PAN-OS 9.0.4 Addressed Issues
PAN-OS® 9.0.4 addressed issues.
Microsoft Azure only) Updates to support changes in Azure Accelerated Networking (AN).
Fixed a rare issue on WF-500 appliances where the firewall did not respond after you upgraded the appliance from a PAN-OS® 8.0.1 release to a PAN-OS 8.0.10 or later release. With this fix, you can run the new
debug software raid fixup autoCLI command to recover the RAID controller.
Fixed an issue where the timer system call activated more frequently than expected, which caused higher than expected CPU usage.
Fixed an issue where the Wildfire Analysis Report incorrectly displayed the following error message:
You are not authorized to access this page on the web interface.
Fixed an intermittent issue where after a configuration change, a commit caused the dataplane to stop responding.
Fixed an issue on Panorama™ M-Series and virtual appliances where the firewall stopped forwarding logs to Cortex Data Lake after you upgraded the cloud services plugin to 1.4.
Microsoft Azure only) Fixed an issue where VM-Series firewalls incorrectly renamed (to
eth) interfaces connected to Mellanox appliances when
Accelerated networkingwas enabled on the firewall.
PA-5200 Series firewalls only) Fixed an issue where the Quad Small Form-factor Pluggable (QSFP) 28 ports 21 and 22 did not respond when plugged in with a Finisar 100G AOC cable.
Fixed an issue where
) did not remove the configuration for any plugins you have set up on Panorama.
Fixed an intermittent issue where domains were not normalized, which caused an incorrect verdict response.
PA-7000 Series firewalls using PA-7000-20G-NPC cards only) Fixed an intermittent issue where an out-of-memory (OOM) condition caused the dataplane or internal path monitoring to stop responding.
Fixed an issue where the Captive Portal request limit was ignored when you configured the Captive Portal authentication method to browser-challenge.
PA-7000 Series firewalls only) Fixed an issue where firewalls running a 20G Network Processing Card (NPC) or a 20GQ NPC dropped stream control transmission protocol (SCTP) connections due to incorrect session handling.
Fixed an intermittent issue where the dataplane stopped responding when processing a UDP packet that passed through an IPSec tunnel.
Virtual and M-Series Panorama appliances and Log Collectors only) Fixed an issue where closed Elasticsearch (ES) indices were continuing to receive and re-queue logs, which resulted in high CPU usage.
Fixed an issue where the firewall could not establish an IKEv2 connection with SHA256 certificates.
Panorama only) Fixed an issue where a file lock was released before the lock was taken, which triggered an erroneous maximum connection timeout that prevented administrators from logging in to and executing commands from the command-line interface (CLI).
Fixed an issue on Panorama M-Series and virtual appliances where bootstrapped managed firewalls were disconnected after you performed a partial revert if you did not first perform a manual commit. With this fix, the manual commit is not required.
Fixed an issue on VM-Series firewalls where single root I/O virtualization (SR-IOV) did not support packet mmap in access mode and DPDK mode.
Fixed an intermittent issue where the firewall dropped a message:
Update PDP Context Responseand did not update the General Packet Radio Service (GPRS) Tunneling Protocol for User Data (GTP-U).
Fixed an issue on Panorama M-Series and virtual appliances where shared policies were out of sync due to an empty stream control transmission protocol (SCTP) after you upgraded the firewall from PAN-OS 8.0.16 to PAN-OS 8.1.8.
Fixed an intermittent issue with local high availability (HA) status changes where a process (
mprelay) failed to commit changes to the HA state.
Fixed an issue where ARP entries took longer than expected to age out in a single run.
Fixed an issue where an internal path monitoring failure due to a buffer leak caused the firewall to reboot.
Fixed an issue where the management server stopped responding when an incorrect filter was used to filter traffic logs instead of displaying an error message.
Fixed an issue where you were unable to create GTP inner sessions, which caused the firewall to drop GTP-U data packets when the firewall was deployed on S1-U and S-11 interfaces.
