diff --git a/crawler/README.md b/crawler/README.md deleted file mode 100644 index 45bc46a..0000000 --- a/crawler/README.md +++ /dev/null @@ -1,261 +0,0 @@ -# Crawler: Common Crawl Ingestion Pipeline - -This folder contains a two-step ingestion pipeline that downloads Palo Alto release-note issue tables from Common Crawl snapshots, then converts those HTML tables into the markdown files consumed by this repository. - -The goal is to avoid repeatedly scraping live vendor pages while still keeping issue data current and reproducible. The HTML tables scraped from Common Crawl are not intended to be checked in to source control. - -## What This Crawler Does - -The crawler workflow has two stages: - -1. Download stage (Python) -- Script: code/crawl_cc.py -- Queries Common Crawl index data for PAN-OS release-note issue pages. -- Fetches archived WARC records from Common Crawl. -- Extracts the issue table HTML from each page. -- Stores one HTML table file per version/type in crawler/data. - -2. Process stage (Node.js) -- Script: code/process_issues.mjs -- Reads downloaded HTML table files. -- Reuses the existing parser/markdown generator from web/js. -- Writes markdown issue files to web/data/issues. - -After processing, you typically run scripts/update_products_from_issues.py to refresh product index mappings. - -## Why - -- Lower load on vendor infrastructure. -- Reproducibility by pinning to a crawl snapshot (for example CC-MAIN-2026-12). -- Repeatable local processing from downloaded artifacts. - -## Folder Structure - -crawler/ -- README.md This guide -- code/ - - crawl_cc.py Download issue table HTML from CC - - process_issues.mjs Convert table HTML into markdown files - - entry_points.json Product/branch entry points - - requirements.txt Python dependencies for downloader -- data/ - - CC-MAIN-2026-12/ - - PAN-OS/ - - 10.2.1-addressed.html - - 10.2.1-known.html - - ... - -Notes: -- data/ contents are gitignored. -- Each crawl snapshot is stored in its own top-level folder under data/. - -## Prerequisites - -Python -- Python 3.10+ recommended. -- Install downloader dependencies: - pip install -r crawler/code/requirements.txt - -Node.js -- Use project dependencies from root package.json. -- If needed: - npm install - -## Entry Points Configuration - -File: crawler/code/entry_points.json - -This file defines: -- Product key (currently PAN-OS). -- URL slug prefix used for version extraction. -- Branch entry points (release-note root pages). - -The downloader uses these entry points for branch-mode discovery. - -## Download Script: crawl_cc.py - -### What it does internally - -Branch mode: -1. Takes a branch entry point URL. -2. Converts it to the release-notes directory prefix. -3. Calls CC index with prefix matching to discover archived URLs. -4. Filters for URLs containing: -- -addressed-issues -- -known-issues -5. Deduplicates by URL and keeps the latest timestamp. -6. Downloads WARC slices via byte-range requests. -7. Extracts HTML and finds the issue table. -8. Writes output as: -- crawler/data///-.html - -Single URL mode: -- Accepts one issue-page URL. -- Tries URL normalization fallbacks (scheme and trailing slash variants). -- Falls back to parent prefix search if exact lookup misses. -- Downloads and saves one file when found. - -### Rate limiting and reliability - -Built-in request controls include: -- Minimum interval between HTTP requests. -- Retry logic for transient errors (429, 5xx). -- Skip-on-failure behavior so one bad record does not kill the whole branch. - -### CLI options - -Common options: -- --crawl - Common Crawl snapshot ID. - Default: CC-MAIN-2026-12 - -- --product - Product key from entry_points.json. - Default: PAN-OS - -- --min-request-interval - Minimum seconds between outbound CC requests. - Default: 1.0 - -Branch-mode options: -- --branch - Restrict to one branch from entry_points.json, such as 10.2. - -- --max-results - In branch mode, stop after N successful downloads. - Default: 0 (no limit). - This is ideal for safe smoke tests. - -Single-page option: -- --url - Download exactly one issue-page URL. - Useful for targeted debugging. - -### Example commands - -One-branch smoke test (download 1 successful file): -python crawler/code/crawl_cc.py --branch 10.2 --max-results 1 --min-request-interval 2.0 - -One-branch small run: -python crawler/code/crawl_cc.py --branch 10.2 --max-results 5 --min-request-interval 1.5 - -One specific page: -python crawler/code/crawl_cc.py --url https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-release-notes/pan-os-10-2-1-known-and-addressed-issues/pan-os-10-2-1-addressed-issues --min-request-interval 2.0 - -Full configured product run: -python crawler/code/crawl_cc.py --min-request-interval 1.5 - -## Processing Script: process_issues.mjs - -Script path: -- crawler/code/process_issues.mjs - -### What it does internally - -1. Reads HTML files in: -- crawler/data/// - -2. Expects file naming: -- -addressed.html -- -known.html - -3. Parses each table using existing project parser logic from web/js/process.js. - -4. Builds markdown using web/js/markdown.js. - -5. Writes output to: -- web/data/issues//addressed/_.md -- web/data/issues//known/_.md - -6. Adds source metadata in frontmatter: -- source: common-crawl -- crawl: - -7. Date behavior: -- Default output date is inferred from crawl ID (CC-MAIN-YYYY-WW -> ISO week start date). -- You can override with --date. - -### CLI options - -- --crawl - Crawl snapshot folder to read from. - Default: CC-MAIN-2026-12 - -- --product - Product folder under crawler/data//. - Default: PAN-OS - -- --date - Optional override for filename date suffix. - If omitted, date is derived from crawl ID when possible. - -### Example commands - -Process files from one crawl snapshot: -node crawler/code/process_issues.mjs --crawl CC-MAIN-2026-12 --product PAN-OS - -Process with explicit date override: -node crawler/code/process_issues.mjs --crawl CC-MAIN-2026-12 --product PAN-OS --date 2026-03-20 - -## Typical End-to-End Workflow - -1. Install dependencies: -- pip install -r crawler/code/requirements.txt -- npm install - -2. Download a small sample safely: -- python crawler/code/crawl_cc.py --branch 10.2 --max-results 1 --min-request-interval 2.0 - -3. Process downloaded HTML to markdown: -- node crawler/code/process_issues.mjs --crawl CC-MAIN-2026-12 --product PAN-OS - -4. Update products mapping: -- python scripts/update_products_from_issues.py - -5. Run tests: -- npm test - -## Recommended Testing Strategy - -Use these modes while iterating: -- Fast syntax check: - python -m py_compile crawler/code/crawl_cc.py - -- Safe download smoke test: - python crawler/code/crawl_cc.py --branch 10.2 --max-results 1 --min-request-interval 2.0 - -- Processing smoke test: - node crawler/code/process_issues.mjs --crawl CC-MAIN-2026-12 --product PAN-OS - -- Verify generated frontmatter quickly: - grep -R "^source:\|^crawl:" web/data/issues/PAN-OS | head - -## Troubleshooting - -No issue links found in branch mode -- Cause: release-note navigation is often JS-rendered and not available in archived HTML. -- Current behavior: branch mode uses CC prefix discovery directly, so this should be rare. - -No CC record for a specific URL -- Cause: URL canonicalization differences (slash/scheme/path form). -- Current behavior: single URL mode tries normalized variants and fallback prefix matching. - -Transient 503 or 429 errors from CC -- Increase --min-request-interval. -- Keep retries enabled (default behavior). -- Rerun; script skips failed pages and continues. - -No table found on a discovered page -- Some legacy pages may be non-standard or combined pages. -- Current behavior: page is skipped with a warning. - -Wrong date suffix in generated markdown -- By default, date is inferred from crawl ID. -- Pass --date if you intentionally want a different date. - -## Design Notes - -- The download stage stores raw extracted table artifacts, not final markdown. -- The process stage intentionally reuses existing parser logic to avoid drift from manual workflow. -- Source provenance is kept in markdown frontmatter using source and crawl keys. -- Each Common Crawl snapshot is isolated in its own data subfolder to support repeatability and comparison. diff --git a/crawler/code/crawl_cc.py b/crawler/code/crawl_cc.py deleted file mode 100644 index 4e7b1e9..0000000 --- a/crawler/code/crawl_cc.py +++ /dev/null @@ -1,472 +0,0 @@ -#!/usr/bin/env python3 -"""Download issue table HTML from Common Crawl for PA docs release note pages. - -Usage: - python crawl_cc.py [--crawl CC-MAIN-2026-12] [--product PAN-OS] [--branch 10.2] -""" - -import argparse -import gzip -import io -import json -import logging -import re -import sys -import time -from pathlib import Path -from urllib.parse import urlparse - -import requests -from bs4 import BeautifulSoup -from warcio.archiveiterator import ArchiveIterator - -CC_INDEX_URL = "https://index.commoncrawl.org/{crawl}-index" -CC_DATA_URL = "https://data.commoncrawl.org/{filename}" - -SCRIPT_DIR = Path(__file__).parent -DATA_DIR = SCRIPT_DIR.parent / "data" -ENTRY_POINTS_FILE = SCRIPT_DIR / "entry_points.json" -DEFAULT_MIN_REQUEST_INTERVAL = 1.0 - -_MIN_REQUEST_INTERVAL_SECONDS = DEFAULT_MIN_REQUEST_INTERVAL -_LAST_REQUEST_TS = 0.0 - -ISSUE_TYPE_SLUGS = { - "addressed": "-addressed-issues", - "known": "-known-issues", -} - - -def get_issue_type_from_url(url: str) -> str | None: - """Return issue type from the final path slug, not parent path segments.""" - slug = urlparse(url).path.rstrip("/").rsplit("/", 1)[-1] - for issue_type, suffix in ISSUE_TYPE_SLUGS.items(): - if slug.endswith(suffix): - return issue_type - return None - - -def load_entry_points(): - with open(ENTRY_POINTS_FILE) as f: - return json.load(f) - - -def set_request_rate_limit(min_interval_seconds: float) -> None: - global _MIN_REQUEST_INTERVAL_SECONDS - _MIN_REQUEST_INTERVAL_SECONDS = max(0.0, float(min_interval_seconds)) - - -def rate_limited_get(url: str, **kwargs): - global _LAST_REQUEST_TS - - if _MIN_REQUEST_INTERVAL_SECONDS > 0: - elapsed = time.monotonic() - _LAST_REQUEST_TS - sleep_for = _MIN_REQUEST_INTERVAL_SECONDS - elapsed - if sleep_for > 0: - time.sleep(sleep_for) - - response = requests.get(url, **kwargs) - _LAST_REQUEST_TS = time.monotonic() - return response - - -def query_cc_index(crawl: str, url: str) -> list[dict]: - """Query the CC index for all records matching *url* exactly. Returns [] if not found.""" - return _query_cc_index(crawl, url, match_type="exact") - - -def query_cc_index_prefix(crawl: str, prefix_url: str) -> list[dict]: - """Query the CC index for all records whose URL starts with *prefix_url*. - - Returns a flat list of all matching records (may be large). - """ - return _query_cc_index(crawl, prefix_url, match_type="prefix") - - -def _query_cc_index(crawl: str, url: str, match_type: str) -> list[dict]: - index_url = CC_INDEX_URL.format(crawl=crawl) - resp = rate_limited_get( - index_url, - params={"url": url, "matchType": match_type, "output": "json"}, - timeout=60, - ) - if resp.status_code == 404: - return [] - resp.raise_for_status() - records = [] - for line in resp.text.strip().splitlines(): - line = line.strip() - if line: - try: - records.append(json.loads(line)) - except json.JSONDecodeError: - continue - return records - - -def pick_latest_record(records: list[dict]) -> dict | None: - """Return the record with the most recent timestamp.""" - if not records: - return None - return max(records, key=lambda r: r.get("timestamp", "")) - - -def _url_candidates(url: str) -> list[str]: - stripped = url.rstrip("/") - with_slash = stripped + "/" - candidates = [stripped, with_slash] - - if stripped.startswith("https://"): - alt = "http://" + stripped[len("https://") :] - candidates.extend([alt, alt + "/"]) - elif stripped.startswith("http://"): - alt = "https://" + stripped[len("http://") :] - candidates.extend([alt, alt + "/"]) - - seen = set() - out = [] - for candidate in candidates: - if candidate not in seen: - seen.add(candidate) - out.append(candidate) - return out - - -def find_latest_record_for_url(crawl: str, url: str) -> dict | None: - """Find the latest CC record for a URL, with normalization fallbacks.""" - for candidate in _url_candidates(url): - record = pick_latest_record(query_cc_index(crawl, candidate)) - if record: - return record - - # Fallback: search the parent path with prefix match and pick the closest URL. - parent_prefix = url.rsplit("/", 1)[0] + "/" - slug = urlparse(url).path.rstrip("/").rsplit("/", 1)[-1] - pref_records = query_cc_index_prefix(crawl, parent_prefix) - if not pref_records: - return None - - candidates = [] - normalized_targets = set(_url_candidates(url)) - for rec in pref_records: - rec_url = str(rec.get("url", "")).split("?", 1)[0].split("#", 1)[0] - if rec_url in normalized_targets: - candidates.append(rec) - continue - rec_slug = urlparse(rec_url).path.rstrip("/").rsplit("/", 1)[-1] - if rec_slug == slug: - candidates.append(rec) - - return pick_latest_record(candidates) - - -def fetch_warc_record(filename: str, offset: int, length: int) -> bytes: - """Fetch a WARC record via HTTP range request and return the raw WARC bytes. - - Retries transient 5xx/429 failures a few times before giving up. - """ - url = CC_DATA_URL.format(filename=filename) - headers = {"Range": f"bytes={offset}-{offset + length - 1}"} - last_error = None - for attempt in range(1, 5): - try: - resp = rate_limited_get(url, headers=headers, timeout=60) - if resp.status_code in (429, 500, 502, 503, 504): - raise requests.HTTPError( - f"Transient HTTP {resp.status_code}", response=resp - ) - resp.raise_for_status() - return resp.content - except requests.RequestException as exc: - last_error = exc - if attempt == 4: - break - wait_seconds = attempt * 2 - logging.warning( - "Retrying WARC fetch (%d/4) after error for %s: %s", - attempt, - filename, - exc, - ) - time.sleep(wait_seconds) - - raise RuntimeError(f"Failed to fetch WARC record after retries: {filename}") from last_error - - -def extract_html_from_warc(warc_bytes: bytes) -> str | None: - """Extract the HTTP response body from a WARC record (handles gzip body encoding).""" - for record in ArchiveIterator(io.BytesIO(warc_bytes)): - if record.rec_type == "response": - body = record.content_stream().read() - # Handle Content-Encoding: gzip on the HTTP response body - encoding = "" - if record.http_headers: - encoding = record.http_headers.get_header("Content-Encoding", "").lower() - if "gzip" in encoding: - try: - body = gzip.decompress(body) - except Exception: - pass - # Determine charset from Content-Type - charset = "utf-8" - if record.http_headers: - ct = record.http_headers.get_header("Content-Type", "") - m = re.search(r"charset=([^\s;]+)", ct, re.I) - if m: - charset = m.group(1) - return body.decode(charset, errors="replace") - return None - - -def extract_version_from_slug(page_slug: str, slug_prefix: str) -> str | None: - """ - Extract a dotted version string from a PA docs page slug. - - Examples (slug_prefix='pan-os-'): - pan-os-10-2-1-addressed-issues -> 10.2.1 - pan-os-10-2-1-h3-addressed-issues -> 10.2.1-h3 - pan-os-10-2-known-issues -> 10.2 - """ - # Strip issue type suffix - stripped = page_slug - for suffix in ISSUE_TYPE_SLUGS.values(): - if stripped.endswith(suffix): - stripped = stripped[: -len(suffix)] - break - - # Strip product prefix - if stripped.startswith(slug_prefix): - stripped = stripped[len(slug_prefix):] - else: - return None - - if not stripped: - return None - - # Convert "10-2-1-h3" -> "10.2.1-h3" - parts = stripped.split("-") - numeric_parts = [] - remainder = [] - for part in parts: - if part.isdigit() and not remainder: - numeric_parts.append(part) - else: - remainder.append(part) - - if not numeric_parts: - return None - - version = ".".join(numeric_parts) - if remainder: - version += "-" + "-".join(remainder) - return version - - -def find_issue_table(html: str) -> str | None: - """ - Find the issue table in an HTML page. Prefers a table whose header row - contains both 'Issue ID' and 'Description'. Falls back to the first table. - """ - soup = BeautifulSoup(html, "html.parser") - for table in soup.find_all("table"): - header_text = " ".join( - th.get_text(separator=" ", strip=True) for th in table.find_all("th") - ).lower() - if "issue" in header_text and "description" in header_text: - return str(table) - table = soup.find("table") - return str(table) if table else None - - -def download_version_page( - record: dict, url: str, issue_type: str, slug_prefix: str, out_dir: Path -) -> bool: - """ - Download and save the issue table HTML for one version page. - Returns True on success, False if skipped. - """ - page_slug = urlparse(url).path.rstrip("/").rsplit("/", 1)[-1] - version = extract_version_from_slug(page_slug, slug_prefix) - if not version: - logging.warning("Could not extract version from URL %s — skipping", url) - return False - - out_file = out_dir / f"{version}-{issue_type}.html" - if out_file.exists(): - logging.info("Already downloaded %s", out_file.relative_to(DATA_DIR.parent)) - return False - - try: - warc_bytes = fetch_warc_record( - record["filename"], - int(record["offset"]), - int(record["length"]), - ) - except Exception as exc: - logging.warning("Could not fetch WARC for %s — skipping (%s)", url, exc) - return False - html = extract_html_from_warc(warc_bytes) - if not html: - logging.warning("Could not extract HTML from WARC for %s — skipping", url) - return False - - table_html = find_issue_table(html) - if not table_html: - logging.warning("No issue table found in %s — skipping", url) - return False - - out_dir.mkdir(parents=True, exist_ok=True) - out_file.write_text(table_html, encoding="utf-8") - logging.info("Saved %s", out_file.relative_to(DATA_DIR.parent)) - return True - - -def process_branch( - crawl: str, - product: str, - product_cfg: dict, - branch_cfg: dict, - max_results: int = 0, -) -> None: - branch = branch_cfg["branch"] - main_page = branch_cfg["main_page"] - slug_prefix = product_cfg.get("slug_prefix", "") - out_dir = DATA_DIR / crawl / product - - # Derive the release-notes directory URL for a prefix query. - # e.g. ".../pan-os/10-2/pan-os-release-notes/features-introduced-in-pan-os" - # -> ".../pan-os/10-2/pan-os-release-notes/" - notes_dir = main_page.rsplit("/", 1)[0] + "/" - - logging.info("=== Branch %s ===", branch) - logging.info("Querying CC index (prefix) for %s", notes_dir) - - all_records = query_cc_index_prefix(crawl, notes_dir) - if not all_records: - logging.warning("No CC records found under %s — skipping branch", notes_dir) - return - - # Deduplicate: keep the latest record per URL. - latest_by_url: dict[str, dict] = {} - for rec in all_records: - url = rec.get("url", "") - if url not in latest_by_url or rec.get("timestamp", "") > latest_by_url[url].get("timestamp", ""): - latest_by_url[url] = rec - - # Filter for issue pages. - issue_urls: dict[str, str] = {} - for url in latest_by_url: - issue_type = get_issue_type_from_url(url) - if issue_type: - issue_urls[url] = issue_type - - if not issue_urls: - logging.warning("No issue page URLs found under %s", notes_dir) - return - - selected_issue_items = sorted(issue_urls.items()) - if max_results > 0: - logging.info( - "Found %d issue page URLs (will stop after %d successful downloads)", - len(issue_urls), - max_results, - ) - else: - logging.info("Found %d issue page URLs", len(issue_urls)) - - successful_downloads = 0 - for url, issue_type in selected_issue_items: - if max_results > 0 and successful_downloads >= max_results: - break - try: - saved = download_version_page(latest_by_url[url], url, issue_type, slug_prefix, out_dir) - if saved: - successful_downloads += 1 - except Exception as exc: - logging.warning("Unexpected error while processing %s — skipping (%s)", url, exc) - - -def process_single_url(crawl: str, product: str, product_cfg: dict, url: str) -> None: - slug_prefix = product_cfg.get("slug_prefix", "") - out_dir = DATA_DIR / crawl / product - - issue_type = get_issue_type_from_url(url) - - if not issue_type: - logging.error( - "URL does not look like a known/addressed issue page: %s", - url, - ) - return - - record = find_latest_record_for_url(crawl, url) - if not record: - logging.warning("No CC record for %s (including normalized fallbacks)", url) - return - - download_version_page(record, url, issue_type, slug_prefix, out_dir) - - -def main(): - logging.basicConfig(level=logging.INFO, format="%(levelname)s %(message)s") - - parser = argparse.ArgumentParser( - description="Download PA docs issue tables from Common Crawl." - ) - parser.add_argument("--crawl", default="CC-MAIN-2026-12", help="Common Crawl index ID") - parser.add_argument( - "--product", - default="PAN-OS", - help="Product name (must match a key in entry_points.json)", - ) - parser.add_argument("--branch", help="Process only this branch (e.g. 10.2)") - parser.add_argument( - "--url", - help="Process exactly one issue page URL (must include -addressed-issues or -known-issues)", - ) - parser.add_argument( - "--min-request-interval", - type=float, - default=DEFAULT_MIN_REQUEST_INTERVAL, - help="Minimum seconds between HTTP requests to Common Crawl (default: 1.0)", - ) - parser.add_argument( - "--max-results", - type=int, - default=0, - help="When using entry-point branch mode, download only the first N discovered issue pages (0 = no limit)", - ) - args = parser.parse_args() - - set_request_rate_limit(args.min_request_interval) - logging.info("Using request rate limit: %.2f seconds/request", args.min_request_interval) - - entry_points = load_entry_points() - if args.product not in entry_points: - sys.exit(f"Product {args.product!r} not found in entry_points.json") - - product_cfg = entry_points[args.product] - - if args.url: - process_single_url(args.crawl, args.product, product_cfg, args.url) - return - - branches = product_cfg["branches"] - - if args.branch: - branches = [b for b in branches if b["branch"] == args.branch] - if not branches: - sys.exit(f"Branch {args.branch!r} not found for product {args.product!r}") - - for branch_cfg in branches: - process_branch( - args.crawl, - args.product, - product_cfg, - branch_cfg, - max_results=max(0, args.max_results), - ) - - -if __name__ == "__main__": - main() diff --git a/crawler/code/entry_points.json b/crawler/code/entry_points.json deleted file mode 100644 index 2c6d606..0000000 --- a/crawler/code/entry_points.json +++ /dev/null @@ -1,47 +0,0 @@ -{ - "PAN-OS": { - "slug_prefix": "pan-os-", - "branches": [ - { - "branch": "8.1", - "main_page": "https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-release-notes/pan-os-8-1-release-information" - }, - { - "branch": "9.0", - "main_page": "https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-release-notes/pan-os-9-0-release-information" - }, - { - "branch": "9.1", - "main_page": "https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-release-notes/pan-os-9-1-release-information" - }, - { - "branch": "10.0", - "main_page": "https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-release-notes/pan-os-10-0-release-information" - }, - { - "branch": "10.1", - "main_page": "https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-release-notes/features-introduced-in-pan-os" - }, - { - "branch": "10.2", - "main_page": "https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-release-notes/features-introduced-in-pan-os" - }, - { - "branch": "11.0", - "main_page": "https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-release-notes/features-introduced-in-pan-os" - }, - { - "branch": "11.1", - "main_page": "https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/features-introduced-in-pan-os" - }, - { - "branch": "11.2", - "main_page": "https://docs.paloaltonetworks.com/pan-os/11-2/pan-os-release-notes/features-introduced-in-pan-os" - }, - { - "branch": "12.1", - "main_page": "https://docs.paloaltonetworks.com/ngfw/release-notes/12-1/features-introduced-in-pan-os" - } - ] - } -} diff --git a/crawler/code/requirements.txt b/crawler/code/requirements.txt deleted file mode 100644 index 37d7a1f..0000000 --- a/crawler/code/requirements.txt +++ /dev/null @@ -1,3 +0,0 @@ -beautifulsoup4 -requests -warcio diff --git a/reference/PAN-OS/addressed/12.1.2.html b/reference/PAN-OS/addressed/12.1.2.html new file mode 100644 index 0000000..2cf3389 --- /dev/null +++ b/reference/PAN-OS/addressed/12.1.2.html @@ -0,0 +1,140 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-242777
+ 		+
+ Fixed an issue where users previously reported limitations due to + session count caps when utilizing + Web Proxy features on PA-5400 Series Firewalls. To + address these performance complaints and support higher traffic + volumes, we have increased the maximum session capacity on specific + PA-5400F series platforms, leveraging available + system memory. This update ensures greater capacity and stability for + high-volume environments. +
+
+ The supported session limits are: + +
+
+
+
+
+
+
+
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
PlatformMax Sessions
PA-541095K
PA-542095K
PA-543095K
PA-5440225K
PA-5445250K
PA-54501.28M
+
+
+
PAN-291499
+ 		+
+ (VM-Series firewalls on Amazon Web Services (AWS) environments + only) Fixed an issue where newly deployed firewalls were unable to + connect to the Strata Logging Service (SLS) until after a reboot, + license fetch, or management server restart. +
+
+
PAN-288726
+ 		+
+ Fixed an issue where the + useridd process stopped + responding due to a Security policy rule ID being set to 0, which + caused the last configuration retrieval to fail. +
+
+
PAN-287133
+ 		+
+ Fixed an issue on the Panorama web interface where assigning a policy + rule to a group at the top or bottom of the list changed the order of + other policy rules. +
+
diff --git a/reference/PAN-OS/addressed/12.1.3-h1.html b/reference/PAN-OS/addressed/12.1.3-h1.html new file mode 100644 index 0000000..364a606 --- /dev/null +++ b/reference/PAN-OS/addressed/12.1.3-h1.html @@ -0,0 +1,34 @@ + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-304195
+ 		+
+ Fixed an issue on the firewall where performing a private data reset + caused device telemetry to stop working. This issue also occurred + after performing a factory reset and then running the CLI command + set system ztp disable. +
+
diff --git a/reference/PAN-OS/addressed/12.1.3-h3.html b/reference/PAN-OS/addressed/12.1.3-h3.html new file mode 100644 index 0000000..69edf3e --- /dev/null +++ b/reference/PAN-OS/addressed/12.1.3-h3.html @@ -0,0 +1,90 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
—
+ 		+
+ A fix was made to address + CVE-2026-0227. +
+
+
PAN-306534
+ 		+
+ Fixed an issue were the + all_task + process repeatedly restarted due to memory pool corruption when + processing fragmented DNS over HTTPs (DoH) JSON queries. This occurred + due to incorrect buffer length calculations during memory deallocation + when the query name field spanned multiple packets. +
+
+
PAN-305480
+ 		+
+ Fixed an issue where the + pan_task + process stopped responding while processing DoH JSON format traffic + with DoH Security enabled, which caused missing cross-packet bytes in + the decoded DNS query type field, and the dataplane went down. +
+
diff --git a/reference/PAN-OS/addressed/12.1.3.html b/reference/PAN-OS/addressed/12.1.3.html new file mode 100644 index 0000000..4c8b5f8 --- /dev/null +++ b/reference/PAN-OS/addressed/12.1.3.html @@ -0,0 +1,180 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-300334
+ 		+
+ Fixed an issue where the ADEM plugin was not compatible with PAN-OS + 12.1.2, which prevented installation of the plugin and disabled the + ability to monitor remote sites on firewalls using the ADEM + functionality. +
+
+ To use this fix, you need the following compatible versions: ADEM + 1.1.0-h3 and SD-WAN plugin 3.4.0. +
+
+
PAN-298241
+ 		+
+ Fixed an issue where the NAT IP address pool was exhausted, which led + to intermittent connectivity issues with call applications and + outbound call failures. This occurred due to the firewall not properly + releasing NAT dynamic ports back to the address pool. +
+
+
PAN-296490
+ 		+
+ (FIPS CC mode enabled only) Fixed an issue + where Panorama on GCP rebooted every hour after upgrading to + 11.1.6-h10. +
+
+
PAN-289249
+ 		+
+ Fixed an issue where a memory leak occurred on the + reportd + process when a WildFire update was initiated while device telemetry + data collection was in progress. This resulted in an OOM condition. +
+
+
PAN-286576
+ 		+
+ Fixed an issue where the + all_pktproc + process restarted, which caused heartbeat failures to occur and a slot + to go down due to path monitor failure. +
+
+
PAN-272245
+ 		+
+ Fixed an issue where the + dnsproxy + process crashed due to memory corruption caused by a race condition + when the allow list downloading was impacted by config change. +
