End-of-Life (EoL)

PAN-OS 10.0.5 Addressed Issues

PAN-OS® 10.0.5 addressed issues.
Issue ID
Fixed an issue on Panorama where a context switch to a managed firewall running PAN-OS 8.1.0 to PAN-OS 8.1.19 failed.
To utilize this fix, upgrade Panorama to PAN-OS 10.0.5.
Fixed a memory leak issue related to a process (mprelay) that was caused by ARP and route entries not being freed after skipping duplicate updates.
Fixed an issue on multi-dataplane platforms where traffic through Large Scale VPN (LSVPN) tunnels dropped with the error message
tunnel resolution failure
Fixed an issue on the passive firewall in a high availability (HA) configuration where a SD-WAN virtual network interface (VIF) status check caused associated static routes to be incorrectly withdrawn from the FIB.
Fixed an issue where an SD-WAN VIF was incorrectly detected as inactive during the commit time, which caused associated route withdrawal.
Fixed an issue where a memory leak related to the configd process occurred if the SD-WAN plugin was installed and many templates were configured on Panorama.
Fixed an issue where the SD-WAN hub firewall sent traffic via a VPN tunnel interface that was inactive.
Fixed an issue where DNS over TCP caused a process (dnsproxy) to run out of memory.
Fixed an issue where the firewall did not receive updates for the Device Dictionary, which caused the firewall to replace new attributes in the IP address-to-device mappings with
VM-Series firewalls on Amazon Web Services (AWS) using a Gateway Load Balancer (GWLB) only
) Fixed an issue where when the VM-Series firewall on AWS is integrated with a GWLB, GlobalProtect did not work.
Fixed an issue where incorrect WildFire verdicts displayed on Panorama from Cortex Data Lake.
Fixed an issue where, after a new Layer 3 interface was created in PAN-OS 10.0.3 or 10.0.4, a downgrade to a PAN-OS 9.0 version failed with the error message U
pstream NAT not supported in older version
. This issue occurred whether SD-WAN was configured on the firewall or not.
Fixed an issue where, due to a dataplane sync issue, SD-WAN traffic was forwarded to a tunnel that was inactive.
Fixed an issue where the time-to-live (TTL) value received from the DNS server reset to 0 on DNS secure TCP transactions when anti-spyware profiles were used, which caused DNS dynamic updates to fail.
Enhanced security in how Palo Alto Networks next-generation VM-Series and PA-Series firewalls handle asymmetric traffic.
Fixed an issue where multiple restarts on a process (all_pktproc) occurred on firewalls in an active/passive HA configuration.
Fixed an issue where the routed process stopped responding when the BGP peer sent AS_PATHs with more than 255 AS numbers in all of the segments combined. There can now be a maximum of 255 AS numbers in an AS_PATH list for a prefix.
Fixed an issue that prevented decryption and IP-tag logs from being forwarded to the syslog over TCP.
Fixed an issue on Panorama where, after an upgrade to a PAN-OS 10.0 release version, configuration pushes failed with the error
Need to config WMI account and password for querying Microsoft directory servers
A fix was made to address an issue where certain invalid URL entries contained in an External Dynamic List (EDL) caused the devsrvr process to stop responding (CVE-2021-3048).
Fixed an issue where the
partition increased to 100% disk usage with multiple older versions of WildFire content updates.
Fixed an issue where some TSL1.3 websites were not accessible when decryption was enabled.
Fixed an issue where the firewall rejected SAML Assertions, which caused user authentication failure when the
Validate Identity Provider Certificate
was enabled in the SAML Server Profile in vsys3 or above.
Adds additional debugging to be used in identifying the malformed references causing process crashes during FQDN refresh.
Fixed an issue where random DNS queries dropped with the counter
when DNS security was enabled.
A fix was made to address an improper handling of exception conditions in the PAN-OS dataplane that enabled an unauthenticated network-based attacker to send specifically crafted traffic through the firewall that caused the service to crash (CVE-2021-3053).
Fixed an issue where the firewall returned the following error message when attempting to request a device certificate using a one-time password (OTP):
invalid ocsp response sig-alg
Fixed a memory leak issue related to the X-Forwarded-For (XFF) security feature.
Fixed an issue where the firewall stopped populating the multicast FIB table with OIL entries for multicast groups.
Fixed an issue where a sudden increase in packet buffer descriptors disrupted traffic.
Fixed an issue where SNMP readings reported 0 for dataplane interface packet statistics when using PacketMMAP mode. This issue occurred because the physical port counters read from MAC addresses were reported as 0.
Fixed an issue where the new PA-7000100G network processing card (NPC) took 25 minutes to start after rebooting the PA-7080 chassis.
Fixed an issue where the firewall dropped GPRS tunneling protocol (GTPv2) Create Session Requests and Responses that had IEs 201 and 202 with the error
Abnormal GTPv2-C message with invalid IE
Fixed an issue where HIP custom checks for plist failed when the HIP exclusion category were configured under (
Mobile User Template > Network > GlobalProtect > Portal<portal-config> > Agent<agent-config> > HIP Data Collection
