|
PAN-304756
|
After you disable the shared optimization feature in Panorama, ensure
that you perform a full configuration push to all managed multi-vsys
devices to re-establish a baseline. Failure to include every device
group associated with the multi-vsys device during this push might
result in incomplete or inconsistent configurations across virtual
systems.
|
|
PAN-298505
|
After upgrading multi-vsys firewalls, the sequence of the virtual
system IDs (vsys ID) changes causing auto-commit failures with
validation errors. This occurs when the multi-vsys firewall has
virtual systems managed by Panorama, and the vsys ID sequence breaks
when unused virtual systems are deleted and the changes are pushed to
the firewall.
|
|
PAN-294179
|
On the Panorama Config Audit page,
some commit versions might display incorrect or missing data. Fields
such as, COMMITTED BY,
COMMIT DATE, and
OBJECT CHANGES
might not be visible for some commit versions. Sometimes, commit
versions can disappear after a refresh and the commit description field
might display corrupted characters.
|
|
PAN-291288
|
An active firewall might unexpectedly reboot due to a
pan_task crash caused by a page
allocation failure. This issue is observed after a period of runtime
with traffic and telemetry collection.
|
|
PAN-290088
|
When pushing configurations from Panorama to a firewall, a memory leak
might occur in the firewall's
configd process, particularly when the
configurations contain shared policies. Each configuration push causes
the configd process to consume
additional memory that is not released after the commit completes.
|
|
PAN-289383
|
(PA-800 series firewalls only) Upgrading
firewalls to PAN-OS 11.0 or later causes SFP ports to go
non-operational when the firewall uses forced port mode and the
connected peer device operates without auto-negotiation.
Workaround: Enable auto-negotiation on the
connected peer firewall.
|
|
PAN-288097
|
Routed process may stop responding after changing MTU or any link
parameters when OSPF and PIM are enabled on the same interface.
|
|
PAN-286231
|
When performing a partial Commit and Push on
Panorama, there is a risk that unintended configuration changes might
be pushed to a firewall.
This issue is more likely to occur in the following scenarios:
-
When you run Commit and Push operations as a
single action.
-
When you trigger multiple parallel commit-all jobs at the same
time.
-
Device groups and templates have different configuration
synchronization versions.
Workaround: Perform one of the following steps:
-
Perform commit and push as two separate, sequential steps.
- Perform a full push instead of selective push.
|
|
PAN-285894
|
If the Preserve Pre-NAT feature is enabled, dataplane crashes may
occur, which could result in firewall reboots.
Workaround: Disable the Preserve Pre-NAT feature
using the
set deviceconfig setting preserve-prenat-feature no
CLI command.
|
|
PAN-283429
|
When you use custom certificates for the connection between Panorama
and a log collector, the automated renewal for the predefined
ElasticSearch certificates gets disrupted.
Workaround: Remove the custom certificates before
the ElasticSearch certificates expire. This allows the system to
correctly identify and renew the predefined ElasticSearch
certificates. After the renewal is complete, re-install the custom
certificates.
|
|
PAN-281885
|
When exporting and importing the CSV file, the hash values of
pre-shared key (PSK) variables set at template and template stack
levels inconsistently change, resulting in both variables displaying
the same hash value.
|
|
PAN-280532
|
When you use a single syslog server over TCP for log forwarding, and
the connectivity to the syslog server breaks, syslog forwarding does
not resume even after the connectivity to the server restores.
Workaround: Performing one of the following tasks:
- Reboot the firewall.
-
Temporarily, configure syslog to use UDP, commit the configuration,
revert to TCP, and then commit.
|
|
PAN-280471
|
When applying filters or searching for logs in the
section, you might experience slow performance.
|
|
PAN-277417
|
Memory leak issues can occur during the parsing of server certificates
used for SSL Inbound Inspection, preventing the firewall from
completing inspection.
|
|
PAN-277034
|
WildFire reports might not fully display or be downloadable because some
static resources fail to load.
|
|
PAN-275601
|
When Panorama is not internet-connected and you try to upload images
to the managed firewalls by using the
Validate option, the upload fails
with the following error:
Failed to create multi-upload job. No valid software deploy targets
found.
|
|
PAN-273300
|
When upgrading Panorama from PAN-OS 10.2 or PAN-OS 11.0 to PAN-OS 11.1
or a later release, Panorama fails to upgrade if it is operating
within a Collector Group. The following error appears:Error: Traceback (most recent call last):File
"/opt/panrepo/releases/<PANOS release version>/validate"...
