Focus

VM-Series and Panorama Plugins Release Notes

Addressed Issues in OpenConfig Plugin 2.1.5

Table of Contents

Addressed Issues in OpenConfig Plugin 2.1.5

Addressed issues in the 2.1.4 version of the OpenConfig plugin.

The following are addressed issues in the OpenConfig 2.1.5 version of the plugin.

PLUG-20941

Resolved an issue related to CVE-2024-45338.

PLUG-22372

The OpenConfig plugin was not listed as an available package for download or installation on the following new PA-3500 series platforms (supported from PAN-OS 12.2.0 onward):

PA-3530, PA-3540
PA-5510, PA-5520, PA-5530
PA-3510, PA-3520

Running show plugins packages on these platforms returned no OpenConfig plugin entries, making it impossible to install the plugin. As a result, users deploying PA-3500 series firewalls could not use OpenConfig streaming telemetry or gNMI. After upgrading to plugin version 2.1.5, the plugin will appear in show plugins packages and can be installed normally.

PLUG-22746

The OpenConfig plugin's on-demand packet capture (PCAP) feature checks MP and DP CPU usage every 60 seconds and terminates the capture if usage exceeds 80%. Due to a calculation bug, the DP CPU rate limit check was triggering incorrectly on production firewalls, causing packet captures to abort before reaching their configured termination parameters (file size, time limit, or packet count).

To resolve this issue, the plugin corrects the DP CPU usage scale to match the 0–1 fraction used by the threshold comparison, and adds per-core maximum CPU tracking alongside the average to improve detection accuracy. On-demand PCAP sessions will now correctly honor their configured termination parameters (duration, file size, packet count) without prematurely aborting due to false CPU threshold violations.

PLUG-22755

Fixed an issue where the deployed timeout was not properly applied to the firewall/panos pcap feature.

PLUG-22755

When initiating a remote on-demand packet capture (PCAP) via the OpenConfig plugin, any user-configured timeout value was ignored. The firewall's packet-diag timeout was reset to the default of 60 seconds upon starting the capture, overriding any custom timeout previously set (e.g., via debug dataplane packet-diag set log timeout 3600). This caused captures to terminate prematurely regardless of the timeout value specified by the operator.

To resolve this issue, the plugin was updated to include the user-configured timeout parameter in the packet capture API request, ensuring the firewall correctly applies the operator-specified timeout duration. On-demand PCAP sessions initiated through the OpenConfig plugin will now correctly honor the user-deployed timeout, allowing captures to run for their intended duration without being prematurely terminated by the default 60-second limit.

PLUG-23003

PAN-OS upgraded its PHP runtime from PHP 7 to PHP 8 as part of an underlying platform modernization. Without corresponding updates, the OpenConfig plugin's PHP-based components would fail to function correctly on PAN-OS versions shipping with PHP 8.

To resolve this issue, the plugin’s PHP components were updated to ensure compatibility with PHP 8, resolving any deprecated function usage and syntax changes introduced in the PHP 8 runtime.

PLUG-13000

When issuing a gNMI GET request using paths that include key-based filters — such as specific interface names, component names, or policy definition names — the response returned only a timestamp with no updates field, meaning no data was returned. This affected paths including:

/interfaces/interface[name=<if-name>]/ethernet/config/aggregate-id
/interfaces/interface[name=<if-name>]/ethernet/state/aggregate-id
/interfaces/interface[name=<if-name>]/subinterfaces/subinterface[index=<n>]/ipv4/config/mtu
/components/component[name=<component-name>]/temperature
/lldp/interfaces/interface[name=<if-name>]/state/neighbors
/routing-policy/policy-definitions/policy-definition[name=<policy-name>]/statements/statement[name=<stmt-name>]/conditions/match-prefix-set/state

This release corrects the path resolution logic in the OpenConfig plugin so that gNMI GET requests for key-filtered paths return the expected leaf data in the updates field of the response.

PLUG-10983

When subscribing to the /components/component/subcomponents/subcomponent/state path via gNMI (including ONCE mode), the OpenConfig plugin returned an incomplete set of subcomponent entries. The response contained only 8 entries instead of the expected 24, with the returned entries limited to internal OS-level mount paths (e.g., /opt/panlogs, operating-system, /dev, /cgroup) rather than the full set of hardware and software subcomponents.

This issue affected gNMI SUBSCRIBE requests against this path across multiple PAN-OS versions (10.1.x, 10.2.x, 11.0.x, 11.1.x, 11.2.x) and OpenConfig plugin versions 1.1.0 and later.

To resolve this issue, the plugin corrects the subcomponent enumeration logic so that gNMI SUBSCRIBE responses for this path include the full set of expected subcomponent entries. Telemetry collectors subscribing to:

/components/component/subcomponents/subcomponent/state

will now receive the complete subcomponent dataset. Monitoring workflows that depended on this path and were silently receiving partial data will now function correctly without any configuration changes.

PAN-22974

On PAN-OS versions that enforce IMA (Integrity Measurement Architecture) signature verification (PAN-OS 12.1.2 and later), gNMI SET and SUBSCRIBE requests for routing policy paths (e.g., routing-policy/defined-sets/prefix-sets) fail with a timeout error:

failed to create a gRPC client for target '<ip>:9339', timeout (2m0s)
        reached

When an OpenConfig plugin version that does not carry valid IMA release signatures (e.g., openconfig-1.3.0 or development builds) is installed on a PAN-OS build with IMA enforcement enabled, the pl-openconfig process fails to start (exit code 13), causing all gNMI connections to time out. To resolve this issue, ensure the OpenConfig plugin version is compatible with the PAN-OS version in use:

PAN-OS 12.1.x → OpenConfig plugin 2.1.4 or later (IMA-signed)
PAN-OS 12.2.x → OpenConfig plugin 2.1.5 or later

PAN-282265

Extended the OpenConfig plugin with additional data model support to achieve parity with commonly used SNMP OIDs. The following data can now be subscribed to via gNMI SUBSCRIBE:

Category	Data
Physical Sensor (ENTITY-SENSOR-MIB)	Sensor operational status (entPhySensorOperStatus), sensor value (entPhySensorValue), sensor type (entPhySensorType)
Storage (HOST-RESOURCES-MIB)	Storage type (hrStorageType)
Interface Stack (IF-MIB)	Interface stack status (ifStackStatus)
BGP Peer (BGP4-MIB)	Peer state, admin status, remote AS, remote address, local address (bgpPeerState, bgpPeerAdminStatus, bgpPeerRemoteAs, bgpPeerRemoteAddr, bgpPeerLocalAddr)
PAN-OS System (PAN-COMMON-MIB)	Application version (panSysAppVersion)
PAN-OS Sessions (PAN-COMMON-MIB)	Active sessions, maximum sessions, session utilization (panSessionActive, panSessionMax, panSessionUtilization)
PAN-OS HA (PAN-COMMON-MIB)	HA state, HA peer state (panSysHAState, panSysHAPeerState)

Operators and network management systems that previously relied on SNMP polling for the above data points can now use gNMI streaming telemetry via the OpenConfig plugin to collect this data in real time, reducing dependency on SNMP in environments that have migrated to OpenConfig-based observability.

PAN-OS Plugin for OpenConfig 2.1.5

PAN-OS Plugin for OpenConfig 2.1.4