>
    PAN-OS 10.0.5 Addressed Issues
    Focus
    Download PDF
    Focus
    1. Home
    2. PAN-OS
    3. PAN-OS 10.0 Addressed Issues
    4. PAN-OS 10.0.5 Addressed Issues
    Download PDF

    PAN-OS 10.0.5 Addressed Issues

    Table of Contents
    End-of-Life (EoL)

    PAN-OS 10.0.5 Addressed Issues

    PAN-OS® 10.0.5 addressed issues.
    Issue ID
    Description
    PAN-164922
    Fixed an issue on Panorama where a context switch to a managed firewall running PAN-OS 8.1.0 to PAN-OS 8.1.19 failed.
    To utilize this fix, upgrade Panorama to PAN-OS 10.0.5.
    PAN-164674
    Fixed a memory leak issue related to a process (mprelay) that was caused by ARP and route entries not being freed after skipping duplicate updates.
    PAN-163538
    Fixed an issue on multi-dataplane platforms where traffic through Large Scale VPN (LSVPN) tunnels dropped with the error message
    tunnel resolution failure
    .
    PAN-163503
    Fixed an issue on the passive firewall in a high availability (HA) configuration where a SD-WAN virtual network interface (VIF) status check caused associated static routes to be incorrectly withdrawn from the FIB.
    PAN-163489
    Fixed an issue where an SD-WAN VIF was incorrectly detected as inactive during the commit time, which caused associated route withdrawal.
    PAN-163415
    Fixed an issue where a memory leak related to the configd process occurred if the SD-WAN plugin was installed and many templates were configured on Panorama.
    PAN-163274
    Fixed an issue where the SD-WAN hub firewall sent traffic via a VPN tunnel interface that was inactive.
    PAN-162746
    Fixed an issue where DNS over TCP caused a process (dnsproxy) to run out of memory.
    PAN-162743
    Fixed an issue where the firewall did not receive updates for the Device Dictionary, which caused the firewall to replace new attributes in the IP address-to-device mappings with
    unknown
    .
    PAN-162534
    (
    VM-Series firewalls on Amazon Web Services (AWS) using a Gateway Load Balancer (GWLB) only
    ) Fixed an issue where when the VM-Series firewall on AWS is integrated with a GWLB, GlobalProtect did not work.
    PAN-162256
    Fixed an issue where incorrect WildFire verdicts displayed on Panorama from Cortex Data Lake.
    PAN-162059
    Fixed an issue where, after a new Layer 3 interface was created in PAN-OS 10.0.3 or 10.0.4, a downgrade to a PAN-OS 9.0 version failed with the error message U
    pstream NAT not supported in older version
    . This issue occurred whether SD-WAN was configured on the firewall or not.
    PAN-161767
    Fixed an issue where, due to a dataplane sync issue, SD-WAN traffic was forwarded to a tunnel that was inactive.
    PAN-161745
    Fixed an issue where the time-to-live (TTL) value received from the DNS server reset to 0 on DNS secure TCP transactions when anti-spyware profiles were used, which caused DNS dynamic updates to fail.
    PAN-161562
    Enhanced security in how Palo Alto Networks next-generation VM-Series and PA-Series firewalls handle asymmetric traffic.
    PAN-161428
    Fixed an issue where multiple restarts on a process (all_pktproc) occurred on firewalls in an active/passive HA configuration.
    PAN-160782
    Fixed an issue where the routed process stopped responding when the BGP peer sent AS_PATHs with more than 255 AS numbers in all of the segments combined. There can now be a maximum of 255 AS numbers in an AS_PATH list for a prefix.
    PAN-160556
    Fixed an issue that prevented decryption and IP-tag logs from being forwarded to the syslog over TCP.
    PAN-160499
    Fixed an issue on Panorama where, after an upgrade to a PAN-OS 10.0 release version, configuration pushes failed with the error
    Need to config WMI account and password for querying Microsoft directory servers
    .
    PAN-160455
    A fix was made to address an issue where certain invalid URL entries contained in an External Dynamic List (EDL) caused the devsrvr process to stop responding (CVE-2021-3048).
    PAN-159692
    Fixed an issue where the
    /dev/shm
     partition increased to 100% disk usage with multiple older versions of WildFire content updates.
    PAN-159393
    Fixed an issue where some TSL1.3 websites were not accessible when decryption was enabled.
    PAN-159135
