, OSPFv3, Protocol Independent Multicast (PIM),
and Internet Group Management Protocol (IGMP). |
PAN-139264 | Fixed an issue where the Elasticsearch cluster
status displayed in yellow due to a missing replica serial number. |
PAN-139172 | Fixed an issue where response pages generated
from the firewall used the SMAC and DMAC addresses from the original
packet, which caused a MAC flap on connected switches. |
PAN-138584 | Fixed an issue that prevented the addition
of a secondary logging disk for a VM-Series firewall deployed on
AWS using Nitro server instance types. |
PAN-138037 | Fixed an issue where the host information
profile (HIP) match message was automatically enabled when modifying
the GlobalProtect Agent settings. |
PAN-138034 | Fixed an issue where virtual machine (VM)
information source Dynamic Address Groups overrode static address
groups, which caused traffic to hit the wrong Security policy rule. |
PAN-137885 | (VM-Series firewalls in Microsoft Azure
environment only) Fixed an issue where a firewall with accelerated
networking enabled was unable to process packets efficiently because
of underlying Microsoft drivers. To leverage this fix, you must
upgrade to VM-Series Plugin 1.0.12. |
PAN-137656 | Fixed an issue where the show config diff CLI
command did not work correctly and produced unexpected output. |
PAN-136957 | Fixed an issue where access was denied if
a password contained more than 63 characters. |
PAN-136950 | Fixed an issue where, on a firewall managed
by Panorama, the XML API based IP tags were lost after a firewall
reboot or process (useridd) restart. |
PAN-136844 | Fixed an issue for S11 traffic where if
the Modify Bearer Request message came after 30 seconds of Create
Session Response message, the firewall dropped the Modify Bearer
Request packet. This fix increases this time to 90 seconds. |
PAN-136726 | Fixed an issue on the firewall where the
dataplane pan-task process (all_pktproc) stopped responding
while inspecting Server Message Block (SMB) traffic. |
PAN-136623 | Fixed an issue where a process (useridd)
failed due to internal user groups that were loading from the disk
taking over the lock. |
PAN-136304 | Fixed an issue where clientless VPN rewrite
failed due to incorrect parsing of the HTML webpage. |
PAN-135946 | Fixed an intermittent issue where Panorama
was unable to query logs from the log collector due to large file
sizes in es_cache_cron.log. |
PAN-135547 | Fixed an issue on Panorama where administrators
were unable to delete a shared address object even when it was not
referenced in the configuration. |
PAN-135418 | Fixed an issue on the firewall where configuring
uppercase User Domain values in authentication
profiles led to a failure in GlobalProtect Agent configuration selection
based on the domain user match condition. |
PAN-135356 | Fixed an issue where policies that contained
objects did not display correctly when exported to CSV or PDF format. |
PAN-135354 | Fixed an issue where the paths between the
control plane and the dataplanes in network processing cards (NPCs)
stalled in the dataplane-to-control plane direction due to the Ring
Descriptor entries becoming out of sync on each side. This produced
unrecoverable data path monitoring failures, which caused the chassis
to become nonfunctional. |
PAN-135321 | Fixed an issue where all NAT rules using
the same FQDN entries as translated IP addresses were not updated
when the IP addresses changed for those FQDNs. |
PAN-135262 | A fix was made to address a vulnerability
involving information exposure through log files where an administrator's
password or other sensitive information was logged in cleartext
while using the CLI in PAN-OS software. The opcmdhistory.log file
was introduced to track operational command (op-command) usage but
did not mask all sensitive information (CVE-2020-2044). |
PAN-135158 | Fixed an issue where setting an IPv6 destination
filter for the packet-diag option returned an error regarding a
character limit. |
PAN-135134 | Fixed an issue where using a session_proxy() without
checking that it actually is a proxy led to a dataplane process
restart. |
PAN-134981 | Fixed an issue with a memory leak in a process (user-id)
due to failed LDAP over SSL (LDAPS) requests. |
PAN-134810 | Fixed an issue where Resolve
(Objects > Addresses > <Name>) in the web interface
did not work for FQDN address objects with more than 63 characters. |
PAN-134714 | Fixed an issue where Safe Search was not
enabled after an application change. |
PAN-134624 | (VM-Series firewalls only) Fixed
an issue where the VLAN interface failed to obtain the MAC address
when the interface was used as a DHCP relay agent. |
PAN-134488 | Fixed an issue where a process (all_pktproc) restarted
while processing Clientless VPN traffic. |
PAN-134038 | Fixed an issue where custom signatures did
not properly detect the User-Agent header when the Origin header
was above the User-Agent header. |
PAN-133915 | Fixed an issue on Panorama where configuring
a BGP import rule from the CLI failed with the following error message: Server error : permission denied for the command set. |
PAN-133912 | Fixed an issue where querying traffic logs
based on address objects and address groups did not work. |
