PAN-OSĀ® Release Notes
  • PAN-OSĀ® Release Notes
  • All Documentation
>
Known Issues Related to PAN-OS 9.1 Releases
Focus
Download PDF
Focus
  1. Home
  2. PAN-OS
  3. PAN-OS 9.1 Release Information
  4. Known Issues
  5. Known Issues Related to PAN-OS 9.1 Releases
Download PDF

Known Issues Related to PAN-OS 9.1 Releases

Table of Contents
End-of-Life (EoL)

Known Issues Related to PAN-OS 9.1 Releases

List of known issues in all PAN-OSĀ® 9.1 releases.
The
Consolidated List of PAN-OS 9.1 Known Issues
includes all known issues that impact the PAN-OSĀ® 9.1 release. This list includes both outstanding issues and issues that are addressed in Panoramaā„¢, GlobalProtectā„¢, VM-Series, and WildFireĀ®, as well as known issues that apply more generally or that are not identified by a specific issue ID.
To review the subset of outstanding known issues for a specific PAN-OS 9.1 maintenance release, see the following lists:

Consolidated List of PAN-OS 9.1 Known Issues

Issue ID
Description
ā€”
Upgrading Panorama with a local Log Collector and Dedicated Log Collectors to PAN-OS 8.1 or a later PAN-OS release can take up to six hours to complete due to significant infrastructure changes. Ensure uninterrupted power to all appliances throughout the upgrade process.
ā€”
A critical System log is generated on the VM-Series firewall if the minimum memory requirement for the model is not available.
  • When the memory allocated is less than 4.5GB, you cannot upgrade the firewall. The following error message displays: Failed to install 9.0.0 with the following error: VM-50 in 9.0.0 requires 5.5GB memory, VM-50 Lite requires 4.5GB memory.Please configure this VM with enough memory before upgrading.
  • If the memory allocation is more than 4.5GB but less that the licensed capacity requirement for the model, it will default to the capacity associated with the VM-50.
    The System log message System capacity adjusted to VM-50 capacity due to insufficient memory for VM-<xxx> license, indicates that you must allocate the additional memory required for licensed capacity for the firewall model.
PLUG-380
When you rename a device group, template, or template stack in Panorama that is part of a VMware NSX service definition, the new name is not reflected in NSX Manager. Therefore, any ESXi hosts that you add to a vSphere cluster are not added to the correct device group, template, or template stack and your Security policy is not pushed to VM-Series firewalls that you deploy after you rename those objects. There is no impact to existing VM-Series firewalls.
PAN-223365
The Panorama management server is unable to query any logs if the ElasticSearch health status for any Log Collector (PanoramaManaged Collector is degraded.
Workaround: Log in to the Log Collector CLI and reboot.
adminrequest restart system
Alternatively, you can contact Palo Alto Networks Customer Support to restart the ElasticSearch process without rebooting the Log Collector.
PAN-206909
The Dedicated Log Collector is unable to reconnect to the Panorama management server if the configd process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection Status (PanoramaManaged Collector) displaying connected and the managed colletor Health status displaying as healthy.
This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted.
Workaround: Restart the mgmtsrvr process on the Dedicated Log Collector.
  1. Log in to the Dedicated Log Collector CLI.
  2. Confirm the Dedicated Log Collector is disconnected from Panorama.
    admin> show panorama-status
    Verify the Connected status is no.
  3. Restart the mgmtsrvr process.
    admin> debug software restart process management-server
PAN-197859
On firewalls running LSVPN with tunnel monitoring enabled, upgrades to 9.1.14 or later cause the LSVPN tunnels to flap.
PAN-197341
On the Panorama management server, if you create multiple device group Objects with the same name in the Shared device group and any additional device groups (PanoramaDevice Groups) under the same device group hierarchy that are used in one or more Policies, renaming the object with a shared name in any device group causes the object name to change in the policies where it is used. This issue applies only to device group objects that can be referenced in a Security policy rule.
