---
type: Addressed
product: PAN-OS
version: 9.1.5
---

## PAN-154092

Added an enhancement that provides an option to increase Data Plane Development Kit (DPDK) ring size and DPDK queue number for VM-Series firewalls deployed on ESXi.

## PAN-152699

Fixed an issue where the firewall added a redundant 0\r\n packet while processing Clientless VPN traffic.

## PAN-152285

Fixed an issue where certain GPRS tunneling protocol (GTP-U) sessions that could not complete installation still occupied the flow table, which led to higher session table usage.

## PAN-151203

Fixed an issue where the firewall dropped certain GTPv1 Update PDP Context packets.

## PAN-151164

Fixed an issue where logs weren't able to be migrated from PA-5200 Series firewalls manually via the CLI.

## PAN-151057

Fixed an issue where upgrading the capacity license on a virtual machine (VM) high availability (HA) pair resulted in both firewalls going into a non-functional state instead of only the higher capacity license firewall.

## PAN-150750

```caveat
PA-5200 and PA-7000 Series firewalls only
```

Fixed an intermittent issue where the firewall dropped packets when two or more GTP packets on the same GTP tunnel were very close to each other.

## PAN-150748

Fixed an issue where the firewall silently dropped GTPv2-C Delete Session Response packets.

## PAN-150746

Fixed an issue where the firewall dropped GTP packets with Delete Bearer messages for EBI 6 if they were received within two seconds of receiving the Delete Bearer messages for EBI 5.

## PAN-150243

Fixed an issue where after a successful commit, the candidate configuration was not updated to running configuration when initiated by an API-privileges-only custom role based administrator.

## PAN-149839

```caveat
PA-7000 Series firewalls only
```

Added CLI commands to enable/disable resource-control groups and CLI commands to set an upper memory limit of 8G on a process (mgmtsrvr). To enable resource-control groups, use debug software resource-control enable and to disable them, use debug software resource-control disable. To set the memory limit, use debug management-server limit-memory enable, and to remove the limit, use debug management-server limit-memory disable. For the memory limit change to take effect, the firewall must be rebooted.

## PAN-149813

Fixed an issue where the reply to an XML API call from Panorama was in a different format after upgrading to PAN-OS 8.1.14-h1 and later releases, which caused automated systems to fail the API call.

## PAN-149770

Fixed an issue with debug file handling that led to a process (mgmtsrvr) restart.

## PAN-149480

Fixed an issue where, if Panorama was connected to log collectors running an earlier release, a custom report query from Panorama, which includes new fields not supported in prior releases, triggered a restart on a process (reportd).

## PAN-149426

Fixed an issue where non-superuser administrators with all rights enabled were unable to **Review Policies** or **Review Apps** for downloaded or installed content versions.

## PAN-149325

Fixed an issue on Panorama where the web interface took more time than expected to load changes when the virtual router was large or when there was a large configuration change request from the web interface.

## PAN-149296

Fixed an issue on Panorama where system and configuration logs of dedicated Log Collectors did not show up on Panorama appliances in Management Only mode.

## PAN-149008

Fixed an issue where the CLI command Show config running following the CLI command set cli op-command-xml-output on produces an unreadable output.

## PAN-149005

Fixed an issue where XML API failed to fetch logs larger than 10MB.

## PAN-148564

Fixed an issue where Panorama stopped showing new logs when url_category_list was in the URL payload format of the HTTP(S) server profile used to forward URL logs from the Panorama Log Collector.

## PAN-148087

Fixed an issue where the object identifier (OID) being polled for the component hrStorageUsed was not unique after a PAN-OS upgrade.

## PAN-147741

Fixed an issue where an API call for correlated events did not return any events.

## PAN-147595

Fixed an issue where, after a policy commit and session rematch, stream control transmission protocol (SCTP) logs for an existing SCTP session still showed old rule information.

