>
    Strata Copilot
    Prisma Access Addressed Issues
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Access
    3. Prisma Access Release Notes
    4. Prisma Access Release Information
    5. Prisma Access Addressed Issues
    Download PDF
    Prisma Access

    Prisma Access Addressed Issues

    Table of Contents

    Prisma Access Addressed Issues

    Lists the known issues in Prisma Access6.1.0.
    The following table lists the issues addressed in Prisma Access 6.1.0.

    Prisma Access 6.1.1 Addressed Issues

    Issue ID
    Description
    CYR-62527Fixed an issue where syslog config filters out NAT tunnel alerts to be sent out to Strata Logging Service.
    CYR-62135Fixed an issue where, in a multitenant Panorama managed Prisma Access deployment, internal host detection could not be configured by device group and template admin users.
    CYR-60959Fixed an issue where, when enabling Private Application Access in Explicit Proxy and ZTNA Connector is also configured, an error message displayed that there was not a service connection deployed.
    CYR-59967Fixed an issue where, for RN-HP sites in OCI regions, maximum bandwidth per tunnel supported is 2Gbps because of OCI limiting per-flow traffic from their side.
    CYR-58965Fixed an issue where Panorama did not send the onboarding commit job to the back end when onboarding Service Connections, requiring a secondary push to properly trigger the commit job for Service Connections.
    CYR-54776Fixed an issue where BGP filtering was enabled on a Panorama in a multi-tenant deployment that had no supertenant. BGP filtering is not supported on a Panorama in a multi-tenant deployment that has no supertenant.
    CYR-55477Fixed an issue where, when using a site-based license, the allocated and available bandwidth for remote networks was incorrectly shown as 0 in the Panorama status page.

    Prisma Access 6.1.0-h10 Addressed Issues

    Issue ID
    Description
    CYR-71579
    Fixed an issue where the following data relating to the remote network's secondary WAN IKE gateway and IPSec template was missing during remote network bulk sync export operation when the remote network is enabled for dual WAN, causing Commit and Push validation issues.
    gateway2['authentication'] NOT SET - Secondary gateway missing pre-shared-key config
    gateway2['local-address'] NOT SET - Secondary gateway missing local address
    tunnel2['tunnel-interface'] NOT SET - Secondary tunnel missing tunnel interface
    CYR-70945Fixed an issue where plugin validation fails on Panorama MT/MU because the adem-aiops-users value is set to 400, which falls below the minimum required value per tenant of 0.
    CYR-70755Fixed an issue where the CIE profile is not added under device group for explicit proxy in Panorama.
    CYR-67131Fixed an issue where the Panorama UI mistakenly includes "Service Connection" in the Licenses and Status tabs for Business Premium licenses, which lack Service Connection support.

    Prisma Access 6.1.0-h9 Addressed Issues

    Issue ID
    Description
    CYR-70786Fixed an issue where, in multi-tenant Panorama, plugin validation fails upon bulk import operation of the remote network configuration. The issue occurred only when the remote network had secondary WAN configuration enabled.
    CYR-67720Fixed an issue where you could not enforce Transport Layer Security (TLS) version 1.3 as the minimum TLS version for the default domain, which prevented you from utilizing the latest security protocols. With this fix, you can now configure TLSv1.3 as the minimum TLS version for the default domain.
    CYR-69289Fixed an issue where Prisma Access Multi-tenant customer Fast Session Delete feature enablement was not taking effect upon commit push.

    Prisma Access 6.1.0-h8 Addressed Issues

    Issue ID
    Description
    CYR-63001
    Effective May 29, 2026, PRA has been officially rebranded as Secure Agentless Access (SAA). This update introduces an expanded range of supported applications and a modernized user experience for both administrators and end users.
    Key Changes and Enhancements
    • Modernized UI: The new user interface and updated navigation are now live directly in the Strata Cloud Manager (SCM) front end.
    • Panorama Integration: Panorama now features a cross-platform launch panel reflecting the new SAA identity.
    • Private Web Apps Support: You can now configure private web applications (HTTP/HTTPS) as a new application type.
    • Licensing Updates: Private Web Apps support is included with Prisma Access base licensing (ZTNA and Enterprise editions). Supporting RDP, SSH, and VNC application types still require the existing add-on license.