+
+
PAN-267450
+ 		+
+ Fixed an issue where the + reportd + process stopped responding with a SIGSEGV at + schedule_report_es_response. +
+
+
PAN-262831
+ 		+
+ (PA-5400f Series firewalls only) Fixed an + intermittent issue where the + all_task + process stopped responding, which caused the firewall to restart. +
+
diff --git a/reference/PAN-OS/addressed/12.1.4-h2.html b/reference/PAN-OS/addressed/12.1.4-h2.html new file mode 100644 index 0000000..82f105e --- /dev/null +++ b/reference/PAN-OS/addressed/12.1.4-h2.html @@ -0,0 +1,77 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-311938
+ 		+
+ Fixed an issue where autocommits failed after an upgrade due to + configuration memory allocation issues and 100% policy rule cache + usage when both DNS Rewrite and URL Custom Category Match were + configured. +
+
+
PAN-306451
+ 		+
+ (VM-Series firewalls on AWS environments only) + Fixed an issue where, after upgrading the firewall to an affected + release, GlobalProtect clients did not connect with IPSec and instead + connected using SSL due to traffic flow being disabled when checking + for health check packets. +
+
+
PAN-304496
+ 		+
+ Fixed an issue where, after unregistering an IP tag and registering a + different IP tag for the same IP address via XML API, the dynamic + address group membership was not updated on the dataplane, which + resulted in Security policy rules being enforced incorrectly. +
+
+
PAN-304195
+ 		+
+ Fixed an issue on the firewall where performing a private data reset + caused device telemetry to stop working. This issue also occurred + after performing a factory reset and then running the CLI command + set system ztp disable. +
+
diff --git a/reference/PAN-OS/addressed/12.1.4-h3.html b/reference/PAN-OS/addressed/12.1.4-h3.html new file mode 100644 index 0000000..eed2159 --- /dev/null +++ b/reference/PAN-OS/addressed/12.1.4-h3.html @@ -0,0 +1,59 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-313572
+ 		+
+ (VM-Series firewalls only) Fixed an issue where + the dataplane restarted due to a segmentation fault. +
+
+
PAN-300664
+ 		+
+ Fixed an issue on the Panorama and firewall web interface where + Applications pages became unresponsive after activating the SaaS + Inline license. +
+
+
PAN-292447
+ 		+
+ Fixed an issue where Panorama did not display data in the + Feature Adoption tab in Strata Cloud + Manager due to the system creating and deleting a CLI user for each + interval instead of reusing a permanent CLI user for telemetry. +
+
diff --git a/reference/PAN-OS/addressed/12.1.4.html b/reference/PAN-OS/addressed/12.1.4.html new file mode 100644 index 0000000..956b4f4 --- /dev/null +++ b/reference/PAN-OS/addressed/12.1.4.html @@ -0,0 +1,623 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
—
+ 		+
+ A fix was made to address + CVE-2026-0227. +
+
+
PAN-305480
+ 		+
+ Fixed an issue where the + pan_task + process stopped responding while processing DoH JSON format traffic + with DoH Security enabled, which caused missing cross-packet bytes in + the decoded DNS query type field, and the dataplane went down. +
+
+
PAN-305151
+ 		+
+ Fixed an issue where the configuration was not updated on the AI + Firewall in AWS after a successful configuration push from Strata + Cloud Manager (SCM). +
+
+
PAN-304195
+ 		+
+ Fixed an issue on the firewall where performing a private data reset + caused device telemetry to stop working. This issue also occurred + after performing a factory reset and then running the CLI command + set system ztp disable. +
+
+
PAN-304075
+ 		+
+ Fixed an issue where the firewall did not detect evasions due to TCP + checksum offloading not being enabled. +
+
+
PAN-303836
+ 		+
+ Resolved an issue in which intermittent session-table resets on the + AIRS VM triggered packet drops, leading to packet loss in egress + response traffic +
+
+
PAN-303700
+ 		+
+ Fixed an issue where GlobalProtect users were incorrectly dropped by + the default Security policy rule after upgrading to PAN-OS 12.1.2 when + IPv6 firewalling was disabled. This occurred due to policy rules + configured with geographic regions matching traffic incorrectly. +
+
+
PAN-303559
+ 		+
+ Fixed an issue where, after manuallly creating a device telemetry + bundle, the + hour_cli_output.txt file within + the bundle had a file size of 0 bytes. This occurred when checking the + bundle content after enabling device telemetry and setting the device + telemetry upload endpoint. +
+
+
PAN-302908
+ 		+
+ Fixed an issue where the firewall did not forward STP frames on Layer + 2 VLAN interfaces, which prevented the construction of loop-free + topologies with connected switches. +
+
+
PAN-301801
+ 		+
+ Fixed an issue on Log Collectors where the Elasticsearch process + fluctuated intermittently between green and red states, which led to + interruptions in log collection. This issue occurred when the number + of shards exceeded the cluster's maximum supported threshold of + greater than 1000 shards per Elasticsearch instance. +
+
+
PAN-301496
+ 		+
+ Fixed an issue where the DNS cache capacity was insufficient for + environments with a large number of FQDN address objects, which caused + the firewall to repeatedly send DNS requests for the same FQDN objects + even after it received valid responses. +
+
+
PAN-300837
+ 		+
+ Fixed an issue where firewalls experienced multiple reboots due to the + pan_task + process restarting with a SIGSEGV signal. This occurred because the + client-to-firewall side assumed TLS 1.3 for the firewall-server side. +
+
+
PAN-300372
+ 		+
+ (Panorama virtual appliances only) Fixed an + issue where maintenance mode was not accessible to do Factory Reset or + switch to FIPSCC mode. +
+
+
PAN-300096
+ 		+
+ Fixed an issue where a local commit on a firewall breaks template + stack overrides, preventing the enabling of LACP (Link Aggregation + Control Protocol). After a local commit, the LACP enable check was + unexpectedly unchecked, causing an outage. Attempting to re-enable + LACP through the web interface was unsuccessful, requiring manual + removal of the LACP configuration from the Panorama CLI. +
+
+
PAN-299815
+ 		+
+ Fixed an issue on multi-vsys firewalls where a host was not removed + from the quarantine list after receiving a redistribution message from + Panorama. This occurred when Panorama was configured to redistribute + quarantine messages to a firewall cluster, and the GlobalProtect + configuration and redistribution were built out in a vsys other than + vsys1. +
+
+
PAN-299678
+ 		+
+ Fixed an issue where the firewall repeatedly rebooted when downgrading + to an affected release. +
+
+
PAN-299193
+ 		+
+ Fixed an issue on the firewall where, after upgrading, autocommits + repeatedly failed until after a second reboot due to a timing issue + between content loading on the management plane card (MPC) and the log + receiver startup. +
+
+
PAN-298684
+ 		+
+ Fixed an issue where an Application Override policy rule was not + applied using an IPv4 source IP address with IPv6 enabled and + Network > + Zones > + Pre-NAT Identification enabled. +
+
+
PAN-298654
+ 		+
+ Fixed an issue where the firewall generated false positive threat logs + during updates to a large domain list (EDL) when a DNS lookup for a + domain being added or removed occurred during the update process. This + resulted in a threat log being generated for a different, unrelated + domain that remained on the list. +
+
+
PAN-298514
+ 		+
+ Fixed an issue where WildFire clusters operating in FIPS-CC mode were + not supported in earlier PAN-OS 12.1 releases. +
+
+
PAN-297972
+ 		+
+ Fixed an issue where a dataplane crash occurred when traffic matched + Inline Cloud Analysis prefiltering signatures, even when Inline Cloud + Analysis features were not enabled. +
+
+
PAN-297797
+ 		+
+ Fixed an issue where, during a refresh of a large External Dynamic + List (EDL), traffic that matched a domain on the list was incorrectly + identified as a different domain, which resulted in false positive + threat logs. +
+
+
PAN-297708
+ 		+
+ Fixed an issue where a long-lived session with many Machine Learning + (ML) model triggers caused a memory leak of feature states associated + with the ML model runs. This resulted in Spyware_State failure + increases, allocation max outs, and impaired policy matching. +
+
+
PAN-297005
+ 		+
+ Fixed an issue where exporting custom reports resulted in empty CSV + files. +
+
+
PAN-296635
+ 		+
+ Fixed an issue where the + reportd + process on passive Panorama management servers leaked memory due to + scheduled report handling from the Strata Logging Service (SLS). This + memory leak occurred daily, consuming available memory until the + process was restarted. +
+
+
PAN-296478
+ 		+
+ Fixed an issue where, after upgrading to PAN-OS 10.2.13-h10, + GlobalProtect Clientless VPN on PA-3250 firewalls failed to execute + JavaScript links, resulting in an authorization error. This occurred + because the firewall was incorrectly injecting text into URLs when + JavaScript buttons or dropdown menus were clicked within the + Clientless VPN portal. +
+
+
PAN-296453
+ 		+
+ Fixed an issue where decryption exclusion lists were not working for + untrusted certificates, and SSL sessions were still being decrypted + even after adding them to the exclusion list. This occurred because + the firewall was not adding sessions to the exclude cache until after + receiving a non-RFC alert (BadCertificate) from the server. The fix + ensures that the first session is added to the exclude cache, allowing + subsequent sessions to skip decryption. This issue affects firewalls + configured as clients in server-client communication. +
+
+
PAN-296202
+ 		+
+ (Firewalls in active/active HA configurations only) Fixed an issue where, when a commit operation was in progress, + newly deployed IP address tags that used the XML API were not + immediately reflected in address group resolution, which delayed IP + address mapping to address groups and caused traffic to be incorrectly + allowed or denied. +
+
+
PAN-295221
+ 		+
+ Fixed an issue where, after upgrading Panorama and Log Collectors from + PAN-OS 10.2.9 to PAN-OS 11.1.6-h6, Traffic and Threat logs were not + forwarded to a Splunk server over UDP. +
+
+
PAN-292393
+ 		+
+ Fixed an issue where TFTP file transfers intermittently timed out in + active-active HA pairs when the TFTP control channel was processed by + one firewall and the data channel was processed by the other. This + occurred because the firewall receiving the data channel failed to + match the predicted session due to asynchronous processing of HA + messages. +
+
+
PAN-291716
+ 		+
+ Fixed an issue where during a commit, the firewall experienced an + out-of-memory (OOM) condition due to a memory leak and displayed an + error message. This issue caused the device to stop responding and + reboot unexpectedly. +
+
+
PAN-291661
+ 		+
+ Fixed an issue on Panorama appliances and Log Collectors where, after + an upgrade, Elasticsearch intermittently entered into a Red state + before automatically recovering. +
+
+
PAN-290665
+ 		+
+ Fixed an issue with firewalls enabled with Security profiles where + certain traffic conditions caused high dataplane CPU utilization and + packet buffer exhaustion, which caused LACP flapping conditions. +
+
+
PAN-290640
+ 		+
+ (VM-Series firewalls on Microsoft Azure environments in HA + configurations only) Fixed an issue where, when an interface was configured with IPv6, + the firewall displayed the message + Unknown error during validation + after the client secret expired, which caused DNS resolution to fail + when resolving FQDNs and HA failovers to occur. +
+
+
PAN-290453
+ 		+
+ Fixed an issue where PA-7500 firewalls experienced silent traffic + drops. During migration from PA-7050 to PA-7500 firewalls connected in + series, intermittent connection losses occurred for some applications. + Traffic leaving the PA-7050 was not received or processed by the + PA-7500, even with direct connections and replaced cables/SFPs. Global + counters did not indicate any drops on the PA-7500. +
+
+
PAN-288598
+ 		+
+ Fixed an issue where Panorama exported the serial number of a managed + collector instead of the collector name when exporting a PDF or CSV + file. +
+
+
PAN-287387
+ 		+
+ Fixed an issue on Panorama where API jobs failed with the error + message + Server error: Timed out while getting config lock. This occurred due to slow set request performance when setting a + large number of address objects in a single set call. +
+
+
PAN-282640
+ 		+
+ Fixed an issue where custom reports showed incomplete data when + exported in CSV format from Panorama. +
+
+
PAN-274333
+ 		+
+ Fixed an issue where the Logging Service License Status displayed as + red even though a valid license was installed on the firewall. +
+
+
PAN-262353
+ 		+
+ Fixed an issue where, when Panorama was upgraded but log collectors + were on an earlier version, logs from a log collector group were not + viewable on a Panorama. +
+
diff --git a/reference/PAN-OS/addressed/12.1.5.html b/reference/PAN-OS/addressed/12.1.5.html new file mode 100644 index 0000000..f256050 --- /dev/null +++ b/reference/PAN-OS/addressed/12.1.5.html @@ -0,0 +1,5502 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-314142
+ 		+
+ Fixed an issue where establishing log forwarding connections to the + Strata Logging Service (SLS) took longer than expected, which resulted + in delayed log visibility on SLS. +
+
+
PAN-313572
+ 		+
+ (VM-Series firewalls only) Fixed an issue where + the dataplane restarted due to a segmentation fault. +
+
+
PAN-313258
+ 		+
+ Fixed an issue where PIM multicast routing failed on appliances with + advanced routing enabled. +
+
+
PAN-312706
+ 		+
+ Fixed an issue where the firewalls restarted due to a function lacking + a NULL-pointer sanity check. +
+
+
PAN-312618
+ 		+
+ Fixed an issue where the firewall was unable to activate GlobalProtect + client software and displayed + SW LIMIT messages related to + max-profiles and unsupported major and minor versions in the downgrade + list, which prevented successful software installation. +
+
+
PAN-311938
+ 		+
+ Fixed an issue where autocommits failed after an upgrade due to + configuration memory allocation issues and 100% policy rule cache + usage when both DNS Rewrite and URL Custom Category Match were + configured. +
+
+