Fixed an issue where the dataplane stopped responding when you pushed permitted IP addresses from Panorama to managed firewalls.
GlobalProtect™ Clientless VPN environments only) Fixed an issue where a process (
all_pktproc) stopped responding and caused the firewall to restart unexpectedly when processing GlobalProtect Clientless VPN traffic. To leverage this fix, you must first upgrade (
) to GlobalProtect Clientless VPN content release 79 or a later release.
PA-7000, PA-5200, and PA-3200 Series firewalls only) Fixed an issue where the firewall dropped ICMP error messages when the security policy was configured to allow ICMP.
Fixed an issue on Panorama M-Series and virtual appliances where the progress bar for a commit all job incorrectly remained at 0% after a job was completed.
Fixed an issue where a process (
pan_comm) stopped responding due to a memory allocation error.
Fixed an issue where you were unable to deploy bootstrapped content in offline environments due to content validity checks.
Fixed an issue where the date in the GlobalProtect HTTP header was incorrectly set to a random date instead of a zero (
0), which negatively and falsely impacted security scorecard ratings.
Fixed an issue on a VM-Series firewall deployed in Microsoft Azure where packets dropped silently due to a kernel error.
Fixed an issue where VM-Series firewalls did not bootstrap successfully when you included the software version in the software folder of the bootstrap package.
Panorama virtual appliances only) Fixed an issue where a disk calculation error resulted in an erroneous opt/panlogs/ partion full condition and caused a process (
CDB) to stop responding.
Fixed an issue on Panaorama M-Series and virtual appliances where a process (
configd) stopped responding when you performed a commit to a large number of firewalls.
Fixed an issue with Panorama on Azure where the configuration of an HA pair became out of sync due to different plugin versions being detected even though the same versions were installed on both peers.
Fixed an issue where the firewall displayed a static route warning when the next hop IP address was not included in the subnet of the outgoing interface.
Fixed an issue on Panorama M-Series and virtual appliances where traffic logs did not display data when the IPv6 address filter is based on netmask.
Fixed an issue where the
test routing bgp virtual-router default restart peer Peer-v6CLI command did not execute the operational request and returned the following error message:
op command for client routed timed out as client is not available.
Fixed an issue where a process (
logrcvr) stopped responding when packet captures (pcap) were generated for HTTP2 traffic.
Fixed an issue where a process (
devsrvr) stopped responding when you performed a commit or a configuration validation when the proxy ID contained 24 or more characters.
Fixed an issue where Dynamic IP and Port (DIPP) NAT pools did not release used ports after all sessions were removed.
Fixed an issue on VM-Series firewalls on AWS where you could not change maximum transmission unit (MTU) values from the web interface and displayed the following error message:
Fixed an issue where, after you upgraded the firewall from PAN-OS 8.1.5 to PAN-OS 9.0.0, the firewall displayed the following validation error:
plugins 'read-only' is not an allowed keyword.
Fixed an issue where after a refresh of the external dynamic list values from the previous list were not retained, which caused the list values to display
0.0.0.0and displayed the following error message:
HTTP/1.1 500 Internal Server Error.
Fixed an intermittent issue on Panorama M-Series and virtual appliances where a memory issue caused the firewall to reboot.
Fixed an issue where data logs were generated but the firewall did not forward the logs to the syslog server.
Fixed an intermittent issue where a large number of packets were received before acknowledgments were complete, which depleted descriptor queue entries and resulted in high latency during data transfers even though CPU usage looked normal.
Fixed a rare issue where a race condition occurred between daemons during a tunnel re-key, which caused BGP sessions to drop from Large Scale VPN tunnels. To leverage this fix, you must run the
debug rasmgr delay-nh-updateCLI command.
Fixed an issue on Panorama M-Series and virtual appliances where renaming a device group followed by a partial commit did not change the device group hierarchy as expected.