(min ([dts['min'] for dts in 10g_type_intv_dir.values() if
dts|'min']])-strftime ('%Y-%m-%d'),
|
|
PAN-262556
|
The ElasticSearch cluster health status might continue to remain
yellow for an extended period after upgrading to PAN-OS 11.1.0.
|
|
PAN-262287
|
Dereferencing a NULL pointer that occurs might cause
pan_task
processes to crash.
|
|
PAN-262263
|
(PA-1400, PA-3400, and PA-5400 Series firewalls) The links on the firewall's RJ-45 ports may go up and down
additional times during a reboot, causing unexpected downtime.
|
|
PAN-260851
|
From the NGFW or Panorama CLI, you can override the existing
application tag even if Disable Override is enabled for the
application () tag.
|
|
PAN-257615
|
The Panorama web interface intermittently displays logs or fails to
display logs completely.
|
|
PAN-259769
|
GlobalProtect portal is not accessible via a web browser and the app
displays the error
ERR_EMPTY_RESPONSE.
|
|
PAN-250062
|
Device telemetry might fail at configured intervals due to bundle
generation issues.
|
|
PAN-243951
|
On the Panorama management sever in an active/passive High
Availability (HA) configuration, managed devices () display as out-of-sync on the
passive HA peer when configuration changes are made to the SD-WAN
() configuration on the active HA peer.
Workaround: Manually synchronize the Panorama HA
peers.
-
-
Select Commit and
Commit to Panorama the SD-WAN
configuration changes on the active HA peer.
On the passive HA peer, select
and observe that the managed devices are now
out-of-sync.
-
Log in to the primary HA peer
Panorama CLI
and trigger a manual synchronization between the active and
secondary HA peers.
request high-availability sync-to-remote running-config
-
Log back in to the active HA peer Panorama web interface and
select
and Push.
|
|
PAN-242910
|
On the Panorama management server, Panorama administrators () that are assigned a custom Panorama admin role () with Push All Changes enabled are
unable to push configuration changes to managed firewalls when
Managed Devices and
Push For Other Admins are disabled.
|
|
PAN-242561
|
GlobalProtect tunnel might disconnect shortly after being established
when SSL is used as a transport protocol.
Workaround: Disable Internet Protocol version 6
(TCP/IPv6) on the PANGP Virtual Network Adapter.
|
|
PAN-241041
|
On the Panorama management server exporting template or template stack
variables () in CSV format results in an empty CSV file.
|
|
PAN-237106
|
LSVPN satellite certificates may be generated with serial numbers
exceeding 40 hexadecimal characters. This causes certificate
revocation and deletion operations to fail with the following error
messages:
-
db-serialno can be at most 40 characters
-
db-serialno is invalid
Workaround:
To resolve this issue, use the following CLI commands with the LSVPN
satellite serial number to manually delete or revoke the affected
certificates:
Delete certificate information:delete sslmgr-store certificate-info portal name
<name> serialno
<satellite_serial>
Revoke satellite certificates:delete sslmgr-store satellite-info-revoke-certificate portal
<name> serialno
<list_of_satellite_serials>
|
|
PAN-234408
|
Enterprise DLP cannot detect and block non-file based traffic for
ChatGPT from traffic forwarded to the DLP cloud service from an NGFW.
|
|
PAN-234015
|
The X-Forwarded-For (XFF) value is not displayed in traffic logs.
|
|
PAN-229081
|
(PA-7500 firewalls only) The CLI commands
show logging-status and
show logging-status verbose yes do
not display aggregate log forwarding statistics on the Management
Plane.
|
|
PAN-228491
|
On the AWS environment, the session failover takes up to 4 minutes.
|
|
PAN-225337
|
On the Panorama management server, the configuration push to a
multi-vsys firewall fails if you:
-
Create a Shared and
vsys-specific device group configuration object with an indentical
name. For example, a
Shared address object called
SharedAO1 and a vsys-specific
address object also called
SharedAO1.
