PAN-OS 8.1.10 Addressed Issues
PAN-OS® 8.1.10 addressed issues
Fixed an issue where the Captive Portal request limit was ignored when you configured the Captive Portal authentication method to
PA-7000 Series firewalls only) Fixed an issue where firewalls running a 20G Network Processing Card (NPC) or a 20GQ NPC dropped stream control transmission protocol (SCTP) connections due to incorrect session handling.
Fixed an issue where the firewall could not establish an IKEv2 connection with SHA256 certificates.
Fixed an issue on Panorama™ M-Series and virtual appliances where bootstrapped managed firewalls were disconnected after you performed a partial revert if you did not first perform a manual commit. With this fix, the manual commit is not required.
Fixed an issue where the
ifAdminStatusobject identifier (OID) for dedicated high availability (HA) interfaces incorrectly displayed as
upwhen interfaces were not used in an HA configuration.
Fixed an issue where ARP entries took longer than expected to age out in a single run.
PAN-OS 8.1.7, 8.1.8, and 8.1.9 only) Fixed an issue where log forwarding stopped responding when you configured a second log collector to the collector group.
PA-3000 Series firewalls only) Fixed an intermittent issue where a low memory condition prevented decoders from loading, which led to traffic inspection issues related to the impacted decoder(s).
Fixed an issue where you were unable to create GTP inner sessions, which caused the firewall to drop GTP-U data packets when the firewall was deployed on S1-U and S-11 interfaces.
Fixed an issue where the dataplane stopped responding when you pushed permitted IP addresses from Panorama to managed firewalls.
Fixed an issue where authentication failed when you configured a User Principal Name (UPN) and included a group in the profile.
PA-7000, PA-5200, and PA-3200 Series firewalls only) Fixed an issue where the firewall dropped ICMP error messages when the security policy was configured to allow ICMP
Fixed an issue where
test routing bgp virtual-router default restart peer <CLI command did not execute the operational request and returned the following error message:
op command for client routed timed out as client is not available.
Fixed an issue where Dynamic IP and Port (DIPP) NAT pools did not release used ports after all sessions were removed.
Fixed an issue on VM-Series firewalls on AWS where you could not change maximum transmission unit (MTU) values from the web interface and displayed the following error message:
Fixed an issue where the child session did not inherit policy-base forwarding information when the parent session is allocated to separate dataplanes.
Fixed an intermittent issue on Panorama M-Series and virtual appliances where a memory issue caused the firewall to reboot.
Fixed an intermittent issue where a large number of packets were received before acknowledgments were complete, which depleted descriptor queue entries and resulted in high latency during data transfers even though CPU usage looked normal.
Fixed an issue on Panorama M-Series and virtual appliances where renaming a device group followed by a partial commit did not change the device group hierarchy as expected.
Fixed an issue on Panorama M-Series and virtual appliances where Global Find caused the web interface to stop responding when you searched for common English words.
Fixed an issue where SaaS reports were not generated due to report definitions not getting pushed to the log collector.
Fixed an issue where a UDP packet without a payload did not trigger the multi-factor authentication (MFA) and was not discarded based on the authentication policy.
Fixed an issue where the firewall dropped syslog packets after you upgraded to PAN-OS® 8.1.6.
Fixed an issue on Panorama M-Series and virtual appliances where malformed API calls caused the appliance to reboot.
Fixed an issue where log purging took longer than expected, which prevented the firewall from capturing traffic logs.
Fixed an issue where traffic was blocked by safe search enforcement before matching the intended allow rule.
Fixed an issue where larger than expected number of packets sent over a GTP-U tunnel caused packet captures to fill the files faster than expected. With this fix, you can run the
debug dataplane packet-diag set capture gtpu-lvl[1-30]command to ensure GTP-U traffic are captured.
Fixed an issue where Panorama in FIPS mode defaulted to FIPS-CC mode instead of Normal mode.
Fixed an issue where sessions were offloaded as the application identification was performed when you configured a custom application with
Continue scanning for other application.
Fixed an issue where the firewall dropped traffic logs due to a negative log counter reading.
Fixed an issue where you were unable to download ZIP files greater than 3GB through a GlobalProtect Clientless VPN application.
Fixed an issue on a Panorama M-Series appliance where the Summary (
) web interface refreshes every 10 seconds when set to manually refresh.
Fixed an issue on a Panorama virtual appliance in Legacy mode and in an HA active/passive configuration where logs were forwarded only to the active HA peer.
Fixed an issue where you were unable to import variable CSV files when variable names contained a character space.
Fixed an issue on VM-Series firewalls where CPU loads were uneven across cores when more than 8 cores were allocated to the dataplane.
