Focus

VM-Series and Panorama Plugins Release Notes

Addressed Issues in OpenConfig Plugin 2.1.4

Table of Contents

Addressed Issues in OpenConfig Plugin 2.1.4

Addressed issues in the 2.1.4 version of the OpenConfig plugin.

The following are addressed issues in the OpenConfig 2.1.4 version of the plugin.

PLUG-18799

The OpenConfig plugin has been updated to support Integrity Measurement Architecture (IMA) signature enforcement, aligning with platform security requirements introduced in PAN-OS 12.1. This allows the plugin to operate correctly on PAN-OS versions that enforce IMA file integrity checks. Firewalls running IMA-enabled builds without this update would fail to load the plugin.

PLUG-18737

Two leaf nodes in the /components data model that were previously marked as deviations are now fully supported, enabling gNMI streaming telemetry for hardware component sensor state. Operators using gNMI streaming telemetry can now subscribe to these paths to monitor hardware health in real time. These paths are no longer deviated in the OpenConfig plugin. No configuration changes are required.

PLUG-17224

When using gNMI SUBSCRIBE requests against the /interfaces data model, the OpenConfig plugin returned only a subset of interfaces (physical Ethernet interfaces only). gNMI GET requests for the same paths returned the full set of interfaces, including aggregate (AE), VLAN, tunnel, loopback, HA, and management interfaces. Operators relying on gNMI streaming telemetry for interface state monitoring (e.g., admin-status, oper-status) were receiving incomplete data, potentially causing gaps in observability dashboards or alerting systems.

gNMI subscription responses now return the complete set of interfaces, consistent with gNMI GET responses. All interface types are now included in subscription updates:

Physical Ethernet interfaces (ethernet1/x)
Aggregate/LAG interfaces (ae1, ae2, ...)
VLAN sub-interfaces (vlan.x)
Tunnel interfaces (tunnel.x)
Loopback, management, and HA interfaces

PLUG-19042

Resolved an issue related to CVE-2024-45338.

PAN-278108

When a gNMI client (e.g., gnmic) connected using invalid credentials, the OpenConfig plugin returned a misleading error:

rpc error: code = Internal desc = Unknown message from component
        'PAN-GO'

The correct response should have been:

rpc error: code = Unauthenticated desc = invalid credentials

This issue occurred when an authentication failure string was changed from "403 Invalid Credential" to "403 API Error: Invalid Credential". The OpenConfig plugin's error parsing logic did not account for the updated format, causing it to fall through to a generic internal error response instead of mapping the failure to the proper gRPC Unauthenticated status code.

To resolve this issue, the OpenConfig plugin's error handling was changed to correctly recognize the new authentication failure message format from PAN-GO and return the appropriate Unauthenticated gRPC error code with a clear invalid credentials description. As a result, gNMI clients will now receive a properly formatted authentication error when connecting with invalid credentials, improving observability and making it easier to diagnose authentication failures programmatically.

PAN-OS Plugin for OpenConfig 2.1.4

PAN-OS Plugin for OpenConfig 2.1.3