PAN-311524
+ 		+
+ Fixed an issue where config-lock was not displayed on the web + interface. +
+
+
PAN-311087
+ 		+
+ Fixed an issue where, when the + request shutdown system CLI + command was executed, the firewall experienced a kernel panic and + automatically rebooted instead of shutting down +
+
+
PAN-311073
+ 		+
+ (Panorama managed firewalls in HA configurations only) Fixed an issue where firewalls incorrectly updated the modified + date and MD5 hash of policy rules during an HA sync commit job or a + subsequent local commit, even when no changes were made to the policy + rules. +
+
+
PAN-310499
+ 		+
+ Fixed an issue on Panorama where, while configuring an an Application + Filter with Generative AI tags, the web interface did not retain + application exclusions that were added across multiple pages until you + clicked OK. +
+
+
PAN-310402
+ 		+
+ Fixed an issue where SNMP returned an incorrect down status for HSCI + and logging interfaces even when the interfaces were up, and counters + for the interfaces displayed only zero values. +
+
+
PAN-309853
+ 		+
+ (Firewalls with FIPS-CC enabled only) Fixed an + issue where, when attempting to make changes to the GlobalProtect + portal, an error message was displayed and configuration updates + failed. +
+
+
PAN-309831
+ 		+
+ Fixed an issue where an AI Runtime Security Firewall rebooted when + processing Cursor traffic. +
+
+
PAN-309826
+ 		+
+ (VM-Series firewalls only) Fixed an issue where + files from SSL decrypted sessions were incorrectly forwarded to the + WildFire cloud for analysis even when + Allow Forwarding of Decryption Content + was disabled. +
+
+
PAN-309459
+ 		+
+ Fixed an issue where on PA-5420 firewalls, configuring security rules + with a number of static IMSI/IMEI/NSSAI entries exceeding 5,000 + resulted in a commit failure. This occurred because the firewall + incorrectly reported the maximum supported static IMSI/IMEI/NSSAI IDs + as 5,000 (as seen in the + cfg.mobile-nw-id.max-static-entries + system state variable), instead of the documented limit of 100,000 for + the platform. +
+
+
PAN-309392
+ 		+
+ Fixed an issue where the scroll bar did not appear when editing + Destination Addresses for Policy + Based forwarding policy rules. +
+
+
PAN-309379
+ 		+
+ Fixed an issue where the + logrcvr + process stopped responding on DPCs, which prevented logs from being + forwarded. +
+
+
PAN-309300
+ 		+
+ Fixed an issue where management plane system resources configuration + size exceeded 28 MB for over 4 hours, and the following error message + was displayed: + Configuration size reaching device capacity limit. +
+
+
PAN-309258
+ 		+
+ Fixed an issue where you were unable to delete a HIP object with + OR in the name, even though you were + able to successfully create and commit the object. +
+
+
PAN-309009
+ 		+
+ Fixed an issue where log ingestion stopped on the Elasticsearch + cluster when the number of open shards was significantly higher than + the number of data nodes. +
+
+
PAN-308786
+ 		+
+ (Panorama appliances only) Fixed an issue where + traffic log queries using the + device_name filter returned no + results, and complex log queries that included negation operators + produced incorrect outputs. +
+
+
PAN-308668
+ 		+
+ Fixed an issue on Prisma Access Remote Network firewalls where high + CPU utilization caused slowness and command timeouts. +
+
+
PAN-308654
+ 		+
+ Fixed an issue where the Elasticsearch Close Indices process closed + more indices than expected and dropped the number of open shards below + the minimum of 800 per Elasticsearch instance. This occurred because + the process did not correctly account for the number of Elasticsearch + instances when calculating the maximum number of allowed open shards. +
+
+
PAN-308606
+ 		+
+ Fixed an issue where traffic was blocked due to a mismatch between the + URL category specified in the Security policy rule and the URL filter + profile when custom URL categories with the same FQDN were configured. +
+
+
PAN-308305
+ 		+
+ Fixed an issue where, when you selected a signature policy rule in the + Anti-Spyware profile and clicked + Find Matching Signatures, the + automatically created filter was incorrect and prevented matching + signatures from being displayed. +
+
+
PAN-308188
+ 		+
+ Fixed an issue where, after a successful commit and push from + Panorama, the management interface SSH profile configuration was + missing or empty on Log Collectors. +
+
+
PAN-308085
+ 		+
+ (VM-Series firewalls in Microsoft Azure environments only) Fixed an issue where, after resizing the VM, the HA2 link became + unstable. Frequent keep-alive failures occurred, and HA2 keep-alive + packets were simultaneously transmitted to multiple destination MAC + addresses and the peer firewall's interface MAC). This issue occurred + on firewalls with Accelerated Networking enabled. +
+
+
PAN-308060
+ 		+
+ (Firewalls in active/active HA configurations only) Fixed an issue where the BFD session went down and did not recover + even though the BGP remained in an established state, which caused the + firewall to cease route learning and advertisement with the peer, even + though BGP keep-alives were exchanged correctly. +
+
+
PAN-307901
+ 		+
+ Fixed an issue where a leak in decryption counters caused resource + exhaustion, which led to a GlobalProtect service outage. +
+
+
PAN-307893
+ 		+
+ Fixed an issue where the Strata Cloud Manager (SCM) web interface + failed to fetch External Dynamic List (EDL) details from Prisma Access + and displayed the error message + Could not fetch the EDL main info. This occurred because the XML query returned an external list + authentication failed response when the EDL entry lacked a valid + certificate. +
+
+
PAN-307806
+ 		+
+ Fixed an issue where, after replacing the MPC (Management Processor + Card) on a firewall, the + logdb process incorrectly wrote + logs to the root partition instead of the /opt/panlogs partition, + which led to high root partition usage and a non-functional state. +
+
+
PAN-307795
+ 		+
+ Fixed an issue where Panorama incorrectly generated system logs + indicating a lost connection to its peer after an upgrade even when + High Availability was not configured. +
+
+
PAN-307773
+ 		+
+ Fixed an issue on Panorama where enabling Post-Quantum Pre-Shared Key + (PPK) within an IKE Gateway profile that was configured as a part of a + template stack failed or was inconsistent when attempted via the web + interface, even when the keys were properly configured. +
+
+
PAN-307714
+ 		+
+ VM-Series firewalls only) Fixed an issue where + insufficient i-node space was available on the sysroot0 partition. +
+
+
PAN-307702
+ 		+
+ (Firewalls in HA configurations only) Fixed an + issue where traffic passing through AE layer 2 interfaces was + interrupted during HA failovers. +
+
+
PAN-307597
+ 		+
+ Fixed an issue where BGP peering sessions between a hub firewall and a + satellite firewall over GlobalProtect LSVPN failed to connect. +
+
+
PAN-307481
+ 		+
+ Fixed a commit failure issue that occurred after migrating from Legacy + to Advanced routing on firewalls where an OSPF authentication profile + was configured to use a 16-character MD5 key with key-ID 10. +
+
+
PAN-307453
+ 		+
+ Fixed an issue for Panorama management servers where commit push + failed when + customer_info status was a + failure received from the + orchestrator, which prevented the system from processing and + validating the specified telemetry region correctly during the commit. +
+
+
PAN-307072
+ 		+
+ Fixed an issue where SNMP interface speed reporting incorrectly + identified 5Gbps interfaces as 1Gbps interfaces during an SNMP walk. +
+
+
PAN-307066
+ 		+
+ Fixed an issue where static DNS entries that were configured on the + firewall failed to resolve for client machines when DNS over TLS (DoT) + was enabled on the firewall DNS proxy for both client and server + settings. +
+
+
PAN-306934
+ 		+
+ Fixed an issue where traffic was unexpectedly blocked due to a + misconfiguration with an empty or invalid application filter. The + firewall incorrectly interpreted the empty filter as + match all cloud-apps, which caused + the traffic to be denied. +
+
+
PAN-306903
+ 		+
+ Fixed an issue on the firewall where, after upgrading, the system log + displayed the error message + Last config fetch FAILED. A commit is required for userid + functionality to work. +
+
+
PAN-306886
+ 		+
+ Fixed an issue where the root partition on the firewall or Panorama + management server filled up due to a file leak in the logging process. +
+
+
PAN-306884
+ 		+
+ Fixed an issue where after changing Panorama to logger mode, commits + failed due to the + panorama-admin role assigned to + plugin management configuration users. +
+
+
PAN-306533
+ 		+
+ Fixed an issue where system logging for NTP events was delayed by + approximately 15 minutes. +
+
+
PAN-306451
+ 		+
+ (VM-Series firewalls on AWS environments only) + Fixed an issue where, after upgrading the firewall to an affected + release, GlobalProtect clients did not connect with IPSec and instead + connected using SSL due to traffic flow being disabled when checking + for health check packets. +
+
+
PAN-306226
+ 		+
+ Fixed an issue where the TLS handshake did not complete and the + session did not go through. This occurred if the HTTP header insertion + applied to an HTTP CONNECT request passing through the firewall, the + scan-handshake feature was enabled, the session matched a decryption + policy rule with the decrypt action, and if the TLS client hello was + in a single packet and TLS 1.2 or below. +
+
+
PAN-306225
+ 		+
+ Fixed an issue on the firewall where the + sslmgr + process memory utilization continually increased due to memory + fragmentation. +
+
+
PAN-306215
+ 		+
+ Fixed an issue where creating device groups in bulk via XML API took + significantly more time and the web interface stopped responding. +
+
+
PAN-306103
+ 		+
+ (PA-3400 and PA-5400 Series firewalls only) + Fixed an issue where the firewall dataplane frequently restarted when + lockless QoS was enabled +
+
+
PAN-305922
+ 		+
+ Fixed an issue on Panorama where the CLI output for the running + configuration intermittently inserted + set template stack commands + within certificate hash data. +
+
+
PAN-305919
+ 		+
+ Fixed an issue where exporting an ML-DSA certificate with PKCS12 + resulted in an error file with the message + failed to process command. +
+
+
PAN-305874
+ 		+
+ Fixed an issue on the firewall where the output of the CLI commands + show running persistent-dipp-client pool + and + show running persistent-dipp-pool ip-utilization + displayed incorrect information or errors. This occurred due to the + command output including data from the network control dataplane. +
+
+
PAN-305835
+ 		+
+ Fixed an issue where firewalls with Memory Integrity Checking + Architecture enabled rebooted unexpectedly due to accessing an invalid + memory address. This occurred because the forwarding data structure + index exceeded its designed limit. +
+
+
PAN-305605
+ 		+
+ Fixed an issue where GlobalProtect gateway authentication failed due + to the firewall incorrectly bypassing SAML. +
+
+
PAN-305557
+ 		+
+ Fixed an issue where LSVPN (Large Scale VPN) satellites failed to + authenticate to the gateway because the portal was providing a + zeroized certificate. +
+
+
PAN-305552
+ 		+
+ Fixed an issue where DLP logs displayed an incorrect file type when + the firewall did not set the file type field. +
+
+
PAN-305549
+ 		+
+ Fixed an issue where the firewall's service route functionality was + impacted due to a missing service route support code. +
+
+
PAN-305502
+ 		+
+ Fixed an issue where Panorama was unable to forward logs to a syslog + server over TLSv1.3 when configured with SSL on a custom port. The + connection was established, but logs were not forwarded due to a + failure in the CRL check. +
+
+
PAN-305414
+ 		+
+ Fixed an issue on the web interface where checkboxes displayed as text + fields for Post-Quantum Cryptography (PQC) settings and Preferred + Session Settings, which prevented users from enabling PQC features via + the web interface. +
+
+
PAN-305412
+ 		+
+ Fixed an issue where the Logging Service License Status displayed a + license failure when the license status transitioned from valid to + expired and then back to valid even when the connection to the + Security Logging Service (SLS) was working. +
+
+
PAN-305411
+ 		+
+ Fixed an issue where, after creating a logical interface with an + assigned IP address and adding it to a virtual router, the connected + route for the interface did not appear in the + show routing route CLI command + output. This occurred even when the interface was up and learning ARP + entries. +
+
+
PAN-305374
+ 		+
+ Fixed an issue on Panorama where the first letter of a custom URL + category was not displayed in generated reports. +
+
+
PAN-305301
+ 		+
+ Fixed an issue where the timing of GlobalProtect lifetime expiry or + inactivity logout notifications used for GlobalProtect SSL tunnels + could cause the + pan_task + process to stop responding and the dataplane to restart. +
+
+
PAN-305188
+ 		+
+ Fixed an issue where TLS connections failed to establish in asymmetric + routing environments if the Client Hello was split into multiple + segments and arrived out of order. +
+
+
PAN-305105
+ 		+
+ Fixed an issue where commits involving routing related network + configuration changes experienced slower than usual completion times + or remaining at 20% completion. +
+
+
PAN-304840
+ 		+
+ Fixed an issue where multiple firewalls experienced high management + CPU utilization after upgrading to an affected release due to repeated + index regeneration occurring every 15 minutes, which caused periodic + CPU spikes above 90%. +
+
+
PAN-304756
+ 		+
+ Fixed an issue on Panorama where, after you disabled the shared + optimization feature, a full configuration push to multi-vsys devices + caused a validation error. +
+
+
PAN-304746
+ 		+
+ (Panorama appliances and Panorama virtual appliances only) Fixed an issue where the + configd + process restarted when committing and pushing configuration for a new + WildFire cluster. +
+
+
PAN-304718
+ 		+
+ Fixed an issue where OSPF and BGP outages occurred due to an + all_task + process restart during clientless VPN content rewrite processing. +
+
+
PAN-304696
+ 		+
