PAN-OS 9.1.9 Addressed Issues

PAN-OS® 9.1.9 addressed issues.
Issue ID
Description
PAN-165194
Fixed an issue where multiple messages were exchanged between secondary and primary Data Plane Development Kit (DPDK) processes, which caused a process (brdagent) to stop responding.
PAN-164564
Fixed an issue where stats API attempted to get stats from an unavailable port.
PAN-163538
Fixed an issue on multi-dataplane platforms where traffic through Large Scale VPN (LSVPN) tunnels dropped with the error message
tunnel resolution failure
.
PAN-163164
Fixed an issue where the GlobalProtect client used IPv6 during gateway login but used IPv4 during IPsec tunnel creation, which caused it to fallback to SSL.
PAN-162746
Fixed an issue where DNS over TCP caused a process (dnsproxy) to run out of memory.
PAN-161745
Fixed an issue where the time-to-live (TTL) value received from the DNS server reset to 0 on DNS secure TCP transactions when anti-spyware profiles were used, which caused DNS dynamic updates to fail.
PAN-160782
Fixed an issue where the routed process stopped responding when the BGP peer sent AS_PATHs with more than 255 AS numbers in all of the segments combined. There can now be a maximum of 255 AS numbers in an AS_PATH list for a prefix.
PAN-160744
Fixed an issue where the negative time difference between the dataplane and the management plane during the client certificate info check prevented the GlobalProtect client from connecting to the GlobalProtect gateway with the following error message:
Required client certificate not found
.
PAN-160434
Fixed an issue where firewalls stopped processing Layer-3-tagged traffic after Panorama pushed VLAN sub-interface configurations to the firewall with the
commit_all
operation.
PAN-159944
Fixed an issue where a process (dnsproxyd) stopped responding due to an error in the DNS cache operation.
PAN-159826
Fixed an issue where SSL VPN leaked when the default browser feature on GlobalProtect was not enabled.
PAN-159135
Fixed an issue where the firewall rejected SAML Assertions, which caused user authentication failure when the
Validate Identity Provider Certificate
was enabled in the SAML Server Profile in vsys3 or above.
PAN-158988
Fixed an issue with HTTP Header Insertion where the payload was truncated when processing a segmented TCP stream and when the client retransmitted the packet with the same sequence number that was previously received segmented.
PAN-158844
Adds additional debugging to be used in identifying the malformed references causing process crashes during FQDN refresh.
PAN-158774
Fixed an issue where random DNS queries dropped with the counter
ctd_dns_wait_pkt_drop
when DNS security was enabled.
PAN-158328
Fixed an issue where the firewall stopped populating the multicast FIB table with OIL entries for multicast groups.
PAN-158036
Fixed an issue on the firewall where custom application signatures based on PROPFIND http-method didn't trigger if
webdav
application ID was blocked by a Security policy.
To utilize this fix, you must install content version 8367-6513 or later.
PAN-157735
Fixed an issue where the new PA-7000100G network processing card (NPC) took 25 minutes to start after rebooting the PA-7080 chassis.
PAN-157721
Fixed an issue where the firewall dropped GPRS tunneling protocol (GTPv2) Create Session Requests and Responses that had IEs 201 and 202 with the error
Abnormal GTPv2-C message with invalid IE
.
PAN-157346
Fixed an issue where HIP custom checks for plist failed when the HIP exclusion category were configured under (
Mobile User Template > Network > GlobalProtect > Portal<portal-config> > Agent<agent-config> > HIP Data Collection
).
PAN-157271
Fixed an issue where
Panorama > Cloud Services
was visible to users with device group and template admin roles even if the admin role was disabled.
PAN-156896
(
VM-Series firewalls only
) Fixed an issue where the firewall frequently sopped responding with the following log:
CONFIG_UPDATE_INC : Incremental update to DP failed please try to commit force the latest config
.
PAN-156264
Fixed an issue where the firewall displayed
IP address
Netmask
and
default gateway
as
unknown
on the web interface as well as the CLI.
PAN-156225
(
PA-3200 Series firewalls only
) Fixed an issue where the HA1-B port remained down after an upgrade from PAN-OS 9.1.4 to PAN-OS 9.1.5.
PAN-155656
Fixed an issue where multicast RTP traffic triggered unicast RTP Control Protocol (RTCP), and the predict session failed to install, which blocked the parent RTP session from forwarding packets.
PAN-155147
(
VM-Series firewalls on Microsoft Azure that use accelerated networking interfaces with DPDK mode
) Fixed an issue where hot plug notifications caused traffic disruption.
PAN-154557
Fixed an issue that caused a process (useridd) core dump when parsing the Subject Alternative Name from a client certificate sent in the HIP report.
PAN-154195
Fixed an issue where the firewall dropped VoIP traffic over IPSec with counters
flow_predict_convert_rtp_drop
and
flow_predict_convert_failed
.
PAN-153316
CLI commands were added to address an issue where virtual memory on a process (configd) exceeded the new 32G limit.
  • To disable the virtual memory limit, use
    debug software disable-virt-limit
    .
  • To enable the virtual memory limit, use
    debug software enable-virt-limit
    .
PAN-153286
Fixed an issue on Panorama deployed on Amazon Web Services (AWS) where the Log Collector disk was on Admin disabled state when changing the instance type from m4 to m5.
PAN-153213
Fixed a rare issue where TCP packets randomly dropped due to reassembly failure.
PAN-152497
Fixed an issue where the firewall was unable to create a new GTP-U session when it received Create Session Response messages, which caused the following error message to display in the GTP log:
GTPv1 message failed stateful inspection
.
PAN-152458
(
VM-Series firewalls on Microsoft Hyper-V only
) Fixed an issue where, when upgrading to PAN-OS 9.0.8 or later, ethernet packets dropped after adding VLAN tags during egress from a subinterface. To leverage this fix, set the interface level maximum transmission unit (MTU) to 1496 or less.
PAN-152003
Fixed an issue where an email client was unable to open an attached file due to removal of part of the file name encoded in UTF-8 by the firewall CTD function for SMTP and NAT sessions.
PAN-151395
Fixed an issue where the firewall repeatedly logged connection failures to a configured Log Collector.
PAN-150298
Fixed an issue where Android clients matched HIP objects configured for Apple products.
PAN-150097
Fixed an issue where hourly URL summary log generation failed.
PAN-147792
Fixed an issue where a process (configd) stopped responding due to a buffer overflow.
PAN-147783
Checks were added to help prevent the dataplane from restarting.
PAN-144538
Fixed an issue where locally disabling the rule hit-count feature on Panorama caused a memory leak.
PAN-144470
Fixed an issue where driver descriptor rings were out of sync in the control plane to dataplane direction, which caused internal path monitoring heartbeat failures.
PAN-142621
Fixed an issue where the firewall was unable to log debug information in case of kernel panic.
PAN-142473
Fixed an issue where a commit failed with the following error message:
Disk quotas add up to more than 100%. Invalid configuration.
due to an integration issue.
PAN-136347
Fixed an issue wherer DNS proxy TCP connections were processed incorrectly, which caused a process (
dnsproxy
) to stop responding.
PAN-134799
Fixed an issue where packets of the same session were forwarded through a different member of an Aggregate Ethernet (AE) group once the session was offloaded.
PAN-120423
Support was added for XML API for GlobalProtect logs.
PAN-113795
Fixed an issue on a firewall configured with GlobalProtect Clientless VPN where a process (
all_pkts
) stopped responding, which caused the dataplane to restart.

Recommended For You