PAN-133880 | Fixed an issue where RADIUS authentication
failed due to an FQDN resolution failure after the VM-Series firewall
rebooted. |
PAN-133673 | Fixed an issue that caused a procses (ikemgr)
to exit when site-to-site VPNs experienced connectivity interruptions. |
PAN-133609 | Fixed an issue where the Authentication
Portal did not work due to a large number of HTTP requests with
unsupported Authorization headers. |
PAN-133285 | Fixed an issue on the firewalls where configuring
a default Online Certificate Status Protocol (OCSP) URL in front
of an intermediate certificate authority (CA) in a certificate profile
did not override the OCSP URL during the validation of client certificates
issued by the intermediate CA. |
PAN-132922 | Fixed an issue where service objects were
unable to be deleted if they were configured to exceed firewall
limits. |
PAN-132715 | Fixed an issue where a child dynamic address
group was not added as a member of the parent group. |
PAN-132697 | Fixed an issue where the GlobalProtect portal
did not generate certificate signing requests (CSRs) due to failed
Simple Certificate Enrollment Protocol (SCEP) authentication cookie
validation. |
PAN-131973 | Fixed an issue where both firewalls in an
HA active/passive configuration stopped responding at the same time. |
PAN-131814 | Fixed an issue where the firewall did not
recognize a device when the DHCP contained a hostname with a trailing
NULL. |
PAN-131491 | Fixed an issue where the ACC risk
meter displayed as zero for long time periods with a large amount
of logs. |
PAN-131045 | Fixed an issue where a rare cleartext HTTP/2
application behavior caused a resource leak. If jumbo frames were
enabled, this leak caused the App-ID queue to fill up quickly, which
led to legitimate sessions being discarded. |
PAN-130564 | Fixed an issue where the session ID did
not display correctly in the debug logs related to the hardware
security module (HSM). |
PAN-130562 | Fixed an issue where, in VM-Series firewalls
deployed using init-cfg.txt in the bootstrap process and set in
an HA configuration, the configuration did not display as synchronized
due to the initcfg configuration. |
PAN-130168 | Fixed an issue where a process (pan_comm) stopped
responding due to operation commands run during a commit. |
PAN-129474 | Fixed an issue where a process (mgmtsrvr) restarted
due to race conditions initialized by the mutex. |
PAN-129461 | Fixed an issue where excessive next hop
FPGA exceptions occurred when an ARP request or response was lost
in the network in an ECMP configuration, which blocked subsequent
ARP learning due to a full queue. |
PAN-129294 | Fixed an issue on Panorama where the Policy Optimizer showed
invalid data for Rule Usage. |
PAN-129277 | Enhanced a daemon (dnsproxy)
to support DNS compression for query strings. |
PAN-128761 | A fix was made to address an OS command
injection vulnerability in the PAN-OS management interface that
allowed authenticated administrators to execute arbitrary OS commands
with root privileges (CVE-2020-2037). |
PAN-128650 | Fixed an issue where selecting Preview Changes under
a specific device group resulted in the following error message: Parameter device group missing. |
PAN-128042 | |
PAN-127691 | Fixed an issue where the dataplane maintained
the old category for the URL even after changing or deleting that
category from PAN-DB. |
PAN-126938 | Fixed an issue where multiple daemons restarted
due to MP ARP overflow. |
PAN-126353 | Fixed an issue where the XML API used to
retrieve hardware status periodically failed with a 200 OK message
and no data. |
PAN-120530 | Fixed an issue where a Panorama appliance
running PAN-OS 10.0.0 observed restarts in a process (reportd)
while running a custom report when the log collector or remote device
was running a software version earlier than the current version
on Panorama. |
PAN-120249 | Fixed an issue where Elasticsearch failed
to properly start up, which caused issues with logging on Panorama
or the Log Collector. |
PAN-118468 | (VM-Series firewalls on VMware ESXi
only) Fixed an issue where the firewall stays in a boot loop
and enters maintenance mode after adding a 60GB disk. |
PAN-118416 | (Japanese language only) Fixed
an issue where the WildFire Update Schedule incorrectly displayed
At as Atlantic. |
PAN-116843 | Fixed an issue on Panorama where, when navigating
through Policies, the following error message displayed: show rule hit count op-command failed. |
PAN-115954 | Fixed an issue where commits failed with
the following error: Error unserializing profile objects failed to handle CONFIG_UPDATE_START. |
PAN-113523 | Fixed an intermittent issue where configuration
audit stopped showing commit history and revisions. |
PAN-112539 | Fixed an issue where the firewall stopped
forwarding logs to the log collector from the Log Processing Card
(LPC) after a commit push from Panorama due to a race condition. |
PAN-112246 | Fixed an issue on the firewalls where a
process (mgmtsrvr) restarted after the Panorama connection flapped. |
PAN-101484 | A fix was made to address an OS command
injection vulnerability in the PAN-OS management interface that
allowed authenticated administrators to execute arbitrary OS commands
with root privileges (CVE-2020-2038). |