Fixed an issue where
Panorama > Cloud Services
was visible to users with device group and template admin roles even if the admin role was disabled.
Fixed an issue with the logrcvr process that caused inaccurate netflow values.
Fixed an issue where a process (mprelay) stopped responding when displaying debug PDT commands
PA-3200 Series firewalls only
) Fixed an issue where the firewall processed internal path monitoring packets more slowly than expected when processing large amounts of traffic, which caused the dataplane to restart.
Fixed an issue where the firewall didn't resolve domain names with multiple nested Canonical Name (CNAME) records when caching was enabled.
Fixed an issue where some zip files did not download and the following error message displayed:
Fixed an issue where the firewall sent ARP replies without checking the ingress interface when the requested IP address was configured as a destination NAT (DNAT) address.
Fixed an issue where the User-ID Agent did not reconnect after being disconnected.
Fixed an issue where the firewall displayed
IP address
default gateway
on the web interface as well as the CLI.
PA-3200 Series firewalls only
) Fixed an issue where the HA1-B port remained down after an upgrade from PAN-OS 9.1.4 to PAN-OS 9.1.5.
Fixed an issue where multicast RTP traffic triggered unicast RTP Control Protocol (RTCP), and the predict session failed to install, which blocked the parent RTP session from forwarding packets.
Fixed an issue where iPad devices did not display Authentication Portal multi-factor authentication (MFA) pages correctly when using Okta for push notifications.
Fixed an out-of-memory (OOM) issue on the firewalls that caused LACP, BGP, and OSPF to go down, resulting in the firewall not receiving LACPDU messages.
Fixed an issue where commits and autocommits repeatedly failed due to an OOM condition that disrupted the processes pan_task and devsrvr.
Fixed a memory leak issue related to a process (configd) that was caused by log queries filtering by address.
Fixed an issue where a process (mgmtsrvr) stopped responding and was inaccessible through SSH or HTTPS until the firewall was power cycled.
Fixed an issue where the firewall dropped VoIP traffic over IPSec with counters
VM-Series firewalls only
) Fixed an issue where the management plane CPU was incorrectly reported to be high.
Fixed an issue where user-based policies did not correctly match if the same user was included in both a policy with the username in NetBIOS format and another policy with the username in FQDN format.
Fixed a rare issue where TCP packets randomly dropped due to reassembly failure.
Fixed an issue where the User-ID process CPU usage remained high when a large number of Terminal Server (TS) agents were configured but only a few were connected.
Fixed an issue with configuration memory leaks on Panorama that caused a process (configd) to restart.
VM-Series firewalls on Microsoft Hyper-V only
) Fixed an issue where, when upgrading to PAN-OS 9.0.8 or later, ethernet packets dropped after adding VLAN tags during egress from a subinterface. To leverage this fix, set the interface level maximum transmission unit (MTU) to 1496 or less.
Fixed an issue where an EDL refresh job did not complete when the configuration for EDL servers used certificate profiles, due to the large server certificates.
PA-3200 Series firewalls only
) Fixed an issue where the `crashinfo` file was not generated after a process (all_pktproc) stopped responding on the dataplane before path monitoring triggered a device reboot.
An enhancement was made to enable additional logging during kernel panic/oops that helps identify the cause.
PA-7000 Series firewalls only
) Fixed an issue where Network Processing Cards (NPC) took longer than expected or failed to boot.
A fix was made to address an issue where an improper authentication vulnerability enabled a Security Assertion Markup Language (SAML) authenticated user to impersonate any user in the GlobalProtect portal and GlobalProtect gateway when they were configured to use SAML authentication (CVE-2021-3046).
Fixed an issue where newly created interface management profiles were unable to be linked to subinterfaces.
Checks were added to help prevent the dataplane from restarting.
Fixed an issue where an application's domain name didn't resolve if the cache was disabled on the DNS Proxy object being used in the GlobalProtect Clientless VPN.
Fixed an issue where locally disabling the rule hit-count feature on Panorama caused a memory leak.
Fixed an issue where driver descriptor rings were out of sync in the control plane to dataplane direction, which caused internal path monitoring heartbeat failures.
Fixed an issue where a commit failed with the following error message:
Disk quotas add up to more than 100%. Invalid configuration.
due to an integration issue.
PA-7000 Series firewalls
) where syslog forwarding over TCP did not work in a multi-vsys environment.
Fixed an issue wherer DNS proxy TCP connections were processed incorrectly, which caused a process (
) to stop responding.
Fixed an issue where packets of the same session were forwarded through a different member of an Aggregate Ethernet (AE) group once the session was offloaded.
VM-Series firewalls only
) Fixed an issue where firewalls with Layer 3 subinterfaces reset Class of Service (CoS) bits in 802.1q.

Recommended For You