For example:
  1. You create a parent device group DG-A and a child device group DG-B.
  2. You create address objects called AddressObjA in the Shared, DG-A and DG-B device groups and add AddressObjA to a Security policy rule under DG-A and DG-B.
  3. Later, you change the AddressObjA name in the Shared device group to AddressObjB.
Changing the name of the address object in the Shared device group causes the references in the Policy rule to use the renamed Shared object instead of the device group object.
PAN-188052
Devices in FIPS-CC mode are unable to connect to servers utilizing ECDSA-based host keys that impacts exporting logs (DeviceScheduled Log Export), exporting configurations (DeviceScheduled Config Export), or the scp export command in the CLI.
Workaround: Use RSA-based host keys on the destination server.
PAN-185966
The debug skip-cert-renewal-check-syslog yes command is not available on Log Collector CLI to stop the Dedicated Log Collector from trying to renew the device certificate and displaying the following error:
No valid device certificate found
PAN-178194
Firewalls licensed for Advanced URL Filtering generate a message indicating that a License required for URL filtering to function is unavailable displays at the bottom of the UI, due to a PAN-OS UI issue. This error does not affect the operation of Advanced URL Filtering or URL Filtering.
PAN-177363
Dedicated Log Collector system and config logs cannot be ingested and are dropped when they are forwarded to a Panorama management server in Management Only mode, resulting in Dedicated Log Collector system and config logs not being viewable on Panorama in Management Only mode.
PAN-174004
On the Panorama management server, local or Dedicated Log Collector mode cannot successfully join an ElasticSearch cluster when added to a Collector Group (PanoramaCollector Groups) if the SSH key length for a Log Collector in the cluster is greater than 2048 characters.
PAN-173509
Superuser administrators with read-only privileges (DeviceAdministrators and PanoramaAdministrators) are unable to view the hardware ACL blocking setting and duration in the CLI using the commands:
admin> show system setting hardware-acl-blocking-enable
admin> show system setting hardware-acl-blocking-duration
PAN-171938
No results are displayed when you Show Application Filter for a Security policy rule (PoliciesSecurityApplicationValueShow Application Filter).
PAN-168113
On the Panorama management server, you are unable to configure a master key (DeviceMaster Key and Diagnostics) for a managed firewall if an interface (NetworkInterfacesEthernet) references a zone pushed from Panorama.
Workaround: Remove the referenced zone from the interface configuration to successfully configure a master key.
PAN-164885
On the Panorama management server, pushes to managed firewalls (CommitPush to Devices or Commit and Push) may fail when an EDL (ObjectsExternal Dynamic Lists) is configured to Check for updates every 5 minutes due to the commit and EDL fetch processes overlapping. This is more likely to occur when multiple EDLs are configured to check for updates every 5 minutes.
PAN-163676
Next-Gen Firewalls are unable to connect to a syslog server when the certificates required to connect to the syslog server are part of a Certificate Profile (DeviceCertificate ManagementCertificate Profile) if the Use OCSP setting is enabled to check the revocation status of certificates.
Workaround: Enable Use CRL to check the revocation status of certificates in the Certificate Profile.
PAN-162748
This issue is now resolved. See PAN-OS 9.1.9 Addressed Issues. GlobalProtect clients in systems with umlaut diacritics in the serial number are unable to log in to the GlobalProtect gateway.
PAN-162088
On the Panorama management server in a high availability (HA) configuration, content updates (PanoramaDynamic Updates) manually uploaded to the active HA peer are not synchronized to the passive HA peer when you Install a content update and enable Sync to HA Peer.
PAN-161955
Firewalls erroneously generate a high severity system log (MonitorLogsSystem) when the firewall connects to a syslog server.
PAN-160410
In the ACC, data cannot be imported or exported when a User filter (ACCNetwork ActivitySet Tab FiltersUser) that contains characters not supported by URL format, such as DOMAIN/USER, is applies to the Network Activity widget.
