Known Issues Related to PAN-OS 10.0 Releases
Table of Contents
Expand all | Collapse all
- Enterprise Data Loss Prevention Features
- IoT Security Features
- Content Inspection Features
- Decryption Features
- GlobalProtect Features
- Management Features
- Certificate Management Features
- Panorama Features
- Networking Features
- User-ID Features
- Policy Features
- Authentication Features
- WildFire Features
- Virtualization Features
- SD-WAN Features
- Mobile Infrastructure Security Features
- New Hardware Introduced with PAN-OS 10.0
- Changes to Default Behavior
- Associated Software and Content Versions
- PAN-OS 10.0.12 Known Issues
- PAN-OS 10.0.11 Known Issues
- PAN-OS 10.0.10 Known Issues
- PAN-OS 10.0.9 Known Issues
- PAN-OS 10.0.8 Known Issues
- PAN-OS 10.0.7 Known Issues
- PAN-OS 10.0.6 Known Issues
- PAN-OS 10.0.5 Known Issues
- PAN-OS 10.0.4 Known Issues
- PAN-OS 10.0.3 Known Issues
- PAN-OS 10.0.2 Known Issues
- PAN-OS 10.0.1 Known Issues
- Known Issues for the CN-Series on Version 10.0
- PAN-OS 10.0.12-h1 Addressed Issues
- PAN-OS 10.0.12 Addressed Issues
- PAN-OS 10.0.11-h1 Addressed Issues
- PAN-OS 10.0.11 Addressed Issues
- PAN-OS 10.0.10-h1 Addressed Issues
- PAN-OS 10.0.10 Addressed Issues
- PAN-OS 10.0.9 Addressed Issues
- PAN-OS 10.0.8-h8 Addressed Issues
- PAN-OS 10.0.8-h4 Addressed Issues
- PAN-OS 10.0.8 Addressed Issues
- PAN-OS 10.0.7 Addressed Issues
- PAN-OS 10.0.6 Addressed Issues
- PAN-OS 10.0.5 Addressed Issues
- PAN-OS 10.0.4 Addressed Issues
- PAN-OS 10.0.3 Addressed Issues
- PAN-OS 10.0.2 Addressed Issues
- PAN-OS 10.0.1 Addressed Issues
- PAN-OS 10.0.0 Addressed Issues
Known Issues Related to PAN-OS 10.0
List of known issues in all PAN-OS® 10.0 releases.
The Consolidated List of PAN-OS 10.0 Known Issues includes all known issues that impact the PAN-OS
®10.0 release. This list includes both outstanding issues and issues that are addressed in Panorama™, GlobalProtect™, VM-Series plugins, and WildFire
®, as well as known issues that apply more general or that are not identified by a specific issue ID.
To review the subset of outstanding known issues for a specific PAN-OS 10.0 maintenance release, see the following lists:
Consolidated List of PAN-OS 10.0 Known Issues
If you use Panorama to retrieve logs from Cortex Data Lake (CDL), new log fields (including for Device-ID, Decryption, and GlobalProtect) are not visible on the Panorama web interface.
Upgrading a PA-220 firewall takes up to an hour or more.
PA-220 firewalls are experiencing slower web interface and CLI performance times.
Upgrading Panorama with a local Log Collector and Dedicated Log Collectors to PAN-OS 8.1 or a later PAN-OS release can take up to six hours to complete due to significant infrastructure changes. Ensure uninterrupted power to all appliances throughout the upgrade process.
A critical System log is generated on the VM-Series firewall if the minimum memory requirement for the model is not available.
Changes to an IoT Security subscription license take up to 24 hours to have effect on the IoT Security app.
An IoT Security production license cannot be installed on a firewall that still has a valid IoT Security eval or trial license.
Workaround:Wait until the 30-day eval or trial license expires and then install the production license.
Traffic logs forwarded to Cortex Data Lake by a Panorama-managed firewall in a high availability (HA) cluster may appear duplicated in the Panorama Traffic logs (
For data retrieved from Cortex Data Lake, the Threat Name column in
When you rename a device group, template, or template stack in Panorama that is part of a VMware NSX service definition, the new name is not reflected in NSX Manager. Therefore, any ESXi hosts that you add to a vSphere cluster are not added to the correct device group, template, or template stack and your Security policy is not pushed to VM-Series firewalls that you deploy after you rename those objects. There is no impact to existing VM-Series firewalls.