## PAN-147285

Fixed an issue where host information profile (HIP) details were not available on Panorama even when a HIP redistribution configuration was in place.

## PAN-146878

Fixed an issue where TCP traffic dropped due to TCP sequence checking in an HA active/active configuration where traffic was asymmetric.

## PAN-146841

Fixed an issue in Panorama where a commit-all to the managed firewalls failed with the following error message: invalid object reference when address objects were uploaded using an external script.

## PAN-146787

Fixed an issue where traffic incorrectly matched URL based authentication policies.

## PAN-146650

A fix was made to address an authentication bypass vulnerability in the GlobalProtect SSL VPN component of PAN-OS that allowed an attacker to bypass all client certificate checks with an invalid certificate. As a result, the attacker was able to authenticate as any user and gain access to restricted VPN network resources when the gateway or portal was configured to rely only on certificate-based authentication ([CVE-2020-2050](https://security.paloaltonetworks.com/CVE-2020-2050)).

## PAN-146623

Fixed an issue where a GlobalProtect client in a system with umlaut diacritics serial number was unable to log in to the GlobalProtect gateway.

## PAN-146506

Fixed an issue where memory usage on a process (useridd) was high, which caused the process to restart on the firewall acting as the User-ID redistribution agent. This issue occurred when multiple clients requested IP address-to-user mappings at the same time.

## PAN-146284

Fixed an issue where Application and Threat Content installation failed on the firewall with the following error message: Error: Threat database handler failed.

## PAN-146117

Fixed an issue on the firewalls where memory usage on a process (devsrvr) increased after running the show object dynamic-address-group all CLI command.

## PAN-146115

Fixed an issue where GlobalProtect IPsec connections flapped when the peer address to the gateway changed due to NAT.

## PAN-146107

Fixed an issue where memory allocation failure caused a process (pan_comm) to restart several times, which caused the firewall to restart.

## PAN-145823

Fixed an issue where BGP learned routes were incorrectly populated with a VR error as a next hop.

## PAN-145757

Fixed an issue on the firewalls where a process (all_pktproc) restarted while processing Session Traversal Utilities for NAT (STUN) over TCP.

## PAN-145752

Fixed an issue where exporting policies to PDF or CSV files did not include all policies and contained duplicates.

## PAN-145721

Fixed an issue where Application Command Center (ACC) data did not load when accessed from the **Top Applications** widget in the **Dashboard**.

## PAN-145507

Fixed an issue on the firewalls where traffic originating from a GlobalProtect user did not match HIP-based Security policies using the cached HIP report. Instead, the traffic was denied until the GlobalProtect agent submitted a new HIP report about 20 seconds later.

## PAN-145305

Fixed an issue where an inconsistent PAN-DB cloud connection caused the firewall to negotiate the incorrect version and decode the cloud responses with the incorrect format.

## PAN-145133

A fix was made to address a vulnerability in the PAN-OS signature-based threat detection engine that allowed an attacker to evade threat prevention signatures using specifically crafted TCP packets ([CVE-2020-1999](https://security.paloaltonetworks.com/CVE-2020-1999)).

## PAN-145041

Fixed an issue on the firewalls where a process (all_task) stopped responding.

## PAN-144919

Fixed an issue on an M-600 appliance where the Panorama management server stopped receiving new logs from firewalls because delayed log purging caused log storage on the Log Collectors to reach maximum capacity.

## PAN-144448

Fixed an issue with the automated correlation engine that caused firewalls to stop generating correlated event logs for the beacon-heuristics object (ID 6005).

## PAN-144232

Fixed an issue where, when any change was made to an authentication profile, the LDAP server or local user database in a shared context removed the user group mapping information from the firewall.

## PAN-143959

Fixed an issue on Panorama where a custom administrator with all rights enabled was not able to display the content of the external dynamic list (EDL) on the Panorama web interface.

## PAN-143809

Fixed an issue where Log Collectors had problems ingesting logs for older days received at a high rate.

