Prisma Access Agent Addressed Issues
Focus
Focus
Prisma Access Agent

Prisma Access Agent Addressed Issues

Table of Contents

Prisma Access Agent Addressed Issues

Review the issues that have been addressed in the Prisma Access Agent.
Where Can I Use This?What Do I Need?
  • Prisma Access (Managed by Panorama or Strata Cloud Manager)
  • NGFW (Managed by Panorama)
  • Check the prerequisites for the deployment you're using
  • Contact your Palo Alto Networks account representative to activate the Prisma Access Agent feature
Review the issues that have been addressed in Prisma Access Agent.

Issues Addressed in Prisma Access Agent 25.6.2

The following table lists the issues addressed in Prisma Access Agent version 25.6.2.
Issue IDDescription
PANG-9620
Fixed an issue where the Prisma Access Agent would automatically disconnect and remain disconnected without attempting to reconnect, leaving users without network protection. The problem occurred when the agent lost its connection to the endpoint management server and failed to re-establish the connection automatically as expected.
This occurred due to a DNS resolution timing conflict in certain network environments where the primary DNS server was unresponsive while the secondary DNS server was functioning properly. The fix adjusts the DNS resolution process to ensure proper failover occurs when the primary DNS server is unavailable, allowing the agent to maintain connectivity and automatically reconnect when network issues are resolved.
PANG-9630
Fixed an issue where the Prisma Access Agent would become stuck in a "Connecting" state after a network switch when attempting to connect to an internal gateway. This problem occurred when users experienced a network change that caused them to be logged out from the tunnel, and while the Prisma Access Agent endpoint manager web-socket would successfully reconnect, the Prisma Access Agent app would remain stuck displaying "Connecting" indefinitely.
PANG-9276
Fixed an issue where the Spyder application would display "Permission denied" errors and fail to work properly when Prisma Access Agent was installed on the same computer. Users found that Spyder would only function normally after completely removing the Prisma Access Agent from their system, creating a conflict between the two programs. The fix ensures that the Prisma Access Agent no longer interferes with Spyder, allowing both programs to run simultaneously without conflicts while maintaining the agent's security protection for other applications on the system.
PANG-9220
Fixed an issue where users encountered "Server Enrollment failure" errors after installing Prisma Access Agent version 25.4.0.29, preventing them from successfully connecting to their organization's network. The problem occurred during the initial setup process when the agent attempted to register with the endpoint management server but failed with messages indicating an invalid enrollment secret. This occurred due to a compatibility issue between the agent's security enrollment method and certain Windows system security components. When the agent tried to use the primary secure enrollment process, some Windows systems would reject the connection due to unsupported security protocols, causing the entire enrollment to fail.
PANG-9092
Fixed an issue where the Prisma Access Agent would freeze and become stuck in a non-responding state. The problem occurred when the application attempted to update multiple settings at the same time from different parts of the program, causing conflicts that would lock up the entire application. This resulted in users being unable to interact with Prisma Access Agent, as the interface would stop responding and the agent would appear to hang indefinitely. The fix ensures that all setting updates are now processed in a controlled, sequential manner to prevent these conflicts and maintain application responsiveness.
PANG-9067
Fixed an issue where the Prisma Access Agent on macOS 15.6.1 failed to connect to external gateways when selecting Best Location and incorrectly switched to internal connectivity. This issue manifested in two specific scenarios:
  1. After upgrading the operating system from macOS 15.6 to 15.6.1, Prisma Access Agent would incorrectly connect to an on-premises gateway instead of maintaining its connection to the external Prisma Access gateway that it was using prior to the OS upgrade.
  2. When users selected Best Location from the Prisma Access Agent app, the agent would search through all available Prisma Access gateways but then inappropriately switch to Internal mode, even when connected to a home WiFi network where Internal Host Detection should not be triggered.
This occurred due to the improper cleanup of the on-premises tunnel routes during the Best Location selection process, which caused the system to incorrectly determine that it was on an internal network and activate the Internal Host Detection functionality. This resulted in users being unable to establish proper external gateway connections through Prisma Access Agent on the updated macOS version, forcing the agent into internal mode when external connectivity was required and available.

Issues Addressed in Prisma Access Agent 25.6

The following table lists the issues addressed in Prisma Access Agent version 25.6.
Issue IDDescription
PANG-8200
Fixed an issue where the Prisma Access Agent on Windows devices would incorrectly display the previously connected server FQDN in the Server Name field after executing the pacli epm signout command without the --keep parameter, instead of properly resetting to show Select Server Name as expected. This inconsistency between Windows and Mac platforms has been resolved, ensuring that both operating systems now consistently reset the login view and display the default Select Server Name prompt when signing out without preserving server information.

Issues Addressed in Prisma Access Agent 25.4

The following table lists the issues addressed in Prisma Access Agent version 25.4.
Issue IDDescription
PANG-7865Fixed an issue where the Prisma Access Agent on Windows did not properly honor updated session timers after a user extended their session through the embedded browser. The agent now correctly adopts the newly extended session duration when users authenticate through the session expiry banner, preventing premature session termination and ensuring the Prisma Access Agent icon remains responsive in the system tray throughout the extended session period.
PANG-7960
Fixed an issue where the Prisma Access Agent on Windows blocked authentication in the embedded browser due to the Best Available - Fail Safe mechanism in the forwarding profile triggering during the initial connection attempt. The embedded browser now properly bypasses the fail-safe mechanism when the agent is configured to run in on-demand mode, enabling successful authentication on the first attempt without requiring users to cancel and retry the authentication process after a reboot.
PANG-7309Fixed an issue where the Prisma Access Agent on Windows failed to automatically switch from an external gateway to an internal gateway when the user's device woke from sleep mode after being connected to different network environments. The agent now properly detects network changes upon waking from sleep. It also automatically switches to the appropriate internal gateway without requiring manual sign-out via the pacli epm signout command and subsequent reauthentication through the Prisma Access Agent app.

Issues Addressed in Prisma Access Agent 25.3.1

The following table lists the issues addressed in Prisma Access Agent version 25.3.1.
Issue IDDescription
PANG-7012Fixed an issue where the embedded browser for Prisma Access Agent did not reuse the Windows Hello token for reauthentication, forcing users to manually enter their credentials despite having Windows Hello enabled on their devices. The embedded browser now properly leverages existing Windows Hello authentication tokens for seamless reauthentication without requiring manual credential entry.

Issues Addressed in Prisma Access Agent 25.3

The following table lists the issues addressed in Prisma Access Agent version 25.3.
Issue IDDescription
PANG-6738Fixed an issue where certificate authentication failed on Windows devices when certificates were stored in the machine certificate store, preventing the Prisma Access Agent from properly authenticating users with machine-level certificates. The agent now correctly accesses and utilizes client certificates from the machine certificate store, eliminating the need to manually import certificates to the user's personal certificate store as a workaround.
EPM-4616Fixed an issue where newly added internal gateways weren’t visible in existing Prisma Access Agent settings, preventing administrators from updating agent configurations with recently added internal gateways. The agent settings now automatically refresh to display all available internal gateways, including those added after the initial configuration, eliminating the need to create new agent settings to access newly added gateways.