After using the firewall CLI to add a WildFire appliance with an IPv6 address, the initial connection may fail.
Workaround:Retry connecting after you restart the web server with the following command:
debug software restart process web-server.
On the Panorama management server, if you create multiple device group
Objectswith the same name in the Shared device group and any additional device groups (
) under the same device group hierarchy that are used in one or more
Policies, renaming the object with a shared name in any device group causes the object name to change in the policies where it is used. This issue applies only to device group objects that can be referenced in a Security policy rule.
Changing the name of the address object in the
Shareddevice group causes the references in the Policy rule to use the renamed
Sharedobject instead of the device group object.
debug skip-cert-renewal-check-syslog yescommand is not available on Log Collector CLI to stop the Dedicated Log Collector from trying to renew the device certificate and displaying the following error:
No valid device certificate found
On the Panorama management server, pushing an unsupported Minimum Password Complexity (
) to a managed firewall erroneously displays
commit time outas the reason the commit failed.
A UI issue in PAN-OS renders the contents of the
Inline MLtab in the
URL Filtering Profileinaccessible on firewalls licensed for Advanced URL Filtering. Additionally, a message indicating that a
License required for URL filtering to functionis unavailable displays at the bottom of the UI. These errors do not affect the operation of Advanced URL Filtering or URL Filtering Inline ML.
Workaround:Configuration settings for URL Filtering Inline ML must be applied through the CLI. The following configuration commands are available:
Dedicated Log Collector system and config logs cannot be ingested and are dropped when they are forwarded to a Panorama management server in Management Only mode, resulting in Dedicated Log Collector system and config logs not being viewable on Panorama in Management Only mode.
On the Panorama management server, local or Dedicated Log Collector mode cannot successfully join an ElasticSearch cluster when added to a Collector Group (
) if the SSH key length for a Log Collector in the cluster is greater than 2048 characters.
Superuser administrators with read-only privileges (
) are unable to view the hardware ACL blocking setting and duration in the CLI using the commands:
No results are displayed when you
Show Application Filterfor a Security policy rule (
Show Application Filter
On the Panorama management server, the
ACCreturns inaccurate results when you filter for
New App-IDusing the
In 10.0, 9 GB of memory might be insufficient for the VM-300 depending upon the feature set or combination of feature sets used on the firewall.
Workaround: If you experience memory resource related issues, increase memory to 11 GB to accommodate the additional memory requirements of some of the features or combination of features. Alternately, you can Enable ZRAM on the VM-Series Firewall to improve memory usage.
On the Panorama management server, clicking
Run Nowfor a custom report (
) with 32 or more filters in the Query Builder returns the result
Manage Custom Reports
No matching records
On the Panorama management server, you are unable to configure a master key (
) for a managed firewall if an interface (
Master Key and Diagnostics
) references a zone pushed from Panorama.
Workaround:Remove the referenced zone from the interface configuration to successfully configure a master key.
This issue is now resolved. SeePAN-OS 10.0.6 Addressed Issues
Fixed an issue where, when a firewall or Panorama appliance configured with a proxy was upgraded to PAN-OS 10.0.3 or a later release, it failed to connect to edge service.
On the Panorama management server, pushes to managed firewalls (
Push to Devices
Commit and Push) may fail when an EDL (
) is configured to
External Dynamic Lists
Check for updatesevery 5 minutes due to the commit and EDL fetch processes overlapping. This is more likely to occur when multiple EDLs are configured to check for updates every 5 minutes.
Next-Gen Firewalls are unable to connect to a syslog server when the certificates required to connect to the syslog server are part of a Certificate Profile (
) if the
Use OCSPsetting is enabled to check the revocation status of certificates.
Use CRLto check the revocation status of certificates in the Certificate Profile.
In some cases, the firewall may not receive updates for the Device Dictionary, which causes the firewall to replace new attributes in the IP address-to-device mappings with “unknown.”
Workaround: Reboot the firewall.
Firewalls erroneously generate a
highseverity system log (
) when the firewall connects to a syslog server.
On the Panorama management server in a high availability (HA) configuration, content updates (
) manually uploaded to the active HA peer are not synchronized to the passive HA peer when you
Installa content update and enable
Sync to HA Peer.