PAN-157240
When a firewall has hardware offloading turned on and OSPF enabled, if ECMP is enabled or disabled for a virtual router during a configuration commit, OSPF sessions may get stuck in Exchange Start state.
Workaround: Disable OSPF when enabling or disabling ECMP, and then re-enable OSPF in the next commit.
PAN-154266
When an application matches an SD-WAN policy and some sessions for the same application do not match an SD-WAN policy, the SD-WAN Monitoringā€”Traffic Characteristics screen displays the Links Used information with an SD-WAN policy and a null policy. Sessions that do not have an SD-WAN policy ID are filtered from Links Used.
Workaround: If you want to see session logs that include a default selection, create a catch-all SD-WAN policy rule and place it last in the list of SD-WAN policies.
PAN-154247
On the Panorama management server, context switching to and from the managed firewall web interface may cause the Panorama administrator to be logged out.
Workaround: Log out and back in to the Panorama web interface.
PAN- 155147
(VM-Series Firewalls on Azure only) For VM-Series firewall on Azure that use accelerated networking interfaces, hot plug notifications cause some traffic disruption. These hotplug notification events are generated on Azure, typically when the host is undergoing any maintenance or migrations on their end, and these events are not initiated or controlled by the VM-Series firewall.
PAN-153803
On the Panorama management server, scheduled email PDF reports (MonitorPDF Reports) fail if a GIF image is used in the header or footer.
PAN-152458
On the VM-Series firewall on Microsoft Hyper-V, when upgrading to PAN-OS 9.1.0 or later, ethernet packets might be dropped after adding VLAN tags during egress from a subinterface.
Workaround: Create the Hyper-V Virtual Switch with MTU size 1504, store as persistent and reboot for the changes to take effect. Before upgrading PAN-OS, access the VM-Series firewall CLI and set the MTU size on firewall interfaces to 1504.
PAN-151909
On the Panorama management server, Preview Changes (CommitCommit to Panorama) incorrectly displays an existing route as Added and the new route as an existing route in the Candidate Configuration when you configure a new virtual router route (NetworkVirtual Router)
PAN-151198
On the Panorama management server, read-only Panorama administrators (PanoramaAdministrators) can load managed firewall configuration Backups (PanoramaManaged DevicesSummary).
PAN-150172
This issue is now resolved. See PAN-OS 9.1.3-h1 Addressed Issues.
Dataplane processes restart when attempting to access websites that have the NotBefore attribute less than or equal to Unix Epoch Time in the server certificate with forward proxy enabled.
PAN-149913
On the firewall CLI, the show system info command displays the management IP address of the firewall as the Ethernet1/1 interface IP address.
On the Panorama management server, the IPv4 address (PanoramaManaged DevicesSummary) displays the Ethernet1/1 interface IP address.
PAN-148359
This issue is now resolved. See PAN-OS 9.1.8 Addressed Issues.
SD-WAN server-to-client symmetric return does not function correctly under certain circumstances, and the issue can also affect path selection of parent/child applications, such as FTP.
PAN-140959
(PAN-OS 9.1.3 and later 9.1 releases only) The Panorama management server allows you to downgrade Zero Touch Provisioning (ZTP) firewalls to PAN-OS 9.1.2 and earlier releases where ZTP functionality is not supported.
PAN-140084
This issue is now resolved. See PAN-OS 9.1.5 Addressed Issues.
There is an issue where the default Dynamic IP and Port (DIPP) NAT oversubscription rate is set to 2.
PAN-140008
ElasticSearch is forced to restart when the masterd process misses too many heartbeat messages on the Panorama management server resulting in a delay in a log query and ingestion.
PAN-136701
(PA-7000b Series firewalls only) Packets for new sessions drop when handling predict sessions.
Workaround: (PAN-OS 9.1.3 and later versions only)Use the following CLi commands to bypass this issue:
  • set session hwpredict disable yes
  • show session hwpredict status
PAN-135260
This issue is now resolved. See PAN-OS 9.1.2 Addressed Issues.
