PAN-OS 9.1.16 Known Issues
Review the known issues specific to the PAN-OS 9.1.16 release.
The following list includes all known issues that impact the PAN-OS® 9.1.16 release. This list includes both outstanding issues and issues that are addressed in Panorama™, GlobalProtect™, VM-Series, and WildFire®, as well as known issues that apply more generally or that are not identified by a specific issue ID.
For a complete list of existing and addressed known issues in all PAN-OS 9.1 releases, see the Known Issues Related to PAN-OS 9.1 Releases.
Upgrading Panorama with a local Log Collector and Dedicated Log Collectors to PAN-OS 8.1 or a later PAN-OS release can take up to six hours to complete due to significant infrastructure changes. Ensure uninterrupted power to all appliances throughout the upgrade process.
A critical System log is generated on the VM-Series firewall if the minimum memory requirement for the model is not available.
When you rename a device group, template, or template stack in Panorama that is part of a VMware NSX service definition, the new name is not reflected in NSX Manager. Therefore, any ESXi hosts that you add to a vSphere cluster are not added to the correct device group, template, or template stack and your Security policy is not pushed to VM-Series firewalls that you deploy after you rename those objects. There is no impact to existing VM-Series firewalls.
On firewalls running LSVPN with tunnel monitoring enabled, upgrades to 9.1.14 or later cause the LSVPN tunnels to flap.
On the Panorama management server, if you create multiple device group
Objectswith the same name in the Shared device group and any additional device groups (
) under the same device group hierarchy that are used in one or more
Policies, renaming the object with a shared name in any device group causes the object name to change in the policies where it is used. This issue applies only to device group objects that can be referenced in a Security policy rule.
Changing the name of the address object in the
Shareddevice group causes the references in the Policy rule to use the renamed
Sharedobject instead of the device group object.
This issue is now resolved. SeePAN-OS 9.1.14-h1 Addressed Issues
The firewall drops all decrypted outbound (SSL Forward Proxy) HTTP/2 traffic after you upgrade to PAN-OS 9.1.14. Dropping this traffic prevents users from loading HTTP/2 web pages and accessing websites that use HTTP/2.
Workaround: On the SSL Forward Proxy tab in the Decryption profile attached to the Decryption Policy rule that controls the HTTP/2 traffic, select
Strip ALPN. When you
Strip ALPN, the firewall negotiates HTTP/1.1 instead of HTTP/2.
Firewalls licensed for Advanced URL Filtering generate a message indicating that a
License required for URL filtering to functionis unavailable displays at the bottom of the UI, due to a PAN-OS UI issue. This error does not affect the operation of Advanced URL Filtering or URL Filtering.
When an application matches an SD-WAN policy and some sessions for the same application do not match an SD-WAN policy, the SD-WAN Monitoring—Traffic Characteristics screen displays the Links Used information with an SD-WAN policy and a null policy. Sessions that do not have an SD-WAN policy ID are filtered from Links Used.
Workaround: If you want to see session logs that include a default selection, create a catch-all SD-WAN policy rule and place it last in the list of SD-WAN policies.
On the Panorama management server, context switching to and from the managed firewall web interface may cause the Panorama administrator to be logged out.
Workaround:Log out and back in to the Panorama web interface.
On the Panorama management server, scheduled email PDF reports (
) fail if a GIF image is used in the header or footer.
PA-7000 series firewalls configured with a large number of interfaces experience impacted performance and possible timeouts when performing SNMP queries.
On the Panorama management server, adding, deleting, or modifying the upstream NAT configuration (
) does not display the branch template stack as
out of sync.
Additionally, adding, deleting, or modifying the BGP configuration (
) does not display the hub and branch template stacks as
out of sync. For example, modifying the BGP configuration on the branch firewall does not cause the hub template stack to display as
out of sync, nor does modifying the BGP configuration on the hub firewall cause the branch template stack as
out of sync.
Workaround:After performing a configuration change,
Commit and Pushthe configuration changes to all hub and branch firewalls in the VPN cluster containing the firewall with the modified configuration.
PAN-OS 9.1.2-h1 and later releases only) On the Panorama management server, adding, deleting, or modifying the original subnet IP, or adding a new subnet after you successfully configure a tunnel IP subnet, for the SD-WAN 1.0.2 plugin does not display the managed firewall templates (
Out of Sync.
Workaround: When modifying the original subnet IP, or adding a new subnet, push the template configuration changes to your managed firewalls and
Force Template Values(
Push to Devices
The Panorama management server allows you to downgrade Zero Touch Provisioning (ZTP) firewalls to PAN-OS 9.1.2 and earlier releases where ZTP functionality is not supported.