Icons in the left sidebar have multiple layers. This issue does not affect any functionality.
ACC, data cannot be imported or exported when a
) that contains characters not supported by URL format, such as
Set Tab Filters
DOMAIN/USER, is applies to the
When you configure an SD-WAN full mesh VPN cluster, Auto VPN automatically creates an M x N mesh between all devices you add, regardless of whether they are branches or hubs. This mesh configuration will have tunnels that connect low-cost services to higher-cost services and there is no way for you to prioritize the tunnel preference. For example, a low-cost broadband link at site A will create a VPN tunnel to a high-cost LTE link at site B and traffic will be sent over the tunnel members of the virtual interface without prioritization.
As a result of a telemetry handling update, the Source Zone field in the DNS analytics logs (viewable in the DNS Analytics tab within AutoFocus) might not display correct results.
On downgrade to PAN-OS 9.1, Enterprise Data Loss Prevention (DLP) filtering settings (
) are not removed and cause commit errors for the downgraded firewall if you do not uninstall the Enterprise DLP plugin before downgrade.
Workaround:After you successfully downgrade a managed firewall to PAN-OS 9.1, commit and push from Panorama to remove the Enterprise DLP filtering settings and complete the downgrade.
When a firewall has hardware offloading turned on and OSPF enabled, if ECMP is enabled or disabled for a virtual router during a configuration commit, OSPF sessions may get stuck in Exchange Start state.
Workaround:Disable OSPF when enabling or disabling ECMP, and then re-enable OSPF in the next commit.
Panorama only) If you configure a standard custom vulnerability signature in a custom Vulnerability Protection profile in a shared device group, the shared profile custom signatures do not populate in the other device groups when you configure a combination custom vulnerability signature.
Workaround:Use the CLI to update the combination signature.
If the firewall fails a file system integrity check while FIPS-CC mode is enabled, the appliance will receive a hash mismatch error and enter maintenance mode on the next reboot.
Workaround:Upgrade to PAN-OS 10.0.2.
VM-Series Firewalls on Azure only) For VM-Series firewall on Azure that use accelerated networking interfaces, hot plug notifications cause some traffic disruption. These hotplug notification events are generated on Azure, typically when the host is undergoing any maintenance or migrations on their end, and these events are not initiated or controlled by the VM-Series firewall.
On the Panorama management server, downgrading from a PAN-OS 10.0 release to a PAN-OS 9.1 release causes Panorama commit (
) failures if a custom report (
Commit to Panorama
) is configured to Group By
Manage Custom Reports
Workaround:After successful downgrade, reconfigure the Group By setting in the custom report.
When an application matches an SD-WAN policy and some sessions for the same application do not match an SD-WAN policy, the SD-WAN Monitoring—Traffic Characteristics screen displays the Links Used information with an SD-WAN policy and a null policy. Sessions that do not have an SD-WAN policy ID are filtered from Links Used.
Workaround: If you want to see session logs that include a default selection, create a catch-all SD-WAN policy rule and place it last in the list of SD-WAN policies.
On the Panorama management server, context switching to and from the managed firewall web interface may cause the Panorama administrator to be logged out.
Workaround:Log out and back in to the Panorama web interface.
On the Panorama management server, the Type column in the System logs (
) for managed firewalls running a PAN-OS 9.1 release erroneously display
iotas the type.
On the Panorama management server, downgrading to PAN-OS 9.1 with the Panorama plugin for Cisco TrustSec version 1.0.2 installed does not automatically transform the plugin to be compatible with PAN-OS 9.1
Workaround:After successful downgrade to PAN-OS 9.1,
) of the Panorama plugin for Cisco TrustSec and then reconfigure the plugin.
On the Panorama management server, scheduled email PDF reports (
) fail if a GIF image is used in the header or footer.
When using the Chrome browser on an Apple MAC laptop, firewalls managed by the Panorama management server running PAN-OS 10.0.1 may not display when you
)when you push a configuration change to managed firewalls.
Commit and Push or Commit
Push to Devices
Workaround:Log in to the Panorama web interface using the Safari browser or manually adjust the size of the Push Scope Selection window until the managed firewalls are displayed.