(PA-7000 Series firewalls only) There is an intermittent issue where the dataplane process (all_pktproc_X) on a Network Processing Card (NPC) restarts unexpectedly when processing IPSec tunnel traffic. This issue can occur on any NPC card in any slot.
PAN-134456
SNMP traps configured to use the dataplane port in service routes are still sent using the management interface.
Workaround: Use a destination-based service route for the SNMP trap server.
PAN-134096
Uploads for custom logos fail.
PAN-134053
ACC does not filter WildFire logs from Dynamic User Groups.
PAN-133782
This issue is now resolved. See PAN-OS 9.1.11 Addressed Issues.
The Panorama management server in Management Only mode may become inaccessible or unresponsive due to insufficient disk space in the /opt/mongobuffer partition required for Panorama logs.
Workaround: Contact Palo Alto Networks Support to repartition the /opt/mongobuffer disk partition table.
PAN-132598
The Panorama management server does not check for duplicate addresses in address groups (ObjectsAddress Groups) and duplicate services in service groups (ObjectsService Groups) when created from the CLI.
PAN-130550
(PA-3200 Series, PA-5220, PA-5250, PA-5260, and PA-7000 Series firewalls) For traffic between virtual systems (inter-vsys traffic), the firewall cannot perform source NAT using dynamic IP (DIP) address translation.
Workaround: Use source NAT with Dynamic IP and Port (DIPP) translation on inter-vsys traffic.
PAN-128271
(VM-Series on ESXi only) The VM-Series firewall on ESXi displays the message [58.601127] Bits 55-60 of /proc/PID/pagemap entries are about to stop being page-shift some time soon.This error is benign. For details, see Linux documentation.
PAN-128269
This issue is now resolved. See PAN-OS 9.1.1 Addressed Issues.
(PA-5250, PA-5260, and PA-5280 firewalls with 100GB AOC cables only) When you upgrade the first peer in a high availability (HA) configuration to PAN-OS 9.0.3 or a later PAN-OS 9.0 release, the High Speed Chassis Interconnect (HSCI) port does not come up due to an FEC mismatch until after you finish upgrading the second peer.
PAN-127474
When you configure a Server Profile, the custom log format for GlobalProtect logs is missing.
PAN-127206
If you use the CLI to enable the cleartext option for the Include Username in HTTP Header Insertion Entries feature, the authentication request to the firewall may become unresponsive or time out.
PAN-124956
This issue is now resolved. See PAN-OS 9.1.11 Addressed Issues.
There is an issue where VM-Series firewalls do not support packet buffer protection.
PAN-123277
Dynamic tags from other sources are accessible using the CLI but do not display on the Panorama web interface.
PAN-121484
This issue is now resolved. See PAN-OS 9.1.6 Addressed Issues.
The dataplane sends positive acknowledgments to predict-status checks from FPP when the corresponding predict is deleted, which causes SIP and RTSP applications to perform less than the expected achievable performance.
PAN-120440
There is an issue on M-500 Panorama management servers where any ethernet interface with an IPv6 address having Private PAN-DB-URL connectivity only supports the following format: 2001:DB9:85A3:0:0:8A2E:370:2.
PAN-120423
PAN-OS 9.1.0 does not support the XML API for GlobalProtect logs.
PAN-120303
There is an issue where the firewall remains connected to the PAN-DB-URL server through the old management IP address on the M-500 Panorama management server, even when you configured the Eth1/1 interface.
Workaround: Update the PAN-DB-URL IP address on the firewall using one of the methods below.
  • Modify the PAN-DB Server IP address on the managed firewall.
    1. On the web interface, delete the PAN-DB Server IP address (DeviceSetupContent IDURL Filtering settings).
    2. Commit your changes.
    3. Add the new M-500 Eth1/1 IP PAN-DB IP address.
    4. Commit your changes.
  • Restart the firewall (devsrvr) process.