+ Fixed an issue where the Cloud User-ID connection timed out because + the firewall took too long to process the OCSP response. +
+
+
PAN-304689
+ 		+
+ Fixed an issue on Panorama where device group users were able to view + and commit configuration changes that had been created by Superusers + but not yet committed, even with access domains configured. +
+
+
PAN-304636
+ 		+
+ Fixed an issue where BGP aggregate routes were not created and discard + routes were not installed in the routing table. +
+
+
PAN-304576
+ 		+
+ Fixed an issue where the firewall entered a non-functional state due + to segmentation fault within the + all_pktproc + process that was caused by a session that involved http2 cleartext + traffic. +
+
+
PAN-304538
+ 		+
+ Fixed an issue where traffic logs did not populate the + Source EDL or + Destination EDL fields when traffic + matched a Security policy rule that used predefined external dynamic + lists. +
+
+
PAN-304496
+ 		+
+ Fixed an issue where, after unregistering an IP tag and registering a + different IP tag for the same IP address via XML API, the dynamic + address group membership was not updated on the dataplane, which + resulted in Security policy rules being enforced incorrectly. +
+
+
PAN-304397
+ 		+
+ Fixed an issue on the web interface where you were unable to test the + SCP server connection for Scheduled Log Exports, and the error message + key is invalid was displayed. +
+
+
PAN-304229
+ 		+
+ Fixed an issue on the Panorama web interface where you were unable to + disable Lifesize (Templates > Network > Network Profiles > IPSec + Crypto). +
+
+
PAN-304205
+ 		+
+ Fixed an issue on Panorama where, after upgrading to an affected + release, a partial commit via the API did not push configuration + changes to managed firewalls, and a full commit was required to + synchronize the configuration. +
+
+
PAN-304177
+ 		+
+ Fixed an issue where the web interface became unresponsive when you + attempted to modify Security policy rule items if the source-hip or + destination-hip settings were not already configured, and the web + interface did not display a relevant error message. +
+
+
PAN-304148
+ 		+
+ Fixed an issue where a large number of GlobalProtect users experienced + failed gateway pre-logins with the error + Failed to create SAML SSO request + during peak login times. +
+
+
PAN-303959
+ 		+
+ Fixed an issue where traffic was incorrectly identified as + unknown-tcp/unknown-udp due to App-ID resource leak and eventually + dropped. +
+
+
PAN-303954
+ 		+
+ Fixed an issue where, when configuring Safenet HSMs in HA and + authentication HSM manually, the second HSM server failed to + authenticate due to the firewall overwriting the first HSM server's + certificate with the second HSM server's certificate. +
+
+
PAN-303836
+ 		+
+ Fixed an issue where intermittent session-table resets on the AIRS VM + triggered packet drops, which led to packet loss in egress response + traffic. +
+
+
PAN-303833
+ 		+
+ Fixed an issue where Panorama and managed devices incorrectly + displayed warning messages that indicated that an Advanced DNS + Security license and an Advanced Threat Prevention license were + required, even when a traditional DNS Security license was installed. +
+
+
PAN-303826
+ 		+
+ Fixed an issue where scheduled software upgrades from the Software + Change Management (SCM) server to the firewall failed with a timeout + error during download. +
+
+
PAN-303791
+ 		+
+ Fixed an issue where configuring a service route on a loopback + interface caused intermittent connectivity issues and disrupted + traffic due to the firewall being unable to resolve domain names. +
+
+
PAN-303765
+ 		+
+ Fixed an issue on Panorama where selective pushes failed when a + scheduled job was deleted from the Panorama configuration. +
+
+
PAN-303745
+ 		+
+ Fixed an issue where inter-dataplane forwarding did not work for + sessions ingressing on Slot 2, which resulted in intermittent ping + failures to interfaces on Network Card 2 when traffic was forwarded to + Slot 3. +
+
+ Note: With this fix, after a slot restart, the + global counter will still show dot1q errors for a short period. +
+
+
PAN-303737
+ 		+
+ Fixed an issue where XML API commands failed with a + Method not found (policy_xml) + error in dagger.log. The issue was due to session-distribution + commands in dagger files handling. +
+
+
PAN-303722
+ 		+
+ Fixed an issue on the firewall where configuring spyware and + vulnerability profiles in Security policy rules caused a memory leak + in the + devsrvr + process with each configuration commit. +
+
+
PAN-303700
+ 		+
+ Fixed an issue where GlobalProtect users were incorrectly dropped by + the default Security policy rule after upgrading to PAN-OS 12.1.2 when + IPv6 firewalling was disabled. This occurred due to policy rules + configured with geographic regions matching traffic incorrectly. +
+
+
PAN-303671
+ 		+
+ Fixed an issue where third-party clients were unable to connect to the + GlobalProtect gateway after a successful login when the username was + entered in the domain\username format. +
+
+
PAN-303663
+ 		+
+ Fixed an issue on the firewall where SolarWinds monitoring systems + reported 100% usage for + Slot1 Data Processor-0 Hardware Packet Buffers + due to an inaccurate reported packet buffer. +
+
+
PAN-303662
+ 		+
+ Fixed an issue where PA-455 firewalls running PAN-OS 11.2.4-h7 + intermittently failed to generate system logs and trigger an HA + failover when a link-monitored interface was unplugged, despite the + interface's status being reflected as down on the GUI. +
+
+
PAN-303627
+ 		+
+ Fixed an issue where, after committing a configuration change, the + firewall experienced traffic issues, + pan_task + crashes, and LACP interface failures. +
+
+
PAN-303508
+ 		+
+ Fixed an issue where the firewall failed to fetch the device + certificate during initial installation. +
+
+
PAN-303487
+ 		+
+ Fixed an issue where Panorama appliances in FIPS-CC mode did not push + the configured values for + max-session-count and + max-session-time to managed + firewalls that were not in FIPS mode. +
+
+
PAN-303390
+ 		+
+ Fixed an issue on the firewall where the DNS cache capacity was set to + an incorrect value, which caused the firewall to repeatedly send DNS + requests for FQDN objects even after receiving valid responses. This + resulted in the firewall not storing DNS responses in the cache for + more than 10-15 seconds despite the minimum FQDN refresh interval + being set to a higher value. +
+
+
PAN-303379
+ 		+
+ Fixed an issue where the + show system resources CLI command + displayed incorrect CPU usage values that did not add up to 100%. +
+
+
PAN-303156
+ 		+
+ Fixed an issue where the session timer for a custom application did + not transition from the initial 3-way handshake timer to the + application timeout when out-of-order 3-way handshake packets were + detected. +
+
+
PAN-303064
+ 		+
+ Fixed an issue where, when a new tunnel interface was added to PIM + (Network > Logical Router > multicast > pim > + interfaces), commits were successful, but the new tunnel interface was not + successfully added under PIM. +
+
+
PAN-303051
+ 		+
+ Fixed an issue on Panorama where a memory leak occurred related to the + reportd + process due to retaining memory that was temporarily used for report + generation instead of releasing the memory for reuse, which resulted + in continuous accumulation and memory exhaustion. +
+
+
PAN-302983
+ 		+
+ Fixed an issue where, after committing changes on Panorama, a shared + post-rule moved to the end of the + post shared rulebase on the + managed device instead of remaining at the top. +
+
+
PAN-302921
+ 		+
+ Fixed an issue where the + set auth radius-require-msg-authentic yes + and + show auth radius-require-msg-authentic + CLI commands were unavailable on Log Collectors. +
+
+
PAN-302908
+ 		+
+ Fixed an issue where the firewall did not forward STP frames on Layer + 2 VLAN interfaces, which prevented the construction of loop-free + topologies with connected switches. +
+
+
PAN-302834
+ 		+
+ Fixed an issue where Panorama did not display decryption logs after a + certain date due to the decryption index being purged. +
+
+
PAN-302811
+ 		+
+ (Firewalls in HA configurations only) Fixed an + issue where network traffic was disrupted due to the + all_pktproc + process repeatedly restarting, which caused an HA failover. +
+
+
PAN-302790
+ 		+
+ Fixed an issue where, with Sender Side Loop Detection enabled, BGP + WITHDRAWAL updates were not sent to peers after a route was removed, + which caused stale routes to persist in the BGP table of neighboring + firewalls. +
+
+
PAN-302737
+ 		+
+ Fixed an issue where API key generation failed after renewing an + expired API certificate, and the system continued to use the expired + certificate. +
+
+
PAN-302567
+ 		+
+ Fixed an issue where firewalls incorrectly returned the message + API Error: Success with the error + code 403 instead of the correct message + API Error: Invalid Credential, when + Cisco-ISE server was used for MSCHAP-PEAP Radius auth. +
+
+
PAN-302564
+ 		+
+ Fixed an issue on the firewall where a path monitoring failure + occurred and caused the dataplane to restart. +
+
+
PAN-302551
+ 		+
+ Fixed an issue where the firewall displayed as disconnected in the SLS + due to the serial number not being retrieved +
+
+
PAN-302471
+ 		+
+ Fixed an issue where the firewall rebooted unexpectedly due to a + missed null pointer check when certification verification was enabled + in a no-decrypt case. This occurred when either + block sessions with untrusted issuers + or + block sessions with expired certificates + was enabled in the decryption profile. +
+
+
PAN-302428
+ 		+
+ Fixed an issue on Panorama where daily scheduled report emails for + custom reports were delivered with no content and instead incorrectly + displayed the message + No matching data found. With this + fix, the content is displayed correctly. +
+
+
PAN-302387
+ 		+
+ Fixed an issue where on PA-7500 firewalls, SNMP incorrectly reported + the administrative and operational status of High Speed Chassis + Interconnect (HSCI) interfaces as down, even when the interfaces were + physically up. Additionally, interface counters for these interfaces + displayed all zeroes. +
+
+
PAN-302254
+ 		+
+ Fixed an issue where the web interface made calls to retrieve cloud + authentication service regions even when creating a non-cloud + authentication service profile. +
+
+
PAN-302196
+ 		+
+ Fixed an issue where the dataplane stopped responding when cleaning up + expired sessions currently in MICA ATP hold mode. +
+
+
PAN-302127
+ 		+
+ (Firewalls in active/active HA configurations only) Fixed an issue where adding a 26th floating IP address to an + aggregate ethernet interface in one vsys caused IPSec tunnels on + another vsys to stop working due to rekeying. This occurred due to the + routed + process not detecting the unchanged virtual address, uninstalling it, + and then reinstalling it, which ended the + ikemgr + connection on the virtual address. +
+
+
PAN-302085
+ 		+
+ Fixed an issue where network values were not displayed in Panorama + with the error message + There is no value for the selected item. This was due to the device group passing vsysName in Panorama. +
+
+
PAN-302073
+ 		+
+ Fixed an issue on Panorama where the override icon in + Agent Config did not change to the + revert icon after reverting a configuration change in a + template-stack. +
+
+
PAN-301975
+ 		+
+ (Firewalls in HA configurations only) Fixed an + issue where the passive firewall incorrectly triggered PBP alerts even + with low packet rates. +
+
+
PAN-301965
+ 		+
+ Fixed an issue on Panorama where enabling Advanced Routing in a + template did not work. +
+
+
PAN-301912
+ 		+
+ Fixed an issue where Panorama stopped responding when deploying + dynamic updates to managed devices. +
+
+
PAN-301848
+ 		+
+ Fixed an issue where websites were incorrectly categorized with high + severity alerts (Monitoring > URL Filtering) even though they were assessed as low risk. This occurred due to + session information being unavailable during logging. +
+
+
PAN-301733
+ 		+
+ Fixed an issue where the + show cloud-auth-service-regions + CLI command took longer than expected to complete due to timeouts + while fetching Cloud Authentication Service (CAS) regions. +
+
+
PAN-301691
+ 		+
+ Fixed an issue where BGP stopped responding with the error message + Too many open files when pushing + 1000 eBGP (External BGP) neighbor configurations. With this fix, the + number of file descriptors for the BGP process is increased from 1024 + to 8192. +
+
+
PAN-301653
+ 		+
+ Fixed an issue where DNS traffic sessions prematurely terminated with + the message + resources-unavailable. This + occurred due to IPv4 fragmented DNS responses causing the Advanced DNS + Security module to incorrectly pack the DNS payload multiple times + when forwarding to the cloud for inspection. +
+
+
PAN-301600
+ 		+
+ Fixed an issue on the firewall where, after an upgrade, OSPF + adjacencies remained in the exchange state, which resulted in an + incomplete routing table. +
+
+
PAN-301496
+ 		+
+ Fixed an issue where the DNS cache capacity was insufficient for + environments with a large number of FQDN address objects, which caused + the firewall to repeatedly send DNS requests for the same FQDN objects + even after it received valid responses. +
+
+
PAN-301456
+ 		+
+ Fixed an issue on Panorama where the + debug system reset-ztp CLI + command was unavailable. +
+
+
PAN-301430
+ 		+
+ Fixed an issue where the web server did not specify the content type + in the header for font files, which could allow a browser to + misinterpret the content and potentially lead to cross-site scripting + (XSS) vulnerabilities. +
+
+
PAN-301409
+ 		+
+ Fixed an issue where Panorama failed to perform a selective push to a + managed device when device tags were added or modified on the policy + rules. The selective push failed with the error message + Failed to generate selective push configuration. Schema validation + failed. Please try a full push. +
+
+
PAN-301386
+ 		+
+ Fixed an issue where BFD echo packets were dropped on Vwire interfaces + due to being incorrectly detected as a land attack when the source and + destination ports of the BFD packets were different. +
+
+
PAN-301305
+ 		+