On the Panorama management server CLI, the overall report status for a report query is marked as
Donedespite reports generated from logs in the Cortex Data Lake (CDL) from the PODamericas Collector Group jobs are still in a
PA-7080 Series firewalls deployed with 100G-NPC cards and legacy cards using older system management controllers (SMC) with over 2,500 IPSec tunnels commit successfully but the 100G-NPC cards fail and display as
The Bonjour Reflector option is supported on up to 16 interfaces. If you enable it on more than 16 interfaces, the commit succeeds and the Bonjour Reflector option is enabled only for the first 16 interfaces and ignored for any additional interfaces.
On the VM-Series firewall on Microsoft Hyper-V, when upgrading to PAN-OS 10.0.0 or later, ethernet packets might be dropped after adding VLAN tags during egress from a subinterface.
Workaround: Create the Hyper-V Virtual Switch with MTU size 1504, store as persistent and reboot for the changes to take effect. Before upgrading PAN-OS, access the VM-Series firewall CLI and set the MTU size on firewall interfaces to 1504.
When you have an active/passive HA pair of PA-3200 Series firewalls running PAN-OS 10.0.0 with NAT configured, if you upgrade one firewall to PAN-OS 10.0.1, the firewall goes to non-functional state due to a NAT oversubscription mismatch between the HA peers. The same non-functional state results if both HA peers are running PAN-OS 10.0.1 and you downgrade one to PAN-OS 10.00. The upgraded or downgraded firewall goes to non-functional state because PAN-OS 10.0.0 and 10.0.1 have different default NAT oversubscription rates.
Workaround: After an upgrade or downgrade, modify the NAT oversubscription rate on one firewall so that the rates on the HA pair match.
On the Panorama management server,
) incorrectly displays an existing route as Added and the new route as an existing route in the Candidate Configuration when you configure a new virtual router route (
Commit to Panorama
There is a known issue where M-100 appliances are able to download and install a PAN-OS 10.0 release image even though the M-100 appliance is no longer supported after PAN-OS 9.1. (Refer to the hardware end-of-life dates.)
On the Panorama management server, you are unable to commit any configuration changes after you successfully downgrade from PAN-OS 10.0 to PAN-OS 9.1 or earlier release due to custom admin roles (
) configured on Panorama.
Workaround:Log in to the Panorama CLI and load the running config
On the Panorama management server, read-only Panorama administrators (
) can load managed firewall configuration Backups (
If a Security rule uses a IP Address External Dynamic List (EDL) for IPv6 traffic, the information for the EDL does not display in the Source EDL or Destination EDL columns in the logs.
On a PA-7000 Series firewall chassis having multiple slots, when HA clustering is enabled on an active/active HA pair, the session table count for one of the peers can show a higher count than the actual number of active sessions on that peer. This behavior can be seen when the session is being set up on a non-cache slot (for example, when a session distribution policy is set to round-robin or session-load); it is caused by the additional cache lookup that happens when HA cluster participation is enabled.
Multi-plugin support for Panorama is not enabled by default on Panorama 10.0.0.
Workaround: Enable multi-plugin support by accessing the Panorama CLI and executing the commands
request feature enable yes feature-name dau3and
debug software restart process configd.
If you deploy a VM-Series firewall on VMware NSX that has been assigned a serial number that was used by a previously deactivated firewall, the new firewall might be deployed in a deactivated or partially deactivated state.
Workaround:You must delete the firewall in NSX Manager. In Panorama, delete the firewall from the Template Stack, Device Group, and Managed Devices lists and Commit your changes. The redeploy the firewall.
If you downgrade from PAN-OS 10.0 to PAN-OS 9.1, a commit error occurs if the HA1 interface isn’t configured.
Workaround:You can either select the PAN-OS 9.1 configuration you were using before you upgraded to PAN-OS 10.0 or, before you downgrade to PAN-OS 9.1, you can use the CLI configuration command to configure the HA1 interface (
set deviceconfig high-availability interface ha1) and commit.
Samples processed using WildFire inline ML on the PA-220, PA-820, and PA-850 appliances do not support automatic false-positive correction.
Automatic quarantine of a device based on forwarding profile or log setting does not work on the PA-7000 Series firewalls.
The Panorama management server continues to forward syslogs to a syslog server over the management interface when configured to forward syslogs over the Ethernet1/1 interface (
After you install the device certificate on a new Panorama management server, Panorama is not able to connect to the IoT Security edge service.