    Prisma Access 6.1.0-h7 Addressed Issues

    Issue ID
    Description
    CYR-67282Fixed an issue where the NGFW Connector was failing in staging and production environments.
    CYR-66709Fixed an issue where the Export Remote Networks configuration did not work when the Remote Networks Template IKE Gateway was configured with a Peer IP Address Type as IP instead of Dynamic.
    CYR-66504Fixed an issue where failures were encountered (for example, the response was empty) when the CA certificate was being requested by Strata Logging Service.
    CYR-66409Fixed an issue where service connection onboarding might not display properly when the administrator creates a sub-tenant's name with the "remote-networks" keyword.
    CYR-66277
    Fixed an issue where, for Prisma Access Cloud Service plugin when IP optimization was enabled and IP Allowlist was enabled, there was a change and difference detected in the configuration between the cloud and the configuration, which pushed an empty change. Because of this action, any changes made by the administrator would be attributed to the __cloud_services user instead of the admin user that made the change.
    CYR-65555Fixed an issue where, in a Multitenant Panorama, the IPv6 option could be enabled in IKE Gateway and IPsec Tunnel templates even if IPv6 WAN was disabled in the Cloud Services Plugin.
    CYR-63794Fixed an issue where, if the Panorama license was renewed after its expiration, the cloud services OTP workflow and license capability fetch workflow did not complete without manually deleting the stale/expired license key files.

    Prisma Access 6.1.0-h6 Addressed Issues

    Issue ID
    Description
    CYR-66462Fixed an issue where, for the NGFW connector to work in staging and production environments, customers must use Cloud Service Plugin version 6.1.0-ch48 only.
    CYR-66281Fixed an issue where SPNs were not appearing on the SD-WAN UI because of a Cloud Service Plugin issue.
    CYR-64827Fixed an issue to remove bad import for get_rn_to_ep_ip_list.py.
    CYR-64328Fixed an issue where these special characters are blocked from plugin Colo-Connect configurations:
    ' - Single Quote
    " - Double Quote
    \ - Backslash
    ; - Semicolon
    – Double dash
    # -Hash
    /* ... */ -C-style comment
    0x00
    \x00
    / Forward slash
    NULL
    CYR-63235Fixed an issue where, if the Panorama device is in multitenant mode, the Cloud Services plugin validation fails when an IPv6 address is configured for tunnel monitoring in the service connection's IPsec tunnel template.
    CYR-61262Fixed a logging issue for commit validation on the Panorama plugin to show the total number of Trusted Source IP Addresses instead of the total number of object entries.

    Prisma Access 6.1.0-h5 Addressed Issues

    Issue ID
    Description
    CYR-65646Fixed an issue where, in the Panorama Explicit Proxy configuration UI, the "Enable Prisma Access Browser" toggle is not visible.
    CYR-65009Fixed an issue where users with the Device Group and Template role cannot push commit for Prisma Access after upgrading to CSP 5.2.0-h69. The user can now commit and push the configuration changes.
    CYR-54503Fixed an issue where domain configurations were not applied to mobile users during a partial commit on Panorama, while the same configurations were successfully applied to remote networks.

    Prisma Access 6.1.0-h4 Addressed Issues

    Issue ID
    Description
    CYR-63880Fixed an issue where a new GlobalProtect app could not be activated in Panorama.
    CYR-63785Fixed an issue where, for Panorama Site-Based License tenants, only 4 sites were displayed on Branch Sites pages. With this fix, up to 25 sites are displayed per page.
    CYR-63697Fixed an issue where commit validation did not fail when Remote Network was configured with ECMP Load Balancing with Symmetric Return and was enabled with no ECMP link.
    CYR-63690Fixed an issue where a "Failed to load mobile user gateways" error occurred during mobile user onboarding for setups with high subtenant counts.
    CYR-63656Fixed an issue where, for Panorama site-based license tenants, if the site was configured in an edge location, the compute location name was displayed on the Branch Sites page instead of edge location name.
    CYR-62342Fixed an issue where the user was unable to configure Quality of Service (QoS) for specific compute locations such as Sweden.
    CYR-61254Fixed an issue where Prisma Access multitenancy managed through Panorama could be enabled for new deployments. For more information, see the EOL announcement at https://www.paloaltonetworks.com/services/support/end-of-life-announcements.
    CYR-60685Fixed an issue where plugin validation failed after reducing the Aggregate Bandwidth allocation for the US-East location.
    CYR-60070Fixed an issue where all Panorama environments were not required to have the device certificate installed.
    CYR-59382Fixed an issue where, when onboarding a legacy (non-remote network high performance) site on Panorama, commit fails because of a missing QoS profile.
    CYR-56776Fixed an issue where users need to block "Allow all IPs and Auth bypass *.*" in Explicit Proxy configuration.
    CYR-44968Fixed an issue where Prisma Access no longer validates the 30-minute maximum limit for automatic VPN restoration when you enable IP Optimization.