SNMP traps configured to use the dataplane port in service routes are still sent using the management interface.
Workaround:Use a destination-based service route for the SNMP trap server.
ACC does not filter WildFire logs from Dynamic User Groups.
PA-3200 Series, PA-5220, PA-5250, PA-5260, and PA-7000 Series firewalls) For traffic between virtual systems (inter-vsys traffic), the firewall cannot perform source NAT using dynamic IP (DIP) address translation.
Workaround:Use source NAT with Dynamic IP and Port (DIPP) translation on inter-vsys traffic.
In the current release, SD-WAN auto-provisioning configures hubs and branches in a hub and spoke model, where branches don’t communicate with each other. Expected branch routes are for generic prefixes, which can be configured in the hub and advertised to all branches. Branches with unique prefixes are not published up to the hub.
Workaround:Add any specific prefixes for branches to the hub advertise-list configuration.
Panorama supports only incremental additions for CSV imports when the SD-WAN plugin is enabled. Delete devices manually in the web interface or CLI.
When you configure a Server Profile, the custom log format for GlobalProtect logs is missing.
If you use the CLI to enable the cleartext option for the Include Username in HTTP Header Insertion Entries feature, the authentication request to the firewall may become unresponsive or time out.
Dynamic tags from other sources are accessible using the CLI but do not display on the Panorama web interface.
When you try to view network QoS statistics on an SD-WAN branch or hub, the QoS statistics and the hit count for the QoS rules don’t display. A workaround exists for this issue. Please contact Support for information about the workaround.
There is an issue on M-500 Panorama management servers where any ethernet interface with an IPv6 address having Private PAN-DB-URL connectivity only supports the following format:
There is an issue where the firewall remains connected to the PAN-DB-URL server through the old management IP address on the M-500 Panorama management server, even when you configured the Eth1/1 interface.
Workaround:Update the PAN-DB-URL IP address on the firewall using one of the methods below.
M-Series Panorama management servers in Management Only mode) When you delete the local Log Collector (
), it disables the 1/1 ethernet interface in the Panorama configuration as expected but the interface still displays as Up when you execute the
show interface allcommand in the CLI after you commit.
Workaround:Disable the 1/1 ethernet interface before you delete the local log collector and then commit the configuration change.
Google Cloud Platform (GCP) only) The firewall does not accept the DNS value from the initial configuration (init-cfg) file when you bootstrap the firewall.
Workaround:Add DNS value as part of the bootstrap.xml in the bootstrap folder and complete the bootstrap process.
Microsoft Azure only) There is an intermittent issue where an Ethernet (eth1) interface does not come up when you first boot up the firewall.
Workaround:Reboot the firewall.
Alibaba Cloud runs on a KVM hypervisor and supports two Virtio modes: DPDK (default) and MMAP. If you deploy a VM-Series firewall running PAN-OS 9.0 in DPDK packet mode and you then switch to MMAP packet mode, the VM-Series firewall duplicates packets that originate from or terminate on the firewall. As an example, if a load balancer or a server behind the firewall pings the VM-Series firewall after you switch from DPDK packet mode to MMAP packet mode, the firewall duplicates the ping packets.
Throughput traffic is not duplicated if you deploy the VM-Series firewall using MMAP packet mode.
Firewalls with multiple virtual systems only) If you configure dynamic DNS (DDNS) on a new interface (associated with vsys1 or another virtual system) and you then create a
NewCertificate Profile from the drop-down, you must set the location for the Certificate Profile to Shared. If you configure DDNS on an existing interface and then create a new Certificate Profile, we also recommend that you choose the Shared location instead of a specific virtual system. Alternatively, you can select a preexisting certificate profile instead of creating a new one.
You can temporarily submit a change request for a URL Category with more than two suggested categories. However, we support only two suggested categories so add no more than two suggested categories to a change request until we address this issue. If you submit more than two suggested categories, we will use only the first two categories you enter.
Invalid configuration errors are not displayed as expected when you revert a Panorama management server configuration.
Workaround:After you revert the Panorama configuration,
) the reverted configuration to display the invalid configuration errors.
Commit to Panorama
The push scope selection on the Panorama web interface displays incorrectly even though the commit scope displays as expected. This issue occurs when one administrator makes configuration changes to separate device groups or templates that affect multiple firewalls and a different administrator attempts to push those changes.
Workaround:Perform one of the following tasks.
If you disable DPDK mode and enable it again, you must immediately reboot the firewall.
Tagged VLAN traffic fails when sent through an SR-IOV adapter.
Using the CLI to enable or disable DNS Rewrite under a Destination NAT policy rule has no effect.
DGA-based threats shown in the firewall threat log display the same name for all such instances.