Fixed an issue where loading custom app tags did not complete successfully, which prevented subsequent requests (such as commits, content installs, and FQDN refreshes) from executing as expected.
Fixed an issue where Security policies were not evaluated in sequential order when the policy was based on URL categories.
Fixed an issue where GlobalProtect configured with the
pre-logon then on-demandconnect method was unable to authenticate during pre-logon when you configured the portal and gateway with an Authentication Override and without a certification profile.
Fixed an issue where the firewall silently dropped packets when Security profiles were attached and FPGA enabled AHO and DFA.
Fixed an issue where the Panorama management server returned a Security Copy (SCP) server connection error after you created an SCP Scheduled Config Export profile (
) due to the SCP server password exceeding 15 characters in length.
Scheduled Config Export
Fixed an issue where the web interface did not populate the Virtual System Name column (
) when you generated reports from the application statistics database.
Manage Custom Reports
Fixed an issue on Panorama M-Series and virtual appliances in an HA active/passive configuration where the passive HA peer displayed an out-of-sync shared policy status when you edited the Device Group.
Fixed an issue where the passive firewall in an HA active/passive configuration was processing traffic.
Fixed an issue where incorrect serial numbers were generated when you created VM-Series firewalls on AWS and swapped the interface with the
Fixed an issue where scheduled reports were not generated as expected when you added groups in a query builder.
Fixed an issue where the GlobalProtect Client was unable to download files from a web interface and sessions went into DISCARD state and displayed the following message:
Packet dropped, control plane service not allowed.
Fixed an issue on a firewall in an HA active/passive configuration where the passive firewall incorrectly received several alerts.
Fixed an issue where obsolete IPv6 Neighbor Discovery (ND) entries did not clear as expected, which caused the IPv6 table to reach full capacity and caused new IPv6 ND entries to fail.
Fixed an issue where hardware security module (HSM) accounts were locked out after three attempts when you ran the
show hsm ha-statusCLI command.
Fixed an issue where the connection between the firewall and Log Collector flapped.
Fixed an issue on VM-Series firewalls where the physical port counters on the dataplane interfaces did not increase on KVM when you disabled DPDK.
PA-3200, PA-5200, and PA-7000 Series firewalls with 100Gbps cards only) Fixed an issue where the
show qos interface ae1 throughput 0CLI command incorrectly displayed the active data stream only and QoS was not working as expected on the first subinterface.
Fixed an issue where a logical operation
receive_timein the traffic log filter did not respond as expected.
Fixed an issue on Panorama M-Series and virtual appliances where commits failed when you configured an address group object in the Include List (
Fixed an issue where the dataplane restarted due to a callback function, which caused a deadlock condition.
Fixed an issue where administrators with a Superuser (read-only) role was able to initiate a commit through the CLI.
Fixed an issue where BGP route attributes were processed from BGP updates, which caused the firewall to stop responding.
Fixed an issue where the firewall duplicated address objects when you imported a configuration to Panorama.
Fixed an issue on a firewall in an HA active/passive configuration where the passive firewall processed a high rate of packets.
Fixed an issue where you were unable to import variable CSV files when the external gateway was configured with a source region of
Fixed an issue where Wildfire® signature version information was no longer displayed after you activated a GlobalProtect client.
Fixed an issue where the firewall did not generate a system log when the firewall detected a RAM issue.
Fixed an issue when you connected to an internal GlobalProtect gateway on a firewall in an HA active/passive configuration and authenticated with multi-factor authentication (MFA) to access a resource where the first and second authentication factors succeeded but you would not be redirected to the actual resource.
Fixed an issue where the firewall did not record email header information in Data Filtering logs when you triggered a test mail that contained a data leak prevention (DLP) pattern.
Fixed an issue where scheduled SaaS reports generated and emailed empty PDF reports.
Fixed an issue where the firewall did not detect user credentials when the number of users exceeded 60,000. To leverage this fix, you must upgrade Windows agents to User-ID agent 8.1.11 or a later User-ID agent 8.1 release.
Fixed an issue where the syslog server TCP keep-alive parameter caused the connection to unexpectedly age out.
PA-800 Series firewalls only) Fixed an intermittent congestion condition caused by paused frames on firewalls where flow control was enabled on adjacent firewalls. To leverage this fix, run the
set system setting hol-system enableCLI command to enable head-of-line (HOL) system mode.
Fixed an issue where the export function (
) was not available for managed devices.
Fixed an issue where the
show wildfire local statisticsCLI command incorrectly returned samples pending analysis when there were no actual samples pending.
Recommended For You
Recommended videos not found.