-
Reference the Shared object in
another Shared configuration.
For example, reference the
Shared address object (SharedAO1) in a Shared address group
called SharedAG1.
-
Use the Shared configuration
object with the reference in a vsys-specific configuration. For
example, reference the
Shared address group (SharedAG1) in a vsys-specific policy rule.
Workaround: Select
and edit the Panorama Settings to enable one of the following:
-
Shared Unused Address and Service Objects with Devices—This options pushes all
Shared objects, along with
device group specific objects, to managed firewalls.
This is a global setting and applies to all managed firewalls, and
may result in pushing too many configuration objects to your
managed firewalls.
-
Objects defined in ancestors will take higher precedence—This option specifies that in the event of objects with the same
name, ancestor object take precedence over descendent objects. In
this case, the Shared objects
take precedence over the vsys-specific object.
This is a global setting and applies to all managed firewalls. In
the example above, if the IP address for the
Shared
SharedAO1 object was
10.1.1.1 and the device group
specific SharedAO1 was
10.2.2.2, the
10.1.1.1 IP address takes
precedence.
Alternatively, you can remove the duplicate address objects from the
device group configuration to allow only the
Shared objects in your
configuration.
|
|
PAN-224502
|
The autocommit time of the VM-Series firewall running PAN-OS 11.1.0
might take longer than expected.
|
|
PAN-222805
|
(PA-7500 firewall only) The CLI command
show running resource-monitor ingress-backlogs
does not display the correct usage values.
|
|
PAN-220577
|
With firewalls in AWS environment that are licensed with VM capacity
and secure web proxy licenses, it is observed that the enablement of
the web-proxy config fails.
Workaround: Reboot the firewall after the web
proxy license is applied.
|
|
PAN-220180
|
Configured botnet reports () are not generated.
|
|
PAN-217307
|
The following Security policy rule () filters return no results:
log-start eq no
log-end eq no
log-end eq yes
|
|
PAN-208794
|
In firewalls with transparent proxy, it is observed that a reboot is
necessary to view the transit sessions.
Workaround: Edit the virtual router settings with
any minor change and commit again. Any changes to the
network/interfaces or network/virtual routers usually fixes this
issue.
Alternatively, you may try rebooting the firewall. This issue
disappears following reboot after the
swg is setup and configured.
|
|
PAN-207733
|
When a DHCPv6 client is configured on HA Active/Passive firewalls, if
the DHCPv6 server goes down, after the lease time expires, the DHCPv6
client should enter SOLICIT state on both the Active and Passive
firewalls. Instead, the client is stuck in BOUND state with an IPv6
address having lease time 0 on the Passive firewall.
|
|
PAN-207611
|
When a DHCPv6 client is configured on HA Active/Passive firewalls, the
Passive firewall sometimes crashes.
|
|
PAN-207442
|
For M-700 appliances in an active/passive high availability () configuration, the
active-primary HA peer
configuration sync to the
secondary-passive HA peer may
fail. When the config sync fails, the job Results is
Successful
(Tasks), however the sync status on
the Dashboard displays as
Out of Sync for both HA peers.
Workaround: Perform a local commit on the
active-primary HA peer and then
synchronize the HA configuration.
-
-
Select Commit and
Commit to Panorama.
-
In the active-primary HA peer
Dashboard, click
Sync to Peer in the High
Availability widget.
|
|
PAN-207040
|
If you disable Advanced Routing, remove logical routers, and downgrade
from PAN-OS 11.0.0 to a PAN-OS 10.2.x or 10.1.x release, subsequent
commits fail and SD-WAN devices on Panorama have no Virtual Router
name.
|
|
PAN-206909
|
The Dedicated Log Collector is unable to reconnect to the Panorama
management server if the configd
process crashes. This results in the Dedicated Log Collector losing
connectivity to Panorama despite the managed collector connection
Status () displaying connected and the
managed colletor Health status
displaying as healthy.