Fixed an issue where commits failed and displayed the following error message:
Commit job was not queued. All daemons are not available.
Fixed an issue on Panorama M-Series and virtual appliances where Global Find caused the web interface to stop responding when you searched for common English words.
Fixed an issue where SaaS reports were not generated due to report definitions not getting pushed to the log collector.
Fixed an issue where the User-ID™ (
useridd) process consumed more CPU cycles than expected when you configured User-ID redistribution.
Fixed an issue where GlobalProtect gateway client configuration generation failed when a matching rule existed.
Fixed an issue on Panorama M-Series and virtual appliances where malformed API calls caused the firewall to reboot.
Fixed an issue where log purging took longer than expected, which prevented the firewall from capturing traffic logs.
Fixed an issue where the
Eventid eq globalprotectportal-config-succsystem query caused the management server (
mgmtsrvr) process to stop responding.
Fixed an issue where after a commit the firewall displayed the following error message:
No Valid DNS Security Licenseeven when the license was valid and successfully applied.
Fixed an issue where traffic was blocked by the safe search enforcement instead of the intended allow rule.
Fixed an issue where larger than expected number of packets sent over a GTP-U tunnel caused packet captures to fill the files faster than expected. With this fix, you can run the
debug dataplane packet-diag set capture gtpu-lvl [1-30]command to ensure GTP-U traffic are captured.
Fixed an issue where Panorama in FIPS mode defaulted to FIPS-CC mode instead of Normal mode.
Fixed an issue where an empty host name in the HTTP header caused a web server process (
websrvr) to stop responding when you accessed the captive portal redirect page.
Fixed an issue where sessions were offloaded as the application identification was performed when you configured a custom application with
Continue scanning for other application.
Fixed an issue where you were unable to download ZIP files greater than 3GB through a GlobalProtect Clientless VPN application.
Fixed an issue on a Panorama M-Series appliance where the Summary (
) web interface refreshes every 10 seconds when set to manually refresh.
Fixed an issue on a Panorama virtual appliance in Legacy mode and in an HA active/passive configuration where logs were forwarded only to the active firewall.
Fixed an issue where you were unable to import variable CSV files when variable names contained a character space.
PA-7000 Series firewalls only) Fixed an issue where the High Speed Chassis Interconnect (HSCI) link flapped after you rebooted the firewall.
Fixed an issue on VM-Series firewalls where CPU loads were uneven across cores when more than 8 cores were allocated to the dataplane.
Fixed an issue where a process (
ikemgr) stopped responding and caused the firewall to reboot.
Fixed an issue where loading custom app tags did not complete successfully, which prevented subsequent requests (such as commits, content installs, and FQDN refreshes) from executing as expected.
Fixed an issue where Security policies were not evaluated in sequential order when the policy was based on URL categories.
Fixed an issue where GlobalProtect configured with the
pre-logon then on-demandconnect method was unable to authenticate during
pre-logonwhen you configured the portal and gateway with an Authentication Override and without a certification profile.
Fixed an issue where the firewall silently dropped packets when security profiles were attached and FPGA enabled AHO and DFA.
Fixed an issue where the GlobalProtect gateway did not assign an IP address when the local IP address was a supernet of the GlobalProtect pool.
Fixed an issue where the Panorama management server returned a Security Copy (SCP) server connection error after you created an SCP Scheduled Config Export profile (
) due to the SCP server password exceeding 15 characters in length.
Scheduled Config Export
Fixed an issue on Panorama M-Series and virtual appliances in an HA active/passive configuration where the passive firewall displayed an out-of-sync shared policy status when you edited the Device Group.
Fixed an issue where the passive firewall in an HA active/passive configuration was processing traffic.
Fixed an issue where a process (
useridd) leaked memory, which caused the firewall to drop traffic and display the following error message:
Out-of-memory condition detected, kill process.