    Fixed an issue where the firewall rejected SAML Assertions, which caused user authentication failure when the
    Validate Identity Provider Certificate
     was enabled in the SAML Server Profile in vsys3 or above.
    PAN-158844
    Adds additional debugging to be used in identifying the malformed references causing process crashes during FQDN refresh.
    PAN-158774
    Fixed an issue where random DNS queries dropped with the counter
    ctd_dns_wait_pkt_drop
     when DNS security was enabled.
    PAN-158723
    A fix was made to address an improper handling of exception conditions in the PAN-OS dataplane that enabled an unauthenticated network-based attacker to send specifically crafted traffic through the firewall that caused the service to crash (CVE-2021-3053).
    PAN-158638
    Fixed an issue where the firewall returned the following error message when attempting to request a device certificate using a one-time password (OTP):
    invalid ocsp response sig-alg
    .
    PAN-158585
    Fixed a memory leak issue related to the X-Forwarded-For (XFF) security feature.
    PAN-158328
    Fixed an issue where the firewall stopped populating the multicast FIB table with OIL entries for multicast groups.
    PAN-158293
    Fixed an issue where a sudden increase in packet buffer descriptors disrupted traffic.
    PAN-158122
    Fixed an issue where SNMP readings reported 0 for dataplane interface packet statistics when using PacketMMAP mode. This issue occurred because the physical port counters read from MAC addresses were reported as 0.
    PAN-157735
    Fixed an issue where the new PA-7000100G network processing card (NPC) took 25 minutes to start after rebooting the PA-7080 chassis.
    PAN-157721
    Fixed an issue where the firewall dropped GPRS tunneling protocol (GTPv2) Create Session Requests and Responses that had IEs 201 and 202 with the error
    Abnormal GTPv2-C message with invalid IE
    .
    PAN-157346
    Fixed an issue where HIP custom checks for plist failed when the HIP exclusion category were configured under (
    Mobile User Template > Network > GlobalProtect > Portal<portal-config> > Agent<agent-config> > HIP Data Collection
    ).
    PAN-157271
    Fixed an issue where
    Panorama > Cloud Services
     was visible to users with device group and template admin roles even if the admin role was disabled.
    PAN-157266
    Fixed an issue with the logrcvr process that caused inaccurate netflow values.
    PAN-157168
    Fixed an issue where a process (mprelay) stopped responding when displaying debug PDT commands
    PAN-157049
    (
    PA-3200 Series firewalls only
    ) Fixed an issue where the firewall processed internal path monitoring packets more slowly than expected when processing large amounts of traffic, which caused the dataplane to restart.
    PAN-156982
    Fixed an issue where the firewall didn't resolve domain names with multiple nested Canonical Name (CNAME) records when caching was enabled.
    PAN-156891
    Fixed an issue where some zip files did not download and the following error message displayed:
    resources-unavailable
    .
    PAN-156716
    Fixed an issue where the firewall sent ARP replies without checking the ingress interface when the requested IP address was configured as a destination NAT (DNAT) address.
    PAN-156498
    Fixed an issue where the User-ID Agent did not reconnect after being disconnected.
    PAN-156264
    Fixed an issue where the firewall displayed
    IP address
    Netmask
     and
    default gateway
     as
    unknown
     on the web interface as well as the CLI.
    PAN-156225
    (
    PA-3200 Series firewalls only
    ) Fixed an issue where the HA1-B port remained down after an upgrade from PAN-OS 9.1.4 to PAN-OS 9.1.5.
    PAN-155656
    Fixed an issue where multicast RTP traffic triggered unicast RTP Control Protocol (RTCP), and the predict session failed to install, which blocked the parent RTP session from forwarding packets.
    PAN-155294
    Fixed an issue where iPad devices did not display Authentication Portal multi-factor authentication (MFA) pages correctly when using Okta for push notifications.
    PAN-154899
    Fixed an out-of-memory (OOM) issue on the firewalls that caused LACP, BGP, and OSPF to go down, resulting in the firewall not receiving LACPDU messages.