The firewall does not generate a notification for the GlobalProtect client when the firewall denies an unencrypted TLS session due to an authentication policy match.
The system log does not correctly display the URL for CRL files; instead, the URLs are displayed with encoded characters.
After upgrading the Panorama management server to PAN-OS 8.1 or a later release, predefined reports do not display a list of top attackers.
Workaround:Create new threat summary reports (
) containing the top attackers to mimic the predefined reports.
Manage PDF Summary
If you configure a HIP object to match only when a connecting endpoint is managed (
), iOS and Android endpoints that are managed by AirWatch are unable to successfully match the HIP object and the HIP report incorrectly indicates that these endpoints are not managed. This issue occurs because GlobalProtect gateways cannot correctly identify the managed status of these endpoints.
Additionally, iOS endpoints that are managed by AirWatch are unable to match HIP objects based on the endpoint serial number because GlobalProtect gateways cannot identify the serial numbers of these endpoints; these serial numbers do not appear in the HIP report.
Adding a disk to a virtual appliance running Panorama 8.1 or a later release on VMware ESXi 6.5 update1 causes the Panorama virtual appliance and host web client to become unresponsive.
Workaround:Upgrade the ESXi host to ESXi 6.5 update2 and add the disk again.
Panorama plugins) The IP address-to-tag mapping information registered on a firewall or virtual system is not deleted when you remove the firewall or virtual system from a Device Group.
Workaround:Log in to the CLI on the firewall and enter the following command to unregister the IP address-to-tag mappings:
debug object registered-ip clear all.
After you configure and push address and address group objects in Shared and vsys-specific device groups from the Panorama management server to managed firewalls, executing the
show logcommand on a managed firewall only returns address and address group objects pushed form the Shared device group.
Workaround:Specify the vsys in the query string:
set system target-vsys
<direction>query equal ‘vsys eq
When booting or rebooting a PA-7000 Series Firewall with the SMC-B installed, the BIOS console output displays attempts to connect to the card's controller in the System Memory Speed section. The messages can be ignored.
GlobalProtect authentication fails with an
Invalid username/passworderror (because the user is not found in
Allow List) after you enable GlobalProtect authentication cookies and add a RADIUS group to the
Allow Listof the authentication profile used to authenticate to GlobalProtect.
Workaround:Disable GlobalProtect authentication cookies. Alternatively, disable (clear)
Retrieve user group from RADIUSin the authentication profile and configure group mapping from Active Directory (AD) through LDAP.
Panorama management server only) The Security Zone and Virtual System columns (
Noneafter a Device Group and Template administrator with read-only privileges performs a context switch.
request shutdown systemcommand does not shut down the Panorama management server.
You cannot restart or shutdown a Panorama on KVM from the Virtual-manager console or virsch CLI.
A firewall that is not included in a Collector Group fails to generate a system log if logs are dropped when forwarded to a Panorama management server that is running in Management Only mode.
On VM-Series firewalls that have Data Plane Development Kit (DPDK) enabled and that use the i40e network interface card (NIC), the
show session infoCLI command displays an inaccurate throughput and packet rate.
Workaround:Disable DPDK by running the
set system setting dpdk-pkt-io offCLI command.
The name for an address object, address group, or an external dynamic list must be unique. Duplicate names for these objects can result in unexpected behavior when you reference the object in a policy rule.
For administrator accounts that you created in PAN-OS 8.0.8 and earlier releases, the firewall does not apply password profile settings (
) until after you upgrade to PAN-OS 8.0.9 or a later release and then only after you modify the account passwords. (Administrator accounts that you create in PAN-OS 8.0.9 or a later release do not require you to change the passwords to apply password profile settings.)
When DPDK is enabled on the VM-Series firewall with i40e virtual function (VF) driver, the VF does not detect the link status of the physical link. The VF link status remains up, regardless of changes to the physical link state.
HTTP Header Insertion does not work when jumbo frames are received out of order.
The firewall and Panorama web interfaces display vulnerability threat IDs that are not available in PAN-OS 9.0 releases (
). To confirm whether a particular threat ID is available in your release, monitor the release notes for each new Applications and Threats content update or check the Palo Alto Networks Threat Vault to see the minimum PAN-OS release version for a threat signature.
When you configure a VM-500 firewall with an SCTP Protection profile (
) and you try to add the profile to an existing Security Profile Group (
), the Security Profile Group doesn’t list the SCTP Protection profile in its drop-down list of available profiles.
Security Profile Groups
Workaround:Create a new Security Profile Group and select the SCTP Protection profile from there.