    1. Log in to the firewall CLI.
    2. Restart the devsrvr process: debug software restart process device-server
PAN-118065
(M-Series Panorama management servers in Management Only mode) When you delete the local Log Collector (PanoramaManaged Collectors), it disables the 1/1 ethernet interface in the Panorama configuration as expected but the interface still displays as Up when you execute the show interface all command in the CLI after you commit.
Workaround: Disable the 1/1 ethernet interface before you delete the local log collector and then commit the configuration change.
PAN-116017
(Google Cloud Platform (GCP) only) The firewall does not accept the DNS value from the initial configuration (init-cfg) file when you bootstrap the firewall.
Workaround: Add DNS value as part of the bootstrap.xml in the bootstrap folder and complete the bootstrap process.
PAN-115816
(Microsoft Azure only) There is an intermittent issue where an Ethernet (eth1) interface does not come up when you first boot up the firewall.
Workaround: Reboot the firewall.
PAN-114495
Alibaba Cloud runs on a KVM hypervisor and supports two Virtio modes: DPDK (default) and MMAP. If you deploy a VM-Series firewall running PAN-OS 9.0 in DPDK packet mode and you then switch to MMAP packet mode, the VM-Series firewall duplicates packets that originate from or terminate on the firewall. As an example, if a load balancer or a server behind the firewall pings the VM-Series firewall after you switch from DPDK packet mode to MMAP packet mode, the firewall duplicates the ping packets.
Throughput traffic is not duplicated if you deploy the VM-Series firewall using MMAP packet mode.
PAN-112694
(Firewalls with multiple virtual systems only) If you configure dynamic DNS (DDNS) on a new interface (associated with vsys1 or another virtual system) and you then create a New Certificate Profile from the drop-down, you must set the location for the Certificate Profile to Shared. If you configure DDNS on an existing interface and then create a new Certificate Profile, we also recommend that you choose the Shared location instead of a specific virtual system. Alternatively, you can select a preexisting certificate profile instead of creating a new one.
PAN-112456
You can temporarily submit a change request for a URL Category with more than two suggested categories. However, we support only two suggested categories so add no more than two suggested categories to a change request until we address this issue. If you submit more than two suggested categories, we will use only the first two categories you enter.
PAN-111928
Invalid configuration errors are not displayed as expected when you revert a Panorama management server configuration.
Workaround: After you revert the Panorama configuration, Commit (CommitCommit to Panorama) the reverted configuration to display the invalid configuration errors.
PAN-111866
The push scope selection on the Panorama web interface displays incorrectly even though the commit scope displays as expected. This issue occurs when one administrator makes configuration changes to separate device groups or templates that affect multiple firewalls and a different administrator attempts to push those changes.
Workaround: Perform one of the following tasks.
  • Initiate a Commit to Panorama operation followed by a Push to Devices operation for the modified device group and template configurations.
  • Manually select the devices that belong to the modified device group and template configurations.
PAN-111729
If you disable DPDK mode and enable it again, you must immediately reboot the firewall.
PAN-111670
Tagged VLAN traffic fails when sent through an SR-IOV adapter.
PAN-111251
Using the CLI to enable or disable DNS Rewrite under a Destination NAT policy rule has no effect.
PAN-110794
DGA-based threats shown in the firewall threat log display the same name for all such instances.
PAN-109759
The firewall does not generate a notification for the GlobalProtect client when the firewall denies an unencrypted TLS session due to an authentication policy match.
PAN-109526
The system log does not correctly display the URL for CRL files; instead, the URLs are displayed with encoded characters.
PAN-104780
If you configure a HIP object to match only when a connecting endpoint is managed (ObjectsGlobalProtectHIP Objects<hip-object>GeneralManaged), iOS and Android endpoints that are managed by AirWatch are unable to successfully match the HIP object and the HIP report incorrectly indicates that these endpoints are not managed. This issue occurs because GlobalProtect gateways cannot correctly identify the managed status of these endpoints.