    PAN-154844
    Fixed an issue where commits and autocommits repeatedly failed due to an OOM condition that disrupted the processes pan_task and devsrvr.
    PAN-154812
    Fixed a memory leak issue related to a process (configd) that was caused by log queries filtering by address.
    PAN-154376
    Fixed an issue where a process (mgmtsrvr) stopped responding and was inaccessible through SSH or HTTPS until the firewall was power cycled.
    PAN-154195
    Fixed an issue where the firewall dropped VoIP traffic over IPSec with counters
    flow_predict_convert_rtp_drop
     and
    flow_predict_convert_failed
    .
    PAN-154145
    (
    VM-Series firewalls only
    ) Fixed an issue where the management plane CPU was incorrectly reported to be high.
    PAN-153614
    Fixed an issue where user-based policies did not correctly match if the same user was included in both a policy with the username in NetBIOS format and another policy with the username in FQDN format.
    PAN-153213
    Fixed a rare issue where TCP packets randomly dropped due to reassembly failure.
    PAN-152998
    Fixed an issue where the User-ID process CPU usage remained high when a large number of Terminal Server (TS) agents were configured but only a few were connected.
    PAN-152813
    Fixed an issue with configuration memory leaks on Panorama that caused a process (configd) to restart.
    PAN-152458
    (
    VM-Series firewalls on Microsoft Hyper-V only
    ) Fixed an issue where, when upgrading to PAN-OS 9.0.8 or later, ethernet packets dropped after adding VLAN tags during egress from a subinterface. To leverage this fix, set the interface level maximum transmission unit (MTU) to 1496 or less.
    PAN-151808
    Fixed an issue where an EDL refresh job did not complete when the configuration for EDL servers used certificate profiles, due to the large server certificates.
    PAN-151218
    (
    PA-3200 Series firewalls only
    ) Fixed an issue where the `crashinfo` file was not generated after a process (all_pktproc) stopped responding on the dataplane before path monitoring triggered a device reboot.
    PAN-150867
    An enhancement was made to enable additional logging during kernel panic/oops that helps identify the cause.
    PAN-150798
    (
    PA-7000 Series firewalls only
    ) Fixed an issue where Network Processing Cards (NPC) took longer than expected or failed to boot.
    PAN-150023
    A fix was made to address an issue where an improper authentication vulnerability enabled a Security Assertion Markup Language (SAML) authenticated user to impersonate any user in the GlobalProtect portal and GlobalProtect gateway when they were configured to use SAML authentication (CVE-2021-3046).
    PAN-148549
    Fixed an issue where newly created interface management profiles were unable to be linked to subinterfaces.
    PAN-147783
    Checks were added to help prevent the dataplane from restarting.
    PAN-147228
    Fixed an issue where an application's domain name didn't resolve if the cache was disabled on the DNS Proxy object being used in the GlobalProtect Clientless VPN.
    PAN-144538
    Fixed an issue where locally disabling the rule hit-count feature on Panorama caused a memory leak.
    PAN-144470
    Fixed an issue where driver descriptor rings were out of sync in the control plane to dataplane direction, which caused internal path monitoring heartbeat failures.
    PAN-142473
    Fixed an issue where a commit failed with the following error message:
    Disk quotas add up to more than 100%. Invalid configuration.
     due to an integration issue.
    PAN-136478
    (
    PA-7000 Series firewalls
    ) where syslog forwarding over TCP did not work in a multi-vsys environment.
    PAN-136347
    Fixed an issue wherer DNS proxy TCP connections were processed incorrectly, which caused a process (
    dnsproxy
    ) to stop responding.
    PAN-134799
    Fixed an issue where packets of the same session were forwarded through a different member of an Aggregate Ethernet (AE) group once the session was offloaded.
    PAN-129927
    (
    VM-Series firewalls only
    ) Fixed an issue where firewalls with Layer 3 subinterfaces reset Class of Service (CoS) bits in 802.1q.

    Recommended For You

    © 2024 Palo Alto Networks, Inc. All rights reserved.