When you configure a firewall running PAN-OS 9.0 as an nCipher HSM client, the web interface on the firewall displays the nCipher server status as Not Authenticated, even though the HSM state is up (
The memory-optimized VM-50 Lite intermittently performs slowly and stops processing traffic when memory utilization is critically high. To prevent this issue, make sure that you do not:
Workaround:When the firewall performs slowly, or you see a critical System log for memory utilization, wait for 5 minutes and then manually reboot the firewall.
Use the Task Manager to verify that you are not performing memory intensive tasks such as installing dynamic updates, committing changes or generating reports, at the same time, on the firewall.
On a VM-Series firewall, the
clear session allCLI command does not clear GTP sessions.
In rare cases, a PA-5200 Series firewall (with an FE100 network processor) that has session offload enabled (default) incorrectly resets the UDP checksum of outgoing UDP packets.
Workaround:In PAN-OS 8.0.6 and later releases, you can persistently disable session offload for only UDP traffic using the
set session udp-off load noCLI command.
The VM-Series firewall on Google Compute Platform does not publish firewall metrics to Google Stack Monitoring when you manually configure a DNS server IP address (
Workaround:The VM-Series firewall on Google Cloud Platform must use the DNS server that Google provides.
SSL decryption based on ECDSA certificates does not work when you import the ECDSA private keys onto an nCipher nShield hardware security module (HSM).
Endpoints failed to authenticate to GlobalProtect through Kerberos when you specify an FQDN instead of an IP address in the Kerberos server profile (
Workaround:Replace the FQDN with the IP address in the Kerberos server profile.
PA-7000 Series, PA-5200 Series, and PA-3200 Series firewalls configured in tap mode don’t close offloaded sessions after processing the associated traffic; the sessions remain open until they time out.
Workaround:Configure the firewalls in virtual wire mode instead of tap mode, or disable session offloading by running the
set session off load noCLI command.
PAN-OS 8.0.1 and later releases) In WildFire appliance clusters that have three or more nodes, the Panorama management server does not support changing node roles. In a three-node cluster for example, you cannot use Panorama to configure the worker node as a controller node by adding the HA and cluster controller configurations, configure an existing controller node as a worker node by removing the HA configuration, and then commit and push the configuration. Attempts to change cluster node roles from Panorama results in a validation error—the commit fails and the cluster becomes unresponsive.
The firewall does not generate a packet capture (pcap) when a Data Filtering profile blocks files.
PAN-OS 8.0.1 and later releases) When you import a two-node WildFire appliance cluster into the Panorama management server, the controller nodes report their state as out-of-sync if either of the following conditions exist:
Workaround:There are three possible workarounds to sync the controller nodes:
Local users and user groups in the Shared location (all virtual systems) are not available to be part of the user-to-application mapping for GlobalProtect Clientless VPN applications (
Workaround:Create users and user groups in specific virtual systems on firewalls that have multiple virtual systems. For single virtual systems (like VM-Series firewalls), users and user groups are created under Shared and are not configurable for Clientless VPN applications.
If the PAN-OS web interface and the GlobalProtect portal are enabled on the same IP address, then when a user logs out of the GlobalProtect portal, the administrative user is also logged out from the PAN-OS web interface.
Workaround:Use the IP address to access the PAN-OS web interface and an FQDN to access the GlobalProtect portal.
When viewing an external dynamic list that requires client authentication and you
Test Source URL, the firewall fails to indicate whether it can reach the external dynamic list server and returns a URL access error (
External Dynamic Lists
When you use a firewall loopback interface as a GlobalProtect gateway interface, traffic is not routed correctly for third-party IPSec clients, such as strongSwan.
Workaround:Use a physical firewall interface instead of a loopback firewall interface as the GlobalProtect gateway interface for third-party IPSec clients. Alternatively, configure the loopback interface that is used as the GlobalProtect gateway to be in the same zone as the physical ingress interface for third-party IPSec traffic.
The VM-Series firewall on KVM, for all supported Linux distributions, does not support the Broadcom network adapters for PCI pass-through functionality.
Regardless of the
Time Frameyou specify for a scheduled custom report on a Panorama M-Series appliance, the earliest possible start date for the report data is effectively the date when you configured the report (
). For example, if you configure the report on the 15th of the month and set the
Manage Custom Reports
Last 30 Days, the report that Panorama generates on the 16th will include only data from the 15th onward. This issue applies only to scheduled reports; on-demand reports include all data within the specified
Workaround:To generate an on-demand report, click
Run Nowwhen you configure the custom report.
When you perform a factory reset on a Panorama virtual appliance and configure the serial number, logging does not work until you reboot Panorama or execute the
debug software restart process management-serverCLI command.
The following issues apply when configuring a firewall to use a hardware security module (HSM):
Recommended For You
Recommended videos not found.