Additionally, iOS endpoints that are managed by AirWatch are unable to match HIP objects based on the endpoint serial number because GlobalProtect gateways cannot identify the serial numbers of these endpoints; these serial numbers do not appear in the HIP report.
PAN-103276
Adding a disk to a virtual appliance running Panorama 8.1 or a later release on VMware ESXi 6.5 update1 causes the Panorama virtual appliance and host web client to become unresponsive.
Workaround: Upgrade the ESXi host to ESXi 6.5 update2 and add the disk again.
PAN-103018
This issue is now resolved. See PAN-OS 9.1.5 Addressed Issues
(Panorama plugins) When you use the AND/OR boolean operators to define the match criteria for Dynamic Address Groups on Panorama, the boolean operators do not function properly. The member IP addresses are not included in the address group as expected.
PAN-101688
(Panorama plugins) The IP address-to-tag mapping information registered on a firewall or virtual system is not deleted when you remove the firewall or virtual system from a Device Group.
Workaround: Log in to the CLI on the firewall and enter the following command to unregister the IP address-to-tag mappings: debug object registered-ip clear all.
PAN-101537
After you configure and push address and address group objects in Shared and vsys-specific device groups from the Panorama management server to managed firewalls, executing the show log <log-type> direction equal <direction> <dst> | <src> in <object-name> command on a managed firewall only returns address and address group objects pushed form the Shared device group.
Workaround: Specify the vsys in the query string:
admin> set system target-vsys <vsys-name>
admin> show log <log-type> direction equal <direction> query equal ā€˜vsys eq <vsys-name>ā€™ <dst> | <src> in <object-name>
PAN-98520
When booting or rebooting a PA-7000 Series Firewall with the SMC-B installed, the BIOS console output displays attempts to connect to the card's controller in the System Memory Speed section. The messages can be ignored.
PAN-97757
GlobalProtect authentication fails with an Invalid username/password error (because the user is not found in Allow List) after you enable GlobalProtect authentication cookies and add a RADIUS group to the Allow List of the authentication profile used to authenticate to GlobalProtect.
Workaround: Disable GlobalProtect authentication cookies. Alternatively, disable (clear) Retrieve user group from RADIUS in the authentication profile and configure group mapping from Active Directory (AD) through LDAP.
PAN-97524
(Panorama management server only) The Security Zone and Virtual System columns (Network tab) display None after a Device Group and Template administrator with read-only privileges performs a context switch.
PAN-96985
The request shutdown system command does not shut down the Panorama management server.
PAN-96960
You cannot restart or shutdown a Panorama on KVM from the Virtual-manager console or virsch CLI.
PAN-96446
A firewall that is not included in a Collector Group fails to generate a system log if logs are dropped when forwarded to a Panorama management server that is running in Management Only mode.
PAN-95773
On VM-Series firewalls that have Data Plane Development Kit (DPDK) enabled and that use the i40e network interface card (NIC), the show session info CLI command displays an inaccurate throughput and packet rate.
Workaround: Disable DPDK by running the set system setting dpdk-pkt-io off CLI command.
PAN-95511
The name for an address object, address group, or an external dynamic list must be unique. Duplicate names for these objects can result in unexpected behavior when you reference the object in a policy rule.
PAN-95028
For administrator accounts that you created in PAN-OS 8.0.8 and earlier releases, the firewall does not apply password profile settings (DevicePassword Profiles) until after you upgrade to PAN-OS 8.0.9 or a later release and then only after you modify the account passwords. (Administrator accounts that you create in PAN-OS 8.0.9 or a later release do not require you to change the passwords to apply password profile settings.)
PAN-94846
When DPDK is enabled on the VM-Series firewall with i40e virtual function (VF) driver, the VF does not detect the link status of the physical link. The VF link status remains up, regardless of changes to the physical link state.
PAN-94093
HTTP Header Insertion does not work when jumbo frames are received out of order.
