Limitations

Limitations related to PAN-OS 9.1 releases.
The following are limitations associated with PAN-OS 9.1.
Issue ID
Description
Firewalls and appliances perform a software integrity check periodically when they are running and when they reboot. If you simultaneously boot up multiple instances of a VM-Series firewall on a host or you enable CPU over-subscription on a VM-Series firewall, the firewall boots in to maintenance mode when a processing delay results in a response timeout during the integrity check. If your firewall goes in to maintenance mode, please check the error and warnings in the fips.log file.
A reboot always occurs during an upgrade so if you enabled CPU over-subscription on your VM-Series firewall, consider upgrading your firewall during a maintenance window.
PAN-142084
Upgrading a Panorama management server deployed on Amazon Web Services (AWS) using a C5 or M5 instance type to PAN-OS 9.1.1 causes the Panorama virtual appliance to become unresponsive.
PAN-137615
On the Panorama management server, scheduled content updates (
Panorama
Device Deployment
Dynamic Updates
) for managed VM-Series firewalls configured to
Download Only
cause commit failures for the VM-Series firewalls.
Workaround:
Configure scheduled content updates for VM-Series firewalls to
Download and Install
.
PAN-128908
If an admin user password is changed but no commit is performed afterward, the new password does not persistent after a reboot. Instead, the admin user can still use the old password to log in, and the calculation of expiry days is incorrect based on the password change timestamp in the database.
PAN-107142
After adding a new virtual system from the CLI, you must log out and log back in to see the new virtual system within the CLI.
PAN-99483
(
Affects only PA-7000 Series firewalls that do not use second-generation PA-7050-SMC-B or PA-7080-SMC-B Switch Management Cards
) When you deploy the firewall in a network that uses Dynamic IP and Port (DIPP) NAT translation with PPTP, client systems are limited to using a translated IP address-and-port pair for only one connection. This issue occurs because the PPTP protocol uses a TCP signaling (control) protocol that exchanges data using Generic Routing Encapsulation (GRE) version 1 and the hardware cannot correlate the call-id in the GRE version 1 header with the correct dataplane (the one that owns the predict session of GRE). This issue occurs even if you configure the Dynamic IP and Port (DIPP)
NAT Oversubscription Rate
to allow multiple connections (
Device
Setup
Session
Session Settings
NAT Oversubscription
).
Workaround:
Upgrade to a second-generation SMC-B card.
PAN-97821
The
commit all
job is executed from Panorama to the firewall only if the newly added firewall is running PAN-OS 8.1 or a later release with
Auto Push on 1st Connect
enabled.
PAN-92719
When performing destination NAT to a translated address that is
Dynamic IP (with session distribution)
, the firewall does not remove duplicate IP addresses from the list of destination IP addresses before the firewall distributes sessions. The firewall distributes sessions to the duplicate addresses in the same way it distributes sessions to non-duplicate addresses.

Recommended For You