Workaround:Restart Panorama to connect to the IoT Security edge service.
During updates to the Device Dictionary, the IoT Security service does not push new Device-ID attributes (such as new device profiles) to the firewall until a manual commit occurs.
Workaround:Perform a force commit to push the attributes in the content update to the firewall.
In an Active-Passive high availability (HA) configuration, an error displays if you create a device object on the passive device.
Workaround:Load the running configuration and perform a force commit to sync the devices.
On the firewall CLI, the
show system infocommand displays the management IP address of the firewall as the Ethernet1/1 interface IP address.
On the Panorama management server, the IPv4 address (
) displays the Ethernet1/1 interface IP address.
When you install an IoT Security eval license on a firewall, the Device Object page in the firewall web interface erroneously displays a message that a license is required for the page to function although it actually functions properly.
If you enter a search term for Events that are related to IoT in the System logs and apply the filter, the page displays an
Type Attributeto filter the logs and use the search term as the
Description Attribute. For example:
( subtype eq iot ) and ( description contains 'gRPC connection' ).
In an active-passive HA configuration, tags for dynamic user groups are not persistent after rebooting the firewall because the active firewall does not sync the tags to the passive firewall during failover.
SD-WAN server-to-client symmetric return does not function correctly under certain circumstances, and the issue can also affect path selection of parent/child applications, such as FTP.
After downgrading a Panorama management server from PAN-OS 10.0 to PAN-OS 9.1, the
logdprocesses may crash when Panorama reboots.
Workaround:Panorama automatically restarts the
Changing the device group configured in a monitoring definition from a child DG to a parent DG, or vice versa, might cause firewalls configured in the child DG to lose IP tag mapping information received from the monitoring definition. Only firewalls assigned to the parent DG receive IP tag mapping updates.
Workaround: Perform a manual config sync on the device group that lost the IP tag mapping information.
Enhanced application logging is not supported for firewalls connected to Cortex Data Lake through a proxy server.
CN-MGMT pods fail to connect to the Panorama management server when using the Kubernetes plugin.
Committhe Panorama configuration after the CN-MGMT pod successfully registers with Panorama.
Fetching the device certificate from the Palo Alto Networks Customer Support Portal (CSP) may fail and displays the following error in the CLI:
ERROR Failed to process S1C msg: Error
Workaround:Retrying fetching the device certificate from the Palo Alto Networks CSP.
Current performance limitation: single data plane use only. The PA-5200 Series and PA-7000 Series firewalls that support 5G network slice security, 5G equipment ID security, and 5G subscriber ID security use a single data plane only, which currently limits the firewall performance.
The Panorama management server allows you to downgrade Zero Touch Provisioning (ZTP) firewalls to PAN-OS 9.1.2 and earlier releases where ZTP functionality is not supported.
There is an issue where the default Dynamic IP and Port (DIPP) NAT oversubscription rate is set to 2.
ElasticSearch is forced to restart when the
masterdprocess misses too many heartbeat messages on the Panorama management server resulting in a delay in a log query and ingestion.
ElasticSearch does not form a cluster when all of the following conditions are met for a Collector Group (
) resulting in loss of logs:
Workaround:Add the specified ciphers to the SSH Service profile and
Commit and Pushthe configuration change to the Collector Group. If you still experience log loss due to the ElasticSearch cluster not being formed, contact Palo Alto Networks Support to restart the ElasticSearch service.
On the Panorama management server, managed firewalls display as
disconnectedwhen installing a PAN-OS software update (
) but display as
connectedwhen you view your managed firewalls Summary (
) and from the CLI.
Workaround:Log out and log back in to the Panorama web interface.
PA-7000b Series firewalls only) Packets for new sessions drop when handling predict sessions.
Workaround:Use the following CLi commands to bypass this issue:
There is an issue in HTTP2 session decryption where the App-ID in the decryption log is the App-ID of the parent session (which is web-browsing).
ACC does not filter WildFire logs from Dynamic User Groups.
The Panorama management server does not check for duplicate addresses in address groups (
) and duplicate services in service groups (
) when created from the CLI.