This results in the local Panorama config and system logs not being
forwarded to the Dedicated Log Collector. Firewall log forwarding to
the disconnected Dedicated Log Collector is not impacted.
Workaround: Restart the
mgmtsrvr process on the Dedicated
Log Collector.
-
-
Confirm the Dedicated Log Collector is disconnected from Panorama.
admin> show panorama-status
Verify the Connected status
is no.
-
Restart the mgmtsrvr process.
admin> debug software restart process management-server
|
|
PAN-197588
|
The PAN-OS ACC (Application Command Center) does not display a widget
detailing statistics and data associated with vulnerability exploits
that have been detected using inline cloud analysis.
|
|
PAN-197419
|
(PA-1400 Series firewalls only) In
, the power over Ethernet (PoE) ports do not display a
Tag value.
|
|
PAN-196758
|
On the Panorama management server, pushing a configuration change to
firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP
configurations for SD-WAN as being edited or deleted despite no edits
or deletions being made when you
Preview Changes (
or
).
|
|
PAN-195968
|
(PA-1400 Series firewalls only) When using the
CLI to configure power over Ethernet (PoE) on a non-PoE port, the CLI
prints an error depending on whether an interface type was selected on
the non-PoE port or not. If an interface type, such as tap, Layer 2,
or virtual wire, was selected before PoE was configured, the error
message will not include the interface name (eg. ethernet1/4). If an
interface type was not selected before PoE was configured, the error
message will include the interface name.
|
|
PAN-194978
|
(PA-1400 Series firewalls only) In
, hovering the mouse over a power over Ethernet (PoE)
Link State icon does not display
link speed and link duplex details.
|
|
PAN-187685
|
On the Panorama management server, the Template Status displays no
synchronization status () after a bootstrapped firewall is successfully added to Panorama.
|
|
PAN-187407
|
The configured Advanced Threat Prevention inline cloud analysis action
for a given model might not be honored under the following condition:
If the firewall is set to
Hold client request for category lookup and the action set to
Reset-Both and the URL cache has
been cleared, the first request for inline cloud analysis will be
bypassed.
|
|
PAN-186283
|
Templates appear out-of-sync on Panorama after successfully deploying
the CFT stack using the Panorama plugin for AWS.
Workaround: Use
to synchronize the templates.
|
|
PAN-184708
|
Scheduled report emails () are not emailed if:
-
A scheduled report email contains a Report Group () which includes a SaaS Application Usage report.
-
A scheduled report contains only a SaaS Application Usage Report.
Workaround: To receive a scheduled report email
for all other PDF report types:
-
Select
and remove all SaaS Application Usage reports from all Report
Groups.
-
Select
and edit the scheduled report email that contains only a SaaS
Application Usage report. For the Recurrence, select
Disable and click
OK.
Repeat this step for all scheduled report emails that contain only
a SaaS Application Usage report.
-
Commit.
(Panorama managed firewalls) Select
|
|
PAN-184406
|
Using the CLI to add a RAID disk pair to an M-700 appliance causes the
dmdb process to crash.
Workaround: Contact customer support to stop the
dmdb process before adding a RAID disk pair to a M-700 appliance.
|
|
PAN-183404
|
Static IP addresses are not recognized when "and" operators are used
with IP CIDR range.
|
|
PAN-181933
|
If you use multiple log forwarding cards (LFCs) on the PA-7000 series,
all of the cards may not receive all of the updates and the mappings
for the clients may become out of sync, which causes the firewall to
not correctly populate the Source User column in the session logs.
|
|
PAN-164885
|
On the Panorama management server, pushes to managed firewalls (
or Commit and Push) may fail when an
EDL () is configured to
Check for updates every 5 minutes
due to the commit and EDL fetch processes overlapping. This is more
likely to occur when multiple EDLs are configured to check for updates
every 5 minutes.
|