+ (Firewalls in HA configurations only) Fixed an + issue where the + all_task + process stopped responding and caused the passive firewall to reboot. +
+
+
PAN-301290
+ 		+
+ Fixed an issue on the Panorama web interface where a custom + administrator with device group and template permissions was unable to + upgrade devices to non-preferred releases due to the options to + uncheck base and preferred releases not being displayed. +
+
+
PAN-301222
+ 		+
+ Fixed an issue where DNS Security logs incorrectly displayed a + sinkhole action for benign DNS categories due to the firewall saving + the drop or sinkhole action in session flags without discarding the + session. +
+
+
PAN-301186
+ 		+
+ Fixed an issue on the Panorama web interface where + Enable pushing device monitoring data to Panorama + was always checked, regardless of the actual configuration. +
+
+
PAN-301113
+ 		+
+ Fixed an issue where the XML API returned the error + Access to this vsys is unauthorized + when generating a report for a specific vsys, even when the + administrator had access to that vsys. This was due to the API session + not correctly populating the + vsysvector field with the user's + allowed vsys. +
+
+
PAN-301089
+ 		+
+ Fixed an issue where Kubernetes pod health checks failed when the + pan-fw annotation was added. When the annotation was present, health + check traffic from the host's public IP address range to the pod CIDR + range was tunneled to the firewall by the pan-cni, which resulted in + asymmetric flows and no response from the pod endpoints. +
+
+
PAN-301018
+ 		+
+ Fixed an issue on Panorama where API queries for correlated category + logs incorrectly returned a count of 0. +
+
+
PAN-300922
+ 		+
+ Fixed an issue where the syslog connection was handled by the syslog + forwarding thread. +
+
+
PAN-300916
+ 		+
+ Fixed an issue where Panorama management servers failed to forward + syslog messages via TLS to a syslog server when DNS resolution for + IPv6 addresses failed, and the system did not automatically fall back + to IPv4. +
+
+
PAN-300906
+ 		+
+ Fixed an issue where XML API commands failed with a + Method not found (policy_xml) + error in dagger.log. The issue was due to missing XML-related + functions for inline-cloud-proxy. +
+
+
PAN-300671
+ 		+
+ Fixed an issue where traffic reports that were generated with + destination/source and destination/source hostnames were not displayed + in IPv4 format. +
+
+
PAN-300664
+ 		+
+ Fixed an issue on the Panorama and firewall web interface where + Applications pages became unresponsive after activating the SaaS + Inline license. +
+
+
PAN-300638
+ 		+
+ (VM-Series firewalls only) Fixed an issue where + the firewall stopped responding due to an out-of-bounds read when + parsing TLS 1.3 clientHello messages with large TLS clientHello + extensions where the + supported_versions extension fell + outside the first TCP segment. +
+
+
PAN-300637
+ 		+
+ (VM-Series firewalls on Microsoft Azure environments only) Fixed an issue where the firewall unexpectedly rebooted due to + repeated + varrcvr + process restarts. +
+
+
PAN-300617
+ 		+
+ Fixed an issue where the Elasticsearch cluster status displayed as red + due to unassigned shards, which prevented logs from updating. +
+
+
PAN-300612
+ 		+
+ (PA-7500 firewalls only) Fixed an issue where + the firewall incorrectly reported the speed of 400G interfaces as 1G + when queried using SNMP +
+
+
PAN-300555
+ 		+
+ (Firewalls in HA configurations only) Fixed an + issue where the HA1-A interface reported an incorrect SNMP down value + even when the interface was physically up on the active firewall. +
+
+
PAN-300548
+ 		+
+ Fixed an issue where using the IKEv2 multiplier setting for VPN + re-authentication resulted in the firewall not re-authenticating at + the expected intervals when both sides initiated rekeying. The + internal re-authentication counter incremented when the local side + triggered the rekey, but not when the peer side triggered it. +
+
+
PAN-300423
+ 		+
+ Fixed an issue where Data Processing Cards (DPCs) installed in slots 5 + and 6 remained stuck in a starting state with the error + Signal detected for port xeS5-DP0 but Link Down + alerts, which resulted in device instability. +
+
+
PAN-300280
+ 		+
+ Fixed an issue where, on firewalls configured as an Area Border Router + (ABR) with a backbone area (0.0.0.0) and a stub area, external Type-5 + Link State Advertisement (LSA) routes were not installed in the + routing table. +
+
+
PAN-300227
+ 		+
+ Fixed an issue where the firewall dropped packets due to the incoming + flow being hashed to a flow bucket that was full. +
+
+
PAN-300216
+ 		+
+ Fixed an issue where, when SD-WAN Direct Internet Access was + configured and traffic traversed the cellular interface without a NAT + policy rule, intermittent cellular modem connectivity issues occurred, + which caused the firewall to disconnect and reconnect to the cellular + network. +
+
+ To use this fix, run the CLI command + set session teardown-upon-fwd-zonechange yes. +
+
+
PAN-300186
+ 		+
+ Fixed an issue where the GlobalProtect portal exposed the internal IP + address of the gateway when accessed via the SAML20/SP/ACS endpoint. +
+
+
PAN-300138
+ 		+
+ Fixed an issue where DNS queries stalled or repeatedly time out due to + multiple DNS responses with different CNAME values causing evasion + false positive alerts. +
+
+
PAN-300055
+ 		+
+ Fixed an issue where the firewall experienced high disk utilization in + the /opt/pancfg/mgmt/content-preview directory due to older content + data not being automatically removed when an error occurred during the + process. +
+
+
PAN-299915
+ 		+
+ Fixed an issue where the Elasticsearch cluster health status displayed + as red on dedicated log collectors due to an expired Elasticsearch CC + certificate, which prevented log visibility from Panorama. +
+
+
PAN-299910
+ 		+
+ Fixed an issue where unintended ARP packets were sent out from the + dataplane interface when the service route setting for DNS was + configured to use that interface. +
+
+
PAN-299785
+ 		+
+ (PA-7500 and PA-5450 firewalls in FIPS-CC mode) + Fixed an issue where the affected firewalls would boot into + maintenance mode when a reboot was initiated from the web interface. + This was due to a device reboot triggering a power down to all slots, + leading to maintenance mode. A hard reboot would allow the firewall to + boot normally. +
+
+
PAN-299772
+ 		+
+ (VM-Series firewalls in active/passive configurations only) Fixed an issue where, after an HA failover event, the newly active + firewall DHCP client interfaces failed to obtain IP addresses + automatically. This occurred because the DHCP client processes did not + initiate the necessary DHCP discover or renew requests +
+
+
PAN-299757
+ 		+
+ Fixed an issue where Router Advertisements for IPv6 were not sent at + the configured time intervals. +
+
+
PAN-299751
+ 		+
+ Fixed an issue where the firewall was unable to connect to the + Subscription License Service (SLS) due to a public and private key + pair mismatch with the device certificate. +
+
+
PAN-299738
+ 		+
+ Fixed an issue where excessive dataplane debug logs were generated due + to the + pan_task + process restarting, even without any dataplane debug logs or captures + being enabled by the administrator. +
+
+
PAN-299706
+ 		+
+ Fixed an issue where the firewall repeatedly sent DNS requests for + FQDN objects despite even after receiving valid responses. +
+
+
PAN-299705
+ 		+
+ Fixed an issue where API calls to commit changes on Panorama + intermittently failed when using the XML API with refresh=no, which caused changes to not be applied to the partial-commit + configuration. +
+
+
PAN-299623
+ 		+
+ (Panorama appliances in Management Only mode only) Fixed an issue where the firewall incorrectly allowed access to the + web interface on a blocked port. Additionally, after configuring a + custom certificate, Panorama continued to present the self-signed + certificate on the blocked port. +
+
+
PAN-299622
+ 		+
+ Fixed an issue where the MFA timestamp was not redistributed between + standalone firewalls behind an Azure load balancer after upgrading, + which resulted in users being prompted to reauthenticate multiple + times. +
+
+
PAN-299615
+ 		+
+ Fixed an issue where, when the Network Packet Broker feature was + enabled, forward TLS (non-decrypted) traffic was not working as + expected when there were segmented client hellos and a no-decrypt rule + existed. This issue occurred when Zone Protection profiles were + configured for trust/untrust zones but not attached to NPB zones. +
+
+
PAN-299495
+ 		+
+ Fixed an issue where the + show system setting ssl-decrypt certificate + CLI command did not display certificates when XML output was enabled. +
+
+
PAN-299450
+ 		+
+ Fixed an issue where PAN-OS + logrotate did not rotate large + log files until the + cron.daily + process ran, which resulted in the root partition filling up. +
+
+
PAN-299242
+ 		+
+ Fixed an issue where the firewall's SSL proxy sent an empty HTTP2 + SETTINGS message to the client before confirming server support, which + caused some clients to incorrectly assume HTTP/2 support and not fall + back to HTTP/1.1. Additionally, the firewall dropped HTTP1.1 400 Bad + Request frames from the server, which prevented the client from + correctly detecting the lack of HTTP/2 support. +
+
+
PAN-299228
+ 		+
+ Fixed an issue where a session process consumed excessive CPU + resources, even when Data Loss Prevention (DLP) was not enabled. This + occurred due to the active threat list being iterated twice when + active threats were present in the session. +
+
+
PAN-299161
+ 		+
+ Fixed an issue where the bytes number overflowed for a specific + application, which caused Network Monitor graphs to display an + unexpectedly large volume of traffic. +
+
+
PAN-299027
+ 		+
+ (Panorama virtual appliances in Management Mode only) Fixed an issue where a maximum configuration size of 120 was + incorrectly enforced instead of 150 MB. +
+
+
PAN-298945
+ 		+
+ Fixed an issue where OSCP HTTP POST requests were not formatted + correctly, which caused failures with strict responders. +
+
+
PAN-298929
+ 		+
+ (Firewalls in HA configurations only) Fixed an + issue where, after upgrading the ESXi host to version 8.0.3, the + firewall interface went down on the active firewall due to a behavior + change in ESXi 8. +
+
+
PAN-298907
+ 		+
+ Fixed an issue on PA-VM in AWS where, in a two-arm deployment + integrated with Gateway Load Balancer (GWLB), the firewall did not + preserve the GENEVE source port for internet traffic, resulting in + increased latency. The fix ensures the firewall preserves the outer + UDP source port of GENEVE encapsulation when sending traffic back to + GWLB. +
+
+
PAN-298872
+ 		+
+ (PA-400 Series firewalls in HA configurations only) Fixed an issue where ports went down after an HA failover. +
+
+
PAN-298617
+ 		+
+ Optimized the commit workflow to reduce the size of the effective + configuration, resulting in lower memory consumption. +
+
+
PAN-298514
+ 		+
+ Fixed an issue where WildFire clusters operating in FIPS-CC/ Non + FIPS-CC mode were not supported in earlier PAN-OS 12.1 releases. +
+
+
PAN-298460
+ 		+
+ (Panorama appliances in HA configurations on Microsoft Azure + environments only) Fixed an issue on the web interface where the plugin versions that + were displayed when hovering the cursor over the Green Match icon were + inconsistent even though the Panorama web interface reported the + versions as matching. +
+
+
PAN-298387
+ 		+
+ Fixed an issue on the firewall where the source and destination NAT IP + addresses did not display in traffic and threat logs. +
+
+
PAN-298288
+ 		+
+ Fixed an issue where traffic loss occurred when two aggregate ethernet + interfaces were configured as vwire with only one member link active + in the aggregate ethernet interface, which occurred due to an + incorrect logic in active port map of AE interfaces. +
+
+
PAN-298279
+ 		+
+ Fixed an issue where Panorama administrators defined in a SAML + Identity Provider (IdP) were unable to authenticate if their username + exceeded 32 characters, and the system logs displayed the failed + authentication attempt with a truncated username. +
+
+
PAN-298252
+ 		+
+ Fixed an issue where Data Loss Prevention (DLP) inspection of chunked + transfer encoding over TLS resulted in incomplete file downloads on + Outlook Web App (OWA) due to the WIF page size limit, which led to + corrupted or incomplete PDF attachments. +
+
+
PAN-298141
+ 		+
+ Fixed an issue where the firewall experienced recurring kernel + segfaults related to multiple processes, which led to a SIGSEGV error. +
+
+
PAN-298000
+ 		+
+ Fixed an issue where the + useridd + process stopped responding after an upgrade, which led to high packet + buffer congestion and an OOM condition. +
+
+
PAN-297976
+ 		+
+ Fixed an issue where the firewall experienced extended boot times + after a reboot due to the + configd + process needing to rebuild the ACE catalog after detecting + discrepancies that were caused by duplicate application checking + between the ACE catalog and content. +
+
+
PAN-297975
+ 		+
+ Fixed an issue where Panorama was unable to push the Trusted Root CA + configuration to Log Collectors via a Collector Group push due to the + Log Collector not supporting the + trusted-root-CA configuration. +
+
+
PAN-297972
+ 		+
+ Fixed an issue where a dataplane crash occurred when traffic matched + Inline Cloud Analysis prefiltering signatures, even when Inline Cloud + Analysis features were not enabled. +
+
+
PAN-297963
+ 		+
+ Fixed an issue where PA-400 Series firewalls were not properly caching + DNS responses for FQDN objects. The firewall was observed to + repeatedly send DNS requests for the same FQDN objects every 10-15 + seconds, even after receiving valid responses, despite the minimum + FQDN refresh interval being set to a much higher value. This resulted + in excessive DNS queries originating from the firewall's management + interface. +
+
+
PAN-297819
+ 		+
+ Fixed an issue where the firewall was unable to send device telemetry + files to Cortex Data Lake due to the firewall receiving an invalid + upload token. +
+
+
PAN-297796
+ 		+
+ Fixed an issue on Panorama where the policy review feature in + Dynamic Updates failed to display + Security policy rules when the device group was set to + All. +
+