Fixed an issue where scheduled reports were not generated as expected when you added groups in a query builder.
Fixed an issue where the GlobalProtect Client was unable to download files from a web interface, sessions went into DISCARD state, and displayed the following message:
Packet dropped, control plane service not allowed.
Fixed an issue where the firewall incorrectly sent several benign critical content alerts daily.
Fixed an issue where obsolete IPv6 Neighbor Discovery (ND) entries did not clear as expected, which caused the IPv6 table to reach full capacity and caused new IPv6 ND entries to fail.
Fixed an issue where hardware security module (HSM) accounts were locked out after three attempts when you ran the
show hsm ha-statusCLI command.
Fixed an issue on VM-Series firewalls where the physical port counters on the dataplane interfaces did not increase on KVM when you disabled DPDK.
Fixed an issue where administrators were unable to log in when character spaces were used in usernames.
Fixed an issue where an incorrect SSH key initialization caused a process (
pan_comm) to stop responding every 15 minutes when you configured an SSH proxy on the firewall.
Fixed an issue where a logical operation
receive_timein the traffic log filter did not respond as expected.
Fixed an issue on Panorama M-Series and virtual appliances where commits failed when you configured an address group object in the Include List (
Fixed a rare issue where a dataplane restart or a commit triggered a large number of route updates, which caused a process (
routed) to stop responding as expected.
Fixed an issue where user groups were deleted from the Group Include List ("
) if you changed the LDAP server profile account password.
Group Mapping Settings
Group Include List
Fixed an issue where administrators with a Superuser (read-only) role was able to initiate a commit through the CLI.
Fixed an issue where the firewall and Panorama web interface did not present HSTS headers to your web browser.
Fixed an issue where credential phishing prevention did not detect user or password phishing when passwords, which contained two discontiguous character spaces were used.
Fixed an issue where the firewall did not generate a notification for the GlobalProtect client when the firewall denied unencrypted TLS sessions due to an authentication policy match.
Fixed an issue where the VPN tunnel operational status incorrectly displays
upeven though the VPN tunnel is down.
Fixed a rare issue where firewalls rebooted in to maintenance mode due to FIPS random number generator (RNG) errors.
Fixed an issue where the firewall did not generate a system log when the firewall detected a RAM issue.
Fixed an issue when you connected to an internal GlobalProtect gateway on a firewall in an HA active/passive configuration and authenticated with multi-factor authentication (MFA) to access a resource, the first and second authentication factors succeeded but you would not be redirected to the actual resource.
PA-3200 Series firewalls only) Fixed an issue on a firewall in an HA active/active configuration where SSL traffic through the GlobalProtect VPN (in SSL mode) tunnel stopped responding after Layer 7 processing completed and when asymmetric routing occurred.
Fixed an issue where the firewall did not record email header information in Data Filtering logs when you triggered a test mail that contained a data leak prevention (DLP) pattern.
Fixed an issue where the firewall incorrectly forwarded traffic when you configured the ingress interface with a QoS policy and the egress interface as a tunnel.
Fixed an issue where scheduled SaaS reports generated and emailed empty PDF reports.
Fixed an issue where the syslog server TCP keep-alive parameter caused the connection to unexpectedly age out.
Fixed an issue where the firewall did not detect user credentials when the number of users exceeded 60,000.
Fixed a memory buffer allocation issue that caused the Session Initiation Protocol (SIP) traffic NAT to stop responding.
PA-800 Series firewalls only) Fixed an intermittent issue where a congestion condition occurred during periods of low traffic. With this fix, run the
set system setting hol-system enableCLI command to enable the HOL system mode.
Fixed an issue where firewalls that were not configured to decrypt HTTPS services and applications traffic allowed users without valid authentication timestamps to access those resources regardless of Authentication Policy settings. To prevent such access, either configure the firewall to decrypt traffic or run the
debug device-server cp-deny-encrypted oncommand and perform a force commit (this command will persist across reboots).