The following list describes known issues and limitations in PAN-OS 9.0 XFR.
The VM-Series firewall deployed on KVM or ESXi go in to maintenance mode. This issue occurs only when it is configured with 2 NUMA nodes/sockets and is enabled for jumbo frames in DPDK mode.
Workaround: Configure the firewall with just 1 NUMA node/socket.
VM-Series firewall interfaces that are using SR-IOV stop transmitting packets if you change the maximum transmission unit (MTU) directly on the physical function on the host while the firewall is powered on.
Workaround: Shut down the VM-Series firewall and re-add the SR-IOV configuration. See this article for details on the SR-IOV configuration.
Active-active HA is not supported on the VM-Series firewall on ESXi with SR-IOV, or KVM with SR-IOV.
When using SR-IOV on the VM-Series firewall on KVM, traffic (both data and HA packets for session state synchronization) does not pass through the firewall if the MTU size is not set to 1600 bytes.
Workaround:Set the MTU size to 1600 bytes on the host physical interface.
You cannot install the PAN-OS-9.0.3.xfr software image when you manually upload and install the software image.
Workaround: If you use Panorama to manage your VM-Series firewalls, you can download the image from
and install it on the VM-Series firewalls. If you do not use Panorama, download the software image from the Palo Alto Networks Support portal. And log in to the firewall and select
to manually upload the image. Select
Upload only to device (do not install), and after it is done
You must install the VM-Series plugin 1.0.5 on the firewall before you install PAN-OS-9.0.3.xfr.
Recommended For You
Recommended videos not found.