+
PAN-297782
+ 		+
+ Fixed an issue on Panorama where reassociating a vsys from one device + group to another in a multi-vsys environment resulted in another vsys + from the same firewall being removed from the original device group. + This resulted in the device being moved into the + no device groups attached group, a + superuser was required to manually reattach the device. +
+
+
PAN-297774
+ 		+
+ Fixed an issue on the web interface where the TLS Version was + misspelled as TLS Vesrion (Device > Server Profiles > Email). +
+
+
PAN-297761
+ 		+
+ Fixed an issue where the firewall incorrectly categorized some URLs as + not-resolved due to a conflict with Top Level Domain (TLD) data + handling in the PAN-DB URL cloud. This affected URLs under domains + marked as TLDs, which the firewall incorrectly assumed did not have + any category. +
+
+
PAN-297759
+ 		+
+ Fixed an issue on PA-7500 firewalls running in a cluster where + sub-interfaces were not discoverable via SNMP, which prevented proper + monitoring and statistics collection for sub-interfaces using + SNMP-based tools. +
+
+
PAN-297749
+ 		+
+ Fixed an issue where the redistribution agent status was blank on the + web interface on both the firewall and Panorama, even though the CLI + showed the agent as connected. +
+
+
PAN-297610
+ 		+
+ Fixed an issue where the firewall became unresponsive after an upgrade + due to the fsck command scanning + drive partitions in parallel with the root partition, which caused the + process to take an extended amount of time. +
+
+
PAN-297609
+ 		+
+ Fixed an issue where the CLI command + debug user-id refresh user-id agent all + failed with the error message + Invalid agent name. Agent name should be 1 to 31 characters + long. +
+
+
PAN-297540
+ 		+
+ (Panorama managed firewalls in HA configurations only) Fixed an issue where the HA-Link-Monitor configuration pushed from + Panorama was converted to a local configuration on the peer device + after an HA sync, which caused subsequent Panorama pushes of link + monitor changes to be flagged as overwritten, and a forced template + push or manual clearing of the configuration on the firewall was + required. +
+
+
PAN-297370
+ 		+
+ Fixed an issue where pushing a new object from Panorama to a Cloud + NGFW Device Group unexpectedly removed existing Panorama-pushed policy + rules, even though the + Push Preview did not show any + deletions, which led to traffic disruptions. +
+
+
PAN-297321
+ 		+
+ (Firewalls in active/active HA configurations only) Fixed an issue where return packets from a phone gateway looped + between the HA pair instead of being encapsulated into the + GlobalProtect tunnel. This occurred when the inner session and the + outer IPSec tunnel terminated on different nodes, which led to + excessive retries and packet drops. +
+
+
PAN-297320
+ 		+
+ (Panorama virtual appliances only) Fixed an + issue where scheduled configuration exports failed with an + invalid key error when connecting + to a SCP server using non-default SCP port. Also, additional CLIs were + added to delete the known-hosts file. +
+
+
PAN-297263
+ 		+
+ (PA-5220 firewalls only) Fixed an issue where + the + ikemgr + process crashed intermittently, which caused IPSec tunnels to go down + randomly. With this fix, the IKE Security association data structures + are accessed in a thread-safe manner, and the + ikemgr + process does not reference an invalid memory pointer during teardown + operations. +
+
+
PAN-296977
+ 		+
+ Fixed an issue where the web interface became unresponsive when + attempting to view + Ethernet interface details after + applying a filter in + Network > Interfaces. +
+
+
PAN-296752
+ 		+
+ (PA-1410 Firewalls only) Fixed an issue where + the firewall experienced high management CPU usage and repeatedly + rebooted when attempting to retrieve SMART data. +
+
+
PAN-296749
+ 		+
+ Fixed an issue where email alerts sent from the firewall were marked + as spam due to the EHLO header containing only the firewall hostname + and not the fully qualified domain name (FQDN). +
+
+
PAN-296694
+ 		+
+ Fixed an issue where the firewall rebooted due to the + useridd + process repeatedly restarting during an IP-port data type writes to + the redis from multiple sources such as TSA or XML in a scale + environment. +
+
+
PAN-296666
+ 		+
+ Fixed an issue where Prisma Access gateways did not pass usernames to + the WildFire portal, which caused the + Recipient User ID to display as + unknown on + wildfire.paloaltonetworks.com, even when the username was present in + the gateway logs. +
+
+
PAN-296616
+ 		+
+ Fixed an issue where, when a PBF policy rule with a monitoring profile + was configured, the intermediate firewall dropped the PBF monitoring + traffic, which caused the PBF rule to remain disabled on the local + firewall. +
+
+
PAN-296598
+ 		+
+ Fixed an issue where EAL logs were not forwarded to the IoT Security + dashboard when the proxy server password contained special characters. +
+
+
PAN-296535
+ 		+
+ Fixed an issue on the firewall where BGP peers disconnected when more + than 500 BGP neighbors were configured in a single Logical Router +
+
+
PAN-296519
+ 		+
+ Fixed an issue where a stream receiving a reconnect signal with an + associated error in + Wifclient + caused the entire pool to close, which resulted in a complete + disconnection. +
+
+
PAN-296443
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where + the firewall had a lower maximum capacity for DIPP translated IP + addresses than the PA-5260, which caused configuration commit errors + during migration. With this fix, the maximum capacity on PA-5450 + firewalls has been increased to 8000. +
+
+
PAN-296397
+ 		+
+ Fixed an issue on the Panorama web interface where previewing changes + after a commit to shared objects were not accurately displayed in the + push scope. +
+
+
PAN-296283
+ 		+
+ Fixed an issue where, on hardware platforms with the SaaS inline + license, Additional Header Logging (AHL) hash table creation proceeded + even when the feature was disabled through the CLI, potentially + leading to crashes. +
+
+
PAN-296224
+ 		+
+ (Firewalls in active/active HA configurations only) Fixed an issue where adding a 26th floating IP address to an + aggregate interface on one vsys caused IPSec tunnels in another vsys + to stop working due to rekeying issues. +
+
+
PAN-296208
+ 		+
+ Fixed an issue where the firewall did not accept address groups in the + filter condition of a Log Forwarding Match list. +
+
+
PAN-296206
+ 		+
+ Fixed an issue where the firewall incorrectly routed external Type-5 + Link State Advertisements (LSAs) within a stub area when the firewall + was configured as an Area Border Router (ABR) in a stub area and + learned about an external prefix from another ABR connected to the + backbone area. +
+
+
PAN-296202
+ 		+
+ (Firewalls in active/active HA configurations only) Added a log enhancement to capture an issue where, when a commit + operation was in progress, newly deployed IP address tags that used + the XML API were not immediately reflected in address group + resolution, which delayed IP address mapping to address groups and + caused traffic to be incorrectly allowed or denied. +
+
+
PAN-296020
+ 		+
+ Fixed an issue where commit operations failed during phase 1 when + configuring a non-default value for the Graceful Restart Hello Delay + due to an FRR parse error if the configured value was between 1 and 9. +
+
+
PAN-295958
+ 		+
+ Fixed an issue where multicast output interfaces (OIFs) were missing + for up to 5 minutes after an HA failover or routing process restart, + which impacted new multicast sessions. This occurred due to an age-out + process triggered by unicast graceful restart conditions. +
+
+
PAN-295951
+ 		+
+ Fixed an issue on firewalls in active/passive HA configurations where + CLI outputs incorrectly included XML formatting. +
+
+
PAN-295950
+ 		+
+ Fixed an issue where the output for some CLI commands incorrectly + included XML formatting. +
+
+
PAN-295899
+ 		+
+ Fixed an issue where DNS resolution failed on Linux machines running + GlobalProtect client version 6.2.6 when connected with DNS Security + enabled. This occurred because the firewall incorrectly discarded DNS + packets when processing multiple DNS requests or responses over the + same session, even when no malicious verdict was received. +
+
+
PAN-295854
+ 		+
+ Fixed an issue where the firewall generated two URL logs for a single + session. +
+
+
PAN-295838
+ 		+
+ Fixed an issue on IKEv1 tunnels where, if the peer IKE gateway was + unreachable, the IKE Phase-1 Security association (SA) was not cleared + by DPD until Phase-2 rekeying occurred or until it was manually + cleared via the CLI because the DPDs were not sent accurately + according to the configured interval due to a miscalculation of the + DPD timer. This resulted in the tunnel taking longer than expected to + recover. +
+
+
PAN-295803
+ 		+
+ Addressed a memory leak issue under sc3 and automatic commit recovery + (ACR) code path. +
+
+
PAN-295802
+ 		+
+ Fixed an issue where a memory leak related to the + configd + process occurred. +
+
+
PAN-295796
+ 		+
+ Fixed an issue where the firewall intermittently failed to forward + VXLAN GARP packets, which led to connectivity issues for wireless + clients in environments that used VXLAN tunnels for wireless access + points. +
+
+
PAN-295766
+ 		+
+ (VM-Series firewalls in HA configurations only) + Fixed an issue where Panorama displayed incorrect packet buffer values + on the web interface and the CLI. +
+
+
PAN-295728
+ 		+
+ Fixed an issue where configuring an OSPFv2 NSSA area range caused + OSPF-learned routes to become unreachable due to the incorrect + installation of a discard route when the NSSA range prefix matched an + existing OSPF route. +
+
+
PAN-295662
+ 		+
+ Fixed an issue where Panorama displayed the URL instead of the file + name for vulnerability threat logs fetched from the Logging Service. +
+
+
PAN-295644
+ 		+
+ Fixed an issue where Strata Logging Service (SLS) log forwarding + streams intermittently displayed as inactive. +
+
+
PAN-295586
+ 		+
+ Fixed an issue where, after committing changes to a Certificate + Profile or other global configurations without any making changes to + the virtual system (vsys), the Data Redistribution include/exclude + lists were ignored on the firewall. This resulted in the firewall + receiving and processing User-ID information from all sources. +
+
+
PAN-295578
+ 		+
+ Fixed an issue where GlobalProtect HIP data file download and + installation failed with the error message + An error occurred while processing request. Please try again after + some time or contact support + or No ETAG from response due to a + script exiting prematurely. +
+
+
PAN-295470
+ 		+
+ Fixed an issue on the firewall where the + useridd + process continuously increased its memory consumption, which resulted + in an OOM condition that caused the firewall to restart. +
+
+
PAN-295421
+ 		+
+ Fixed an issue where the CLI command outputs incorrectly included XML + formatting tags. +
+
+
PAN-295385
+ 		+
+ Fixed an issue where syslog forwarding dropped due to FQDN resolution + failures. +
+
+
PAN-295257
+ 		+
+ Fixed an issue where, after onboarding a firewall to Panorama, IPsec + tunnels displayed IKEv2 in Panorama, even though the tunnels were + configured with IKEv1 locally on the firewall. +
+
+
PAN-295245
+ 		+
+ Fixed an issue where the + useridd + process stopped responding because the client was unavailable. +
+
+
PAN-295240
+ 		+
+ Fixed an issue where the source user field was intermittently missing + in traffic logs, even when the IP address-to-user mapping was + available. This occurred due to a race condition where the log + generation process preceded the creation of the IP address-to-user + mapping. +
+
+
PAN-295221
+ 		+
+ Fixed an issue where, after upgrading Panorama and Log Collectors from + PAN-OS 10.2.9 to PAN-OS 11.1.6-h6, Traffic and Threat logs were not + forwarded to a Splunk server over UDP. +
+
+
PAN-295185
+ 		+
+ (Panorama appliances only) Fixed an issue where + a custom administrator role with the permission + Network > QoS (Read Only) was + unable to create a QoS profile, even when the + Policies > QoS (Enabled) and + Network Profiles > QoS Profile (Enabled) + permissions were also set. +
+
+
PAN-295095
+ 		+
+ Fixed an issue where, when you used a syslog forwarding profile with + the CEF format, an additional string was appended to the end of the + log message when viewing the log entry from the Universal Forwarder + directory. +
+
+
PAN-294893
+ 		+
+ Fixed an issue where firewalls with the + Send handshake messages to CTD for inspection + setting enabled caused incorrect security policy rules to be matched + during the TLS handshake. Additionally, the expected response page for + blocked URLs was not displayed. +
+
+
PAN-294770
+ 		+
+ (Firewalls in active/passive HA configurations) + Fixed an issue on firewalls where, after failover, certain subnets + were missing from the Link State Database, which prevented OSPF routes + from being immediately learned due to a Type-7 to Type-5 LSA + translation conflict in the ABR when the same LSA was advertised by + two peers in the NSSA area. +
+
+
PAN-294524
+ 		+
+ Fixed an issue where firewalls and Panorama management servers were + unable to view or download WildFire reports from a WF-500 appliance, + resulting in a 401 error in the report tab. +
+
+
PAN-294434
+ 		+
+ Fixed an issue where memory leaks occurred. These leaks were caused by + two distinct scenarios: the failure to deallocate memory for a nodeset + when a new nodeset was assigned to the same variable, and the failure + to free a UUID hash table during error conditions. +
+
+
PAN-294307
+ 		+
+ Fixed an issue on Panorama where a + configd + SIGSEGV crash occurred when renaming objects within policy rules, + objects, or zones. +
+
+
PAN-294191
+ 		+
+ Fixed an issue where BGP did not generate a system log when the number + of prefixes received from a peer exceeded the configured threshold, + even with the Address Family Identifier and Peer Group settings + configured to trigger a warning. +
+
+
PAN-294179
+ 		+
+ Fixed an issue where viewing, refreshing, and comparing config + versions in Config Audit caused the + configd + process to stop responding. If the page loaded successfully, some + commit versions displayed incorrect or missing data. +