PAN-93968
The firewall and Panorama web interfaces display vulnerability threat IDs that are not available in PAN-OS 9.0 releases (ObjectsSecurity ProfilesVulnerability Protection<profile>Exceptions). To confirm whether a particular threat ID is available in your release, monitor the release notes for each new Applications and Threats content update or check the Palo Alto Networks Threat Vault to see the minimum PAN-OS release version for a threat signature.
PAN-93607
When you configure a VM-500 firewall with an SCTP Protection profile (ObjectsSecurity ProfilesSCTP Protection) and you try to add the profile to an existing Security Profile Group (ObjectsSecurity Profile Groups), the Security Profile Group doesnā€™t list the SCTP Protection profile in its drop-down list of available profiles.
Workaround: Create a new Security Profile Group and select the SCTP Protection profile from there.
PAN-93532
When you configure a firewall running PAN-OS 9.0 as an nCipher HSM client, the web interface on the firewall displays the nCipher server status as Not Authenticated, even though the HSM state is up (DeviceSetupHSM).
PAN-93193
The memory-optimized VM-50 Lite intermittently performs slowly and stops processing traffic when memory utilization is critically high. To prevent this issue, make sure that you do not:
  • Switch to the firewall Context on the Panorama management server.
  • Commit changes when a dynamic update is being installed.
  • Generate a custom report when a dynamic update is being installed.
  • Generate custom reports during a commit.
Workaround: When the firewall performs slowly, or you see a critical System log for memory utilization, wait for 5 minutes and then manually reboot the firewall.
Use the Task Manager to verify that you are not performing memory intensive tasks such as installing dynamic updates, committing changes or generating reports, at the same time, on the firewall.
PAN-91802
On a VM-Series firewall, the clear session all CLI command does not clear GTP sessions.
PAN-83610
In rare cases, a PA-5200 Series firewall (with an FE100 network processor) that has session offload enabled (default) incorrectly resets the UDP checksum of outgoing UDP packets.
Workaround: In PAN-OS 8.0.6 and later releases, you can persistently disable session offload for only UDP traffic using the set session udp-off load no CLI command.
PAN-83236
The VM-Series firewall on Google Compute Platform does not publish firewall metrics to Google Stack Monitoring when you manually configure a DNS server IP address (DeviceSetupServices).
Workaround: The VM-Series firewall on Google Cloud Platform must use the DNS server that Google provides.
PAN-83215
SSL decryption based on ECDSA certificates does not work when you import the ECDSA private keys onto an nCipher nShield hardware security module (HSM).
PAN-81521
Endpoints failed to authenticate to GlobalProtect through Kerberos when you specify an FQDN instead of an IP address in the Kerberos server profile (DeviceServer ProfilesKerberos).
Workaround: Replace the FQDN with the IP address in the Kerberos server profile.
PAN-77125
PA-7000 Series, PA-5200 Series, and PA-3200 Series firewalls configured in tap mode donā€™t close offloaded sessions after processing the associated traffic; the sessions remain open until they time out.
Workaround: Configure the firewalls in virtual wire mode instead of tap mode, or disable session offloading by running the set session off load no CLI command.
PAN-75457
(PAN-OS 8.0.1 and later releases) In WildFire appliance clusters that have three or more nodes, the Panorama management server does not support changing node roles. In a three-node cluster for example, you cannot use Panorama to configure the worker node as a controller node by adding the HA and cluster controller configurations, configure an existing controller node as a worker node by removing the HA configuration, and then commit and push the configuration. Attempts to change cluster node roles from Panorama results in a validation errorā€”the commit fails and the cluster becomes unresponsive.
PAN-73530
The firewall does not generate a packet capture (pcap) when a Data Filtering profile blocks files.
PAN-73401
(PAN-OS 8.0.1 and later releases) When you import a two-node WildFire appliance cluster into the Panorama management server, the controller nodes report their state as out-of-sync if either of the following conditions exist:
  • You did not configure a worker list to add at least one worker node to the cluster. (In a two-node cluster, both nodes are controller nodes configured as an HA pair. Adding a worker node would make the cluster a three-node cluster.)