    Prisma Access 6.1.0-h2 Addressed Issues

    Issue ID
    Description
    CYR-62135Fixed an issue where, in a multitenant Panorama managed Prisma Access deployment, internal host detection could not be configured by device group and template admin users.
    CYR-61659Fixed an issue where, before changing the infrastructure subnet, administrators were not provided a message indicating that a maintenance window and a TAC case is required.
    CYR-61474Fixed an issue where the Explicit Proxy feature in Prisma Access displayed "Prisma Access Browser" instead of "Prisma Browser".
    CYR-61443Fixed an issue where, under the OnboardingService Connection area in Strata Cloud Manager, when Colo-Connect service connections are onboarded, the BGP-specific column that includes overlay BGP status and peer RIB and routing table information displayed a pop-up window with an error that the BGP status couldn't be found.
    CYR-60959Fixed an issue where, when enabling Private Application Access in Explicit Proxy and ZTNA Connector is also configured, an error message displayed that there was not a service connection deployed.
    CYR-59412Fixed an issue where serviceability commands did not yield any output in a tenant that had Dynamic Privilege Access enabled.
    CYR-54776Fixed an issue where BGP filtering was enabled on a Panorama in a multi-tenant deployment that had no supertenant. BGP filtering is not supported on a Panorama in a multi-tenant deployment that has no supertenant.
    CYR-52444Fixed an issue where, in a multitenant Panorama Managed Prisma Access deployment, the BGP Filtering feature was supported only on a parent Tenant and was not supported on sub-tenants.

    Prisma Access 6.1.0-h1 Addressed Issues

    Issue ID
    Description
    CYR-61065Fixed an issue where a Panorama local commit failed with a validation error: Failed Plugin Validation error after a Cloud Services Plugin upgrade.
    CYR-60869Fixed an issue where the export operation failed to download the Remote Network configuration from Panorama.
    CYR-60105Fixed an issue where the Panorama one-time password (OTP) workflow for a new deployment failed from the UI.
    CYR-59494Fixed an issue where the list of Remote Networks on the Remote Networks status page displayed a count of 0.
    CYR-58530Fixed an issue on Panorama where you could not update hypervisor profile fields when an on-premises deployment was pending.
    CYR-55824Fixed an issue where the Panorama UI did not allow BGP configuration for the passive tunnel in an Active/Passive tunnel configuration.
    CYR-54007Fixed an issue where, after reducing the Remote Network's aggregate bandwidth from a Safari browser, the browser fails to display the list of unused SPN names that will be released.

    Prisma Access 6.1.0 Addressed Issues

    Issue ID
    Description
    CYR-58852
    Fixed an issue where Panorama commit validation workflows would fail if a tenant's licenses had the "no_limit" string under the service_connection local service chain information in the license_capabilities. This occurred because the system was attempting to convert the string to an integer.
    CYR-58332
    Fixed an issue where commits to GlobalProtect gateways failed with a validation error related to the `max-version` setting in the SSL-TLS service profile.
    CYR-58134
    Fixed an issue where upgrading the cloud_services plugin from version 5.1.0-39 to 6.0.0-11 on Panorama automatically disabled the "Enable Private App Access" option. When this configuration was pushed to Prisma Access, it caused an outage to critical internal applications.
    CYR-57700
    Fixed an issue where any changes to the Cloud Services Plugin onboarding configuration on Panorama resulted in an error when the 'DEFAULT' config was missing in the GlobalProtect portal.
    CYR-57636
    Fixed an issue where Panorama could not display bandwidth usage statistics for remote networks in the tenant status view when managing Prisma Access with multitenancy enabled.
    CYR-55432
    Fixed an issue where Internal Host Detection (IHD) details were grayed out during Mobile User onboarding.
    CYR-54503
    Fixed an issue where domain configurations were not applied to mobile users during a partial commit on Panorama, while the same configurations were successfully applied to remote networks.
    CYR-53941
    Fixed an issue where, when onboarding remote networks using configuration import in a multitenant deployment, an import error was seen.
    CYR-51619
    Fixed an issue where, after creating a new regional IP pool for IP the pool group 31 region, a 'blank ip pool' message was received in the Cloud services plugin UI.
    CYR-49944
    Fixed an issue where a secondary DNS server was configured, which is not allowed.

    © 2026 Palo Alto Networks, Inc. All rights reserved.