PA-3200 Series, PA-5220, PA-5250, PA-5260, and PA-7000 Series firewalls) For traffic between virtual systems (inter-vsys traffic), the firewall cannot perform source NAT using dynamic IP (DIP) address translation.
Workaround:Use source NAT with Dynamic IP and Port (DIPP) translation on inter-vsys traffic.
If you use the CLI to enable the cleartext option for the Include Username in HTTP Header Insertion Entries feature, the authentication request to the firewall may become unresponsive or time out.
On the managed firewall web interface, the Secure Communication Settings (
) configuration does display a green cog widget to indicate that the configuration was pushed from the Panorama management server.
Dynamic tags from other sources are accessible using the CLI but do not display on the Panorama web interface.
PA-7000b Series only) The following error during secure boot has no impact and can be ignored:
[ 0.672461] Device 'efifb.0' does not have a release() function, it is broken and must be fixed.[ 2.026107] EFI: Problem loading in-kernel X.509 certificate (-65)Maintenance Mode filesystem size: 2.0G
There is an issue on M-500 Panorama management servers where any ethernet interface with an IPv6 address having Private PAN-DB-URL connectivity only supports the following format:
PAN-OS 10.0.0 does not support the XML API for GlobalProtect logs.
There is an issue where the firewall remains connected to the PAN-DB-URL server through the old management IP address on the M-500 Panorama management server, even when you configured the Eth1/1 interface.
Workaround:Update the PAN-DB-URL IP address on the firewall using one of the methods below.
Google Cloud Platform (GCP) only) The firewall does not accept the DNS value from the initial configuration (init-cfg) file when you bootstrap the firewall.
Workaround:Add DNS value as part of the bootstrap.xml in the bootstrap folder and complete the bootstrap process.
Microsoft Azure only) There is an intermittent issue where an Ethernet (eth1) interface does not come up when you first boot up the firewall.
Workaround:Reboot the firewall.
Alibaba Cloud runs on a KVM hypervisor and supports two Virtio modes: DPDK (default) and MMAP. If you deploy a VM-Series firewall running PAN-OS 9.0 in DPDK packet mode and you then switch to MMAP packet mode, the VM-Series firewall duplicates packets that originate from or terminate on the firewall. As an example, if a load balancer or a server behind the firewall pings the VM-Series firewall after you switch from DPDK packet mode to MMAP packet mode, the firewall duplicates the ping packets.
Throughput traffic is not duplicated if you deploy the VM-Series firewall using MMAP packet mode.
Firewalls with multiple virtual systems only) If you configure dynamic DNS (DDNS) on a new interface (associated with vsys1 or another virtual system) and you then create a
NewCertificate Profile from the drop-down, you must set the location for the Certificate Profile to Shared. If you configure DDNS on an existing interface and then create a new Certificate Profile, we also recommend that you choose the Shared location instead of a specific virtual system. Alternatively, you can select a preexisting certificate profile instead of creating a new one.
You can temporarily submit a change request for a URL Category with three suggested categories; however, only two categories are supported. Do not add more than two suggested categories to a change request until we address this issue. If you submit more than two suggested categories, only the first two categories in the change request are evaluated.
You cannot unregister tags for a subnet or range in a dynamic address group from the web interface.
Workaround:Use an XML API request to unregister the tags for the subnet or range.
Invalid configuration errors are not displayed as expected when you revert a Panorama management server configuration.
Workaround:After you revert the Panorama configuration,
) the reverted configuration to display the invalid configuration errors.
Commit to Panorama
The push scope selection on the Panorama web interface displays incorrectly even though the commit scope displays as expected. This issue occurs when one administrator makes configuration changes to separate device groups or templates that affect multiple firewalls and a different administrator attempts to push those changes.
Workaround:Perform one of the following tasks.
If you disable DPDK mode and enable it again, you must immediately reboot the firewall.
Tagged VLAN traffic fails when sent through an SR-IOV adapter.
DGA-based threats shown in the firewall threat log display the same name for all such instances.
The firewall does not generate a notification for the GlobalProtect client when the firewall denies an unencrypted TLS session due to an authentication policy match.
The system log does not correctly display the URL for CRL files; instead, the URLs are displayed with encoded characters.