  • You did not configure a service advertisement (either by enabling or not enabling advertising DNS service on the controller nodes).
Workaround: There are three possible workarounds to sync the controller nodes:
  • After you import the two-node cluster into Panorama, push the configuration from Panorama to the cluster. After the push succeeds, Panorama reports that the controller nodes are in sync.
  • Configure a worker list on the cluster controller:
    admin@wf500(active-controller)# set
deviceconfig cluster mode controller worker-list <worker-ip-address>
    (<worker-ip-address> is the IP address of the worker node you are adding to the cluster.) This creates a three-node cluster. After you import the cluster into Panorama, Panorama reports that the controller nodes are in sync. When you want the cluster to have only two nodes, use a different workaround.
  • Configure service advertisement on the local CLI of the cluster controller and then import the configuration into Panorama. The service advertisement can advertise that DNS is or is not enabled.
    admin@wf500(active-controller)# set
deviceconfig cluster mode controller service-advertisement dns-service
enabled
yes
    or
    admin@wf500(active-controller)# set
deviceconfig cluster mode controller service-advertisement dns-service
enabled
no
    Both commands result in Panorama reporting that the controller nodes are in sync.
PAN-71329
Local users and user groups in the Shared location (all virtual systems) are not available to be part of the user-to-application mapping for GlobalProtect Clientless VPN applications (NetworkGlobalProtectPortals<portal>Clientless VPNApplications).
Workaround: Create users and user groups in specific virtual systems on firewalls that have multiple virtual systems. For single virtual systems (like VM-Series firewalls), users and user groups are created under Shared and are not configurable for Clientless VPN applications.
PAN-70906
If the PAN-OS web interface and the GlobalProtect portal are enabled on the same IP address, then when a user logs out of the GlobalProtect portal, the administrative user is also logged out from the PAN-OS web interface.
Workaround: Use the IP address to access the PAN-OS web interface and an FQDN to access the GlobalProtect portal.
PAN-69505
When viewing an external dynamic list that requires client authentication and you Test Source URL, the firewall fails to indicate whether it can reach the external dynamic list server and returns a URL access error (ObjectsExternal Dynamic Lists).
PAN-41558
When you use a firewall loopback interface as a GlobalProtect gateway interface, traffic is not routed correctly for third-party IPSec clients, such as strongSwan.
Workaround: Use a physical firewall interface instead of a loopback firewall interface as the GlobalProtect gateway interface for third-party IPSec clients. Alternatively, configure the loopback interface that is used as the GlobalProtect gateway to be in the same zone as the physical ingress interface for third-party IPSec traffic.
PAN-40079
The VM-Series firewall on KVM, for all supported Linux distributions, does not support the Broadcom network adapters for PCI pass-through functionality.
PAN-39636
Regardless of the Time Frame you specify for a scheduled custom report on a Panorama M-Series appliance, the earliest possible start date for the report data is effectively the date when you configured the report (MonitorManage Custom Reports). For example, if you configure the report on the 15th of the month and set the Time Frame to Last 30 Days, the report that Panorama generates on the 16th will include only data from the 15th onward. This issue applies only to scheduled reports; on-demand reports include all data within the specified Time Frame.
Workaround: To generate an on-demand report, click Run Now when you configure the custom report.
PAN-38255
When you perform a factory reset on a Panorama virtual appliance and configure the serial number, logging does not work until you reboot Panorama or execute the debug software restart process management-server CLI command.
PAN-31832
The following issues apply when configuring a firewall to use a hardware security module (HSM):
  • nCipher nShield Connectā€”The firewall requires at least four minutes to detect that an HSM was disconnected, causing SSL functionality to be unavailable during the delay.
  • SafeNet Networkā€”When losing connectivity to either or both HSMs in an HA configuration, the display of information from the show high-availability state and show hsm info commands are blocked for 20 seconds.

Technical Documentation

Company

Legal Notices

Ā© 2025 Palo Alto Networks, Inc. All rights reserved.