## PAN-143796

Fixed an issue where commits failed on the firewall due to memory allocation failure. Configuration memory can be checked using the debug dataplane show cfg-memstat statistics CLI command.

## PAN-143010

```caveat
PA-7000 Series firewalls only
```

Fixed an issue with intermittent packet loss for GlobalProtect SSL tunnel traffic.

## PAN-142562

Fixed an issue on Panorama where creating certificates took longer than expected, which caused configuration lock timeouts.

## PAN-142363

Fixed an issue where a process (mprelay) stopped responding and invoked an out-of-memory (OOM) killer condition and displayed the following error messages: `tcam full` and pan_plfm_fe_cp_arp_delete.

## PAN-142219

Fixed an issue where a Panorama log query did not work for closed indices.

## PAN-141980

Fixed an issue where random member ports in a link aggregate group failed to join the aggregate group due to the following error: Link speed mismatch.

## PAN-141895

Fixed an issue that prevented GTP tunnel session timeout values from being configured via the web interface.

## PAN-141793

Fixed an issue where Panorama did not show correct logs filtered with not, leq, and geq.

## PAN-141717

Fixed an issue where an administrative user using custom admin roles and without access to the **Device** tab was unable to expand the detailed views of **Monitor > Logs**.

## PAN-141551

Fixed an issue where SSH service restart management did not take effect in the SSH management server profile.

## PAN-141296

Fixed an issue where a large certificate chain transmission delayed the decryption process and did not populate the mutual authentication cache.

## PAN-140900

Fixed an issue where IP address-to-tag mapping entries had negative time-to-live (TTL) values instead of being removed after expiry.

## PAN-140883

Fixed an issue where, after rebooting the firewall, the SNMP object identifier (OID) for TCP connections per second (panVsysActiveTcpCps / .1.3.6.1.4.1.25461.2.1.2.3.9.1.6.1) returned 0 until another OID was pulled. Additionally, after a restart of a daemon (snmpd), if the above OID was called before other OIDs, there was an approximate 10 second delay in populating the data pulled by each OID.

## PAN-140736

Fixed an issue where configuration synchronization failed in an HA configuration.

## PAN-140382

Fixed an issue where the Host Evasion Threat ID signature did not trigger for the initial session even after the DNS response was received before the session expired.

## PAN-140227

```caveat
PA-7000 Series firewalls only
```

Fixed a rare issue where the firewall rebooted due to path monitoring failure on the Log Processing Card (LPC).

## PAN-140173

Fixed an issue where a high number of groups in group mapping caused a process (useridd) to exit.

## PAN-140100

Fixed an issue where **Detailed Log View** (**Monitor > Logs > Traffic**) did not display the URL filtering logs as expected on HTTP/2 stream sessions.

## PAN-140084

```caveat
PA-3200 Series firewalls only
```

Fixed an issue where the default Dynamic IP and Port (DIPP) NAT oversubscription rate was set as 2.

## PAN-139991

Fixed an issue where the web interface and the CLI were inaccessible, which caused the following error message to display on the web interface: Timed out while getting config lock.

## PAN-139233

Fixed an issue where HIP reports failed to show up via the web interface or the CLI.

## PAN-139136

Fixed an issue where a large number of groups in group mappings caused a process (useridd) to exit.

## PAN-138427

Fixed an issue where pushing a configuration from a Panorama management server running PAN-OS 9.0 to a firewall running PAN-OS 8.1 produced a HTTP/2 warning. To leverage this fix, update both Panorama and the firewall to PAN-OS 9.1.5.

## PAN-137663

Fixed a cosmetic issue where misleading App-ID and rule shadowing warnings populated after a commit.

## PAN-137157

Fixed an issue where Panorama became inaccessible with the following error message: Timed out while getting config lock.

## PAN-135989

Fixed an issue where the serial number was unknown for VM-Series firewalls after upgrading from PAN-OS 8.0 to PAN-OS 8.1.