If you configure a HIP object to match only when a connecting endpoint is managed (
), iOS and Android endpoints that are managed by AirWatch are unable to successfully match the HIP object and the HIP report incorrectly indicates that these endpoints are not managed. This issue occurs because GlobalProtect gateways cannot correctly identify the managed status of these endpoints.
Additionally, iOS endpoints that are managed by AirWatch are unable to match HIP objects based on the endpoint serial number because GlobalProtect gateways cannot identify the serial numbers of these endpoints; these serial numbers do not appear in the HIP report.
Adding a disk to a virtual appliance running Panorama 8.1 or a later release on VMware ESXi 6.5 update1 causes the Panorama virtual appliance and host web client to become unresponsive.
Workaround:Upgrade the ESXi host to ESXi 6.5 update2 and add the disk again.
Panorama plugins) The IP address-to-tag mapping information registered on a firewall or virtual system is not deleted when you remove the firewall or virtual system from a Device Group.
Workaround:Log in to the CLI on the firewall and enter the following command to unregister the IP address-to-tag mappings:
debug object registered-ip clear all.
After you configure and push address and address group objects in Shared and vsys-specific device groups from the Panorama management server to managed firewalls, executing the
show logcommand on a managed firewall only returns address and address group objects pushed form the Shared device group.
Workaround:Specify the vsys in the query string:
set system target-vsys
<direction>query equal ‘vsys eq
When booting or rebooting a PA-7000 Series Firewall with the SMC-B installed, the BIOS console output displays attempts to connect to the card's controller in the System Memory Speed section. The messages can be ignored.
GlobalProtect authentication fails with an
Invalid username/passworderror (because the user is not found in
Allow List) after you enable GlobalProtect authentication cookies and add a RADIUS group to the
Allow Listof the authentication profile used to authenticate to GlobalProtect.
Workaround:Disable GlobalProtect authentication cookies. Alternatively, disable (clear)
Retrieve user group from RADIUSin the authentication profile and configure group mapping from Active Directory (AD) through LDAP.
Panorama management server only) The Security Zone and Virtual System columns (
Noneafter a Device Group and Template administrator with read-only privileges performs a context switch.
A firewall that is not included in a Collector Group fails to generate a system log if logs are dropped when forwarded to a Panorama management server that is running in Management Only mode.
On VM-Series firewalls that have Data Plane Development Kit (DPDK) enabled and that use the i40e network interface card (NIC), the
show session infoCLI command displays an inaccurate throughput and packet rate.
Workaround:Disable DPDK by running the
set system setting dpdk-pkt-io offCLI command.
The name for an address object, address group, or an external dynamic list must be unique. Duplicate names for these objects can result in unexpected behavior when you reference the object in a policy rule.
For administrator accounts that you created in PAN-OS 8.0.8 and earlier releases, the firewall does not apply password profile settings (
) until after you upgrade to PAN-OS 8.0.9 or a later release and then only after you modify the account passwords. (Administrator accounts that you create in PAN-OS 8.0.9 or a later release do not require you to change the passwords to apply password profile settings.)
When DPDK is enabled on the VM-Series firewall with i40e virtual function (VF) driver, the VF does not detect the link status of the physical link. The VF link status remains up, regardless of changes to the physical link state.
HTTP Header Insertion does not work when jumbo frames are received out of order.
The firewall and Panorama web interfaces display vulnerability threat IDs that are not available in PAN-OS 9.0 releases (
). To confirm whether a particular threat ID is available in your release, monitor the release notes for each new Applications and Threats content update or check the Palo Alto Networks Threat Vault to see the minimum PAN-OS release version for a threat signature.
When you configure a VM-500 firewall with an SCTP Protection profile (
) and you try to add the profile to an existing Security Profile Group (
), the Security Profile Group doesn’t list the SCTP Protection profile in its drop-down list of available profiles.
Security Profile Groups
Workaround:Create a new Security Profile Group and select the SCTP Protection profile from there.
When you configure a firewall running PAN-OS 9.0 as an nCipher HSM client, the web interface on the firewall displays the nCipher server status as Not Authenticated, even though the HSM state is up (
The memory-optimized VM-50 Lite intermittently performs slowly and stops processing traffic when memory utilization is critically high. To prevent this issue, make sure that you do not:
Workaround:When the firewall performs slowly, or you see a critical System log for memory utilization, wait for 5 minutes and then manually reboot the firewall.
Use the Task Manager to verify that you are not performing memory intensive tasks such as installing dynamic updates, committing changes or generating reports, at the same time, on the firewall.
On a VM-Series firewall, the
clear session allCLI command does not clear GTP sessions.
In rare cases, a PA-5200 Series firewall (with an FE100 network processor) that has session offload enabled (default) incorrectly resets the UDP checksum of outgoing UDP packets.
Workaround:In PAN-OS 8.0.6 and later releases, you can persistently disable session offload for only UDP traffic using the
set session udp-off load noCLI command.
The VM-Series firewall on Google Compute Platform does not publish firewall metrics to Google Stack Monitoring when you manually configure a DNS server IP address (
Workaround:The VM-Series firewall on Google Cloud Platform must use the DNS server that Google provides.
SSL decryption based on ECDSA certificates does not work when you import the ECDSA private keys onto an nCipher nShield hardware security module (HSM).
Endpoints failed to authenticate to GlobalProtect through Kerberos when you specify an FQDN instead of an IP address in the Kerberos server profile (
Workaround:Replace the FQDN with the IP address in the Kerberos server profile.
PA-7000 Series, PA-5200 Series, and PA-3200 Series firewalls configured in tap mode don’t close offloaded sessions after processing the associated traffic; the sessions remain open until they time out.
Workaround:Configure the firewalls in virtual wire mode instead of tap mode, or disable session offloading by running the
set session off load noCLI command.
In WildFire appliance clusters that have three or more nodes, the Panorama management server does not support changing node roles. In a three-node cluster for example, you cannot use Panorama to configure the worker node as a controller node by adding the HA and cluster controller configurations, configure an existing controller node as a worker node by removing the HA configuration, and then commit and push the configuration. Attempts to change cluster node roles from Panorama results in a validation error—the commit fails and the cluster becomes unresponsive.
The firewall does not generate a packet capture (pcap) when a Data Filtering profile blocks files.
When you import a two-node WildFire appliance cluster into the Panorama management server, the controller nodes report their state as out-of-sync if either of the following conditions exist:
Workaround:There are three possible workarounds to sync the controller nodes:
If the PAN-OS web interface and the GlobalProtect portal are enabled on the same IP address, then when a user logs out of the GlobalProtect portal, the administrative user is also logged out from the PAN-OS web interface.
Workaround:Use the IP address to access the PAN-OS web interface and an FQDN to access the GlobalProtect portal.
When viewing an external dynamic list that requires client authentication and you
Test Source URL, the firewall fails to indicate whether it can reach the external dynamic list server and returns a URL access error (
External Dynamic Lists
When you use a firewall loopback interface as a GlobalProtect gateway interface, traffic is not routed correctly for third-party IPSec clients, such as strongSwan.
Workaround:Use a physical firewall interface instead of a loopback firewall interface as the GlobalProtect gateway interface for third-party IPSec clients. Alternatively, configure the loopback interface that is used as the GlobalProtect gateway to be in the same zone as the physical ingress interface for third-party IPSec traffic.
The VM-Series firewall on KVM, for all supported Linux distributions, does not support the Broadcom network adapters for PCI pass-through functionality.
Regardless of the
Time Frameyou specify for a scheduled custom report on a Panorama M-Series appliance, the earliest possible start date for the report data is effectively the date when you configured the report (
). For example, if you configure the report on the 15th of the month and set the
Manage Custom Reports
Last 30 Days, the report that Panorama generates on the 16th will include only data from the 15th onward. This issue applies only to scheduled reports; on-demand reports include all data within the specified
Workaround:To generate an on-demand report, click
Run Nowwhen you configure the custom report.
When you perform a factory reset on a Panorama virtual appliance and configure the serial number, logging does not work until you reboot Panorama or execute the
debug software restart process management-serverCLI command.
The following issues apply when configuring a firewall to use a hardware security module (HSM):
The new pattern-matching engine in PAN-OS 10.0 does not support the regular expression (regex) character
\C. If you try to use this character in a pattern that is only compatible with the new engine, you will see a warning when you try to save the signature.
Example of an invalid signature:
Explanation: Only the new engine allows you to create signatures with fewer than seven literal characters.
Example of a valid signature:
Explanation: This signature is compatible with the former pattern-matching engine, which matches
\Cto any literal character.