## PAN-135354

Fixed an issue where the paths between the control plane and the dataplanes in network processing cards (NPCs) stalled in the dataplane-to-control plane direction due to the Ring Descriptor entries becoming out of sync on each side. This produced unrecoverable data path monitoring failures, which caused the chassis to become nonfunctional.

## PAN-135071

Fixed an issue in Panorama where the template stack drop-down was missing templates when using access domain. This issue is fixed only for existing template stacks.

## PAN-134907

Fixed an issue where IP tags were not evaluated in the filter evaluation criteria when Dynamic Address Groups were configured.

## PAN-134745

Fixed an issue where Panorama commits failed due to a process (useridd) running on high file descriptors as a large number firewalls connect to Panorama for User-ID redistribution.

## PAN-134226

Fixed an issue where **AdminStatus** for HA1 and High Speed Chassis Interconnect (HSCI) interfaces were incorrectly reported.

## PAN-133934

Fixed an intermittent issue where user-to-IP address mappings were not redistributed to client firewalls.

## PAN-131750

Fixed an issue where a configuration push from Panorama to the firewall showed the **Commit All** status as completed even though the job was still being processed.

## PAN-130955

Fixed an issue where templates on the secondary Panorama appliance were out of sync with the primary Panorama appliance due to an empty content-preview node.

## PAN-130389

```caveat
PA-220 firewalls only
```

Fixed an issue where rx-broadcast and rx-multicast interface counters were not increasing even broadcast and/or multicast traffic was being received.

## PAN-130357

Fixed a memory leak issue where virtual memory used by the SNMP process started to slowly increase when the request was sent with a request-id of 0.

## PAN-129376

```caveat
PA-800 Series firewalls only
```

Fixed an issue that prevented ports 9-12 from being powered down by hardware after being requested to do so.

## PAN-129234

Fixed an issue where syslog connection failures were frequently reported in system logs.

## PAN-128048

Fixed an issue where certificate-based authentication with IKEv2 IPSec tunnels failed to establish with some third-party vendors.

## PAN-126353

Fixed an issue where the XML API used to retrieve hardware status periodically failed with a 200 OK message and no data.

## PAN-125218

A fix was made to address an information exposure vulnerability in Panorama that disclosed the token for the Panorama web interface administrator's session to a managed device when the Panorama administrator performed a context switch ([CVE-2020-2022](https://security.paloaltonetworks.com/CVE-2020-2022)).

## PAN-124681

A fix was made to address a vulnerability where Ethernet packets on PA-200, PA-220, PA-500, PA-800, PA-2000 Series, PA-3000 Series, PA-3200 Series, PA-5000 Series, PA-5200 Series, and PA-7000 Series firewalls were not cleared before the data frame was created ([CVE-2021-3031](https://security.paloaltonetworks.com/CVE-2021-3031)).

## PAN-121035

Added support of high powered module PAN-QSFP28-100GBASE-ER4.

## PAN-120245

Fixed an issue on Panorama where WildFire cloud content download failed for content deployment to the WF-500 appliance.

## PAN-119982

Fixed an issue where template variable view failed to display some template variables when the **Device Priority** type variable was configured.

## PAN-115541

Fixed an issue where removing a cipher from an SSL/TLS profile did not take effect if it was attached to the management interface.

## PAN-112449

Fixed an issue that caused a daemon (snmpd) to hang when sending a Simple Network Management Protocol (SNMP) GET request for LcLogUsageTable on a Panorama appliance in Management Only mode.

## PAN-110423

Fixed an issue where mounting failure occurred and root partition reached 100%.

## PAN-110168

Fixed an issue where the firewall and Panorama web interface did not present HSTS headers to your web browser.

## PAN-103018

Fixed an issue where, when defining the match criteria for dynamic address groups on Panorama, the boolean AND/OR operators did not function properly.