+
+
PAN-294161
+ 		+
+ Fixed an issue where the firewall rebooted unexpectedly due to the + useridd + process restarting and causing an HA failover. This occurred due to + the + configd + process timing out when running the CLI command + show user user-id-agent config all. +
+
+
PAN-294123
+ 		+
+ Fixed an issue where the firewall removed all Infrastructure and Audit + logs, as well as logdb and search + engine quotas, when the configured retention period was reached + instead of only removing logs older than the configured retention + period. +
+
+
PAN-294001
+ 		+
+ Fixed an issue on Panorama managed firewalls generated + Failed in get_pwchange_required + error messages in the + authd + logs for local administators. +
+
+
PAN-293879
+ 		+
+ Fixed an issue on the firewall where the VM monitor source remained in + the Getting All status, which + prevented dynamic address groups from updating IP addresses for new + EC2 instances. This issue occurred due to a race condition where two + threads that simultaneously retrieved IP address tag information from + AWS VM monitoring sources became stuck while reading the XML file. +
+
+
PAN-293858
+ 		+
+ Fixed an issue where the file URL was not displayed on SCM LogViewer + when a file was downloaded. This issue affected logs with a subtype of + 'file'. +
+
+
PAN-293848
+ 		+
+ Fixed an issue where Panorama failed to push the default value of + None for the secondary NTP server + address to managed firewalls, resulting in a commit validation error. + This occurred even when configuring the secondary NTP server address + as None in Panorama's web interface, + and affected both newly deployed and long-standing production + firewalls after upgrading. +
+
+
PAN-293847
+ 		+
+ Fixed an issue where EAL logs for traffic matching the + intrazone-default security rule were not forwarded to the IoT Security + portal. +
+
+
PAN-293840
+ 		+
+ Fixed an issue on the Panorama web interface where SNMP settings + configured in Panorama templates were incorrectly displayed as locally + configured. +
+
+
PAN-293825
+ 		+
+ Fixed an issue where packets with bad TCP checksums were transmitted + even when the + Strict TCP/IP checksum option was + enabled. +
+
+
PAN-293708
+ 		+
+ Fixed an issue where the + configd + process stopped responding when a partial revert operation was + performed on a newly added rule in a rulebase that was empty in the + running configuration. +
+
+
PAN-293686
+ 		+
+ Fixed an issue where importing a device state file was incorrectly + allowed during an existing commit job. +
+
+
PAN-293561
+ 		+
+ Fixed an issue where users with a custom role-based administrator role + were unable to download the GlobalProtect client application via the + web interface even when the + GlobalProtect Client option was + enabled in the admin role profile. +
+
+
PAN-293297
+ 		+
+ Fixed an issue on Panorama where a full push to device groups was + initiated instead of a selective push when using + Commit and Push Changes Made By in + the commit and push. +
+
+
PAN-293281
+ 		+
+ Fixed an issue where the reported throughput and packet rate were + higher than the actual interface traffic due to a double counting + error. +
+
+
PAN-293141
+ 		+
+ (Panorama appliances only) Fixed an issue where + the web interface did not display the commit button for a custom + administrator when changes were made to a template while a device + group push was pending. +
+
+
PAN-292752
+ 		+
+ Fixed an issue where a command injection vulnerability could occur due + to improper input sanitization. +
+
+
PAN-292580
+ 		+
+ (Panorama appliances only) Fixed an issue where + the software deployment validation process did not display the + required software version for dedicated log collectors (DLCs), and + downloading software images to multiple DLCs failed. +
+
+
PAN-292529
+ 		+
+ Fixed an issue where HA configuration synchronization failed between + HA firewalls due to an empty interface node present only in the + passive firewall's running-config.xml file. +
+
+
PAN-292447
+ 		+
+ Fixed an issue where Panorama did not display data in the + Feature Adoption tab in Strata Cloud + Manager due to the system creating and deleting a CLI user for each + interval instead of reusing a permanent CLI user for telemetry. +
+
+
PAN-292306
+ 		+
+ Fixed an issue where the + authd + process stopped handling RADIUS authentication requests and required a + restart. +
+
+
PAN-292285
+ 		+
+ (Firewalls in active/passive HA configurations only) Fixed an issue where network outages of approximately 30 seconds + occurred after a failover due to a delay in establishing the BGP + connection between the new active firewall and one of its peers and a + second delay in advertising prefixes learned from the firewall to + another peer. +
+
+
PAN-292242
+ 		+
+ Fixed an issue on M-200 and logging appliances where traffic logs were + intermittently truncated when forwarded using a TCP syslog + configuration. This issue occurred during the log forwarding stage due + to intermittent syslog drops caused by exceeding the forwarding queue + capacity. +
+
+
PAN-292220
+ 		+
+ Fixed an issue where the Status LED on PA-7500 SFCs did not work. +
+
+
PAN-292079
+ 		+
+ (Panorama appliances only) Fixed an issue where + the data on scheduled SaaS Application Usage Reports was different + than the data on on-demand reports generated via + Run Now. +
+
+
PAN-292019
+ 		+
+ Fixed an issue on the Panorama web interface where cloud applications + were not displayed under + Objects > Applications after a + new content upgrade and Cloud App Catalog download, and were only + visible in application groups, security policy rules, and the CLI. +
+
+
PAN-291984
+ 		+
+ Fixed an issue where SSH/SFTP traffic was intermittently blocked by + URL filtering due to the firewall incorrectly applying URL categories + from previous sessions. +
+
+
PAN-291940
+ 		+
+ Fixed an issue where the firewall established multiple TCP connections + to a syslog server, which caused logs to be dropped. This occurred + because the firewall established a new TCP session for each transfer + and the sessions were not closed, which resulted in a continuous + increase in connections over time. +
+
+
PAN-291915
+ 		+
+ Fixed an issue on the firewall where the PDT process experienced a + memory leak due to frequent dumping of fabric traffic statistics, + which resulted in high CPU utilization and instability. +
+
+
PAN-291792
+ 		+
+ (PA-7050 firewalls on vwire instances only) + Fixed an issue where Bidirectional Forwarding Detection (BFD) echo + packets were dropped due to the firewall dropping packets with the + same source and destination IP addresses. +
+
+
PAN-291706
+ 		+
+ Fixed an issue where the software tag descriptor was always at 100, + which led to resource unavailability errors and prevented users from + obtaining DHCP IP addresses. +
+
+
PAN-291660
+ 		+
+ Fixed an issue where the firewall incorrectly reported the speed of + 25G interfaces as 1G when queried using SNMP for the ifHighSpeed OID. +
+
+
PAN-291650
+ 		+
+ Fixed an issue where the firewall rebooted unexpectedly due to an OOM + condition. +
+
+
PAN-291631
+ 		+
+ (VM-Series firewalls only) Fixed an issue where + the firewall frequently rebooted. +
+
+
PAN-291273
+ 		+
+ Fixed an issue where a PA-VM-Flex firewall in an air-gapped + environment failed to install the license when bootstrapping after a + factory reset when the ISO image contained a PAN-OS image. +
+
+
PAN-291247
+ 		+
+ Fixed an issue where checksum values changed when downloading files + through TFTP on firewalls using subinterfaces. +
+
+
PAN-291174
+ 		+
+ Fixed an issue where Real Time Streaming Protocol (RTSP) video streams + did not work when connected through GlobalProtect due to the firewall + blocking 200 OK responses. This occurred because of incorrect NAT + translations for the 200 OK message from the server. +
+
+
PAN-291067
+ 		+
+ Fixed an issue where the + devsrvr + process periodically exceeded its virtual memory limit and restarted, + which led to intermittent outages. +
+
+
PAN-291009
+ 		+
+ Fixed an issue where, after a web server returned a 401 or 403 error, + the firewall was unable to decrypt HTTP/2 traffic, and the firewall + rejected all subsequent streams from the client. +
+
+
PAN-290954
+ 		+
+ Fixed an issue where the web server used a low HTTP Strict Transport + Security (HSTS) max-age value of 86400 seconds for the + log.query.expression.js.php page. +
+
+
PAN-290948
+ 		+
+ Fixed an issue where the proxy hid the Cache-Control header, which + prevented context switching. +
+
+
PAN-290938
+ 		+
+ Fixed an issue where multiple memory leaks occurred related to the + configd + process. +
+
+
PAN-290851
+ 		+
+ Fixed an issue where the Agent User Override Key was incorrectly + available for configuration on Panorama management servers when + running in FIPS-CC mode. +
+
+
PAN-290783
+ 		+
+ Fixed an issue where the + debug dataplane nat sync-ippool + command may not accurately account for all allocated ports or + display/sync leaks when multiple NAT rules use the same IP pool. This + could result in inaccurate reporting of leaked ports. The fix modifies + the implementation to directly compare the original pool against the + temporary pool across all vsys. +
+
+
PAN-290757
+ 		+
+ Fixed an issue where the user, region, and external IP address were + reported as unknown in the AppSec logs due to an incorrect packet + adjust logic. +
+
+
PAN-290728
+ 		+
+ Fixed an issue where modifying an interface IP address on an existing + vsys caused a default vsys1 to be + created, which led to commit failures due to the maximum supported + number of vsys being reached. +
+
+
PAN-290681
+ 		+
+ Fixed an issue on Panorama and Panorama managed firewalls where + template settings reverted during a device group push when + Include Device and Network Templates + was checked, even if no changes were made to the template. This caused + the SAML IDP server profile certificate to revert to an older, invalid + certificate, and resulted in GlobalProtect users being unable to + authenticate via SAML. +
+
+
PAN-289852
+ 		+
+ Fixed an issue where websites did not load when accumulation proxy was + enabled. +
+
+
PAN-289826
+ 		+
+ Fixed an issue on Panorama where a selective push of policy rule + changes to a firewall caused the firewall to lose its Security policy + rules. +
+
+
PAN-289736
+ 		+
+ Fixed an issue where partial-revert operations were taking a long + time, causing config lock timeout issues and resulting in frequent + error messages being displayed: + Timed out while getting config lock. Please try again. +
+
+
PAN-289706
+ 		+
+ Fixed an issue where the + authd + process crashed intermittently on VM-Series firewalls due to + authentication sequence failures. The crashes occurred during memory + management operations within a library while releasing memory to its + central cache. +
+
+
PAN-289578
+ 		+
+ Fixed an issue on Panorama managed firewalls where the source user, + source device vendor, source MAC address, and OS version information + were not visible in traffic logs and SCM when the user and device + access control lists were empty. +
+
+
PAN-289413
+ 		+
+ Fixed an issue where dataplane interfaces went down and configurations + were lost after a reboot. +
+
+
PAN-289383
+ 		+
+ Fixed an issue where the MPLS interface eth1/6 went down and remained + down, even after replacing the SFP with a supported one and adjusting + duplex and speed settings. +
+
+
PAN-289067
+ 		+
+ Fixed an issue where, after upgrading Panorama in a High Availability + (HA) pair, the configuration logs stopped synchronizing from the + primary Panorama to the secondary Panorama. This issue occurred + because the log forwarding flag was permanently disabled due to the + connection state not being active when the + log-fwd-ctrl message was + received. +
+
+
PAN-288938
+ 		+
+ Fixed an issue on the Panorama web interface where the search bar + suddenly was not displayed, or the filter/clear filter icon moved to + the left of the search bar. +
+
+
PAN-288869
+ 		+
+ Fixed an issue where custom administrators with visibility into + specific vsys logs were able to view logs for all vsys. +
+
+
PAN-288388
+ 		+
+ Fixed an issue where, after an EDL certificate update or repository + migration, authentication failures caused the firewall to not fall + back to the last successfully cached EDL entries, which led to policy + rules that referenced the EDL to not be enforced. +
+
+
PAN-288175
+ 		+
+ Addressed a stack buffer overflow memory leak under plugin management + code path. +
+
+
PAN-288141
+ 		+
+ Fixed an issue where the + debug data-plane sync ippool CLI + command did not work for Per Destination IP Pool (PDIPP) and caused a + memory leak. +
+
+
PAN-288139
+ 		+
+ Fixed an issue where the firewall incorrectly identified ports as + leaking when the session was not active even though the ports were + allocated. +
+
+
PAN-287599
+ 		+
+ Fixed an issue where the prefix value for a BGP neighbor caused the + firewall to leak routes to a different BGP peer. +
+
+
PAN-287581
+ 		+
+ (Firewalls in active/passive HA configurations only) Fixed an issue where the firewall did not process and transmit HA + path monitoring probes received from another HA cluster when the + firewall acted as a gateway for internal monitoring IP addresses used + in the HA path monitoring group, which caused HA flapping due to path + monitoring failures. +
+
+
PAN-287387
+ 		+
+ Fixed an issue on Panorama where API jobs failed with the error + message + Server error: Timed out while getting config lock. This occurred due to slow set request performance when setting a + large number of address objects in a single set call. +
+
+
PAN-287086
+ 		+
+ Fixed an issue where PA-3420 firewalls experienced unexpected reboots + due to the + all_task_7 + process crashing with signal 6, leading to a non-functional state. +
+
+
PAN-287035
+ 		+
+ Fixed an issue where, when an application stopped responding, a large + file was created in the /opt/panlogs directory, which caused the + partition to fill up. +
+
+
PAN-287034
+ 		+
+ Fixed an issue where sequence numbers were skipped for all types of + logs on the firewall due to audit logs being generated but not written + to disk when Audit Tracking was enabled. +
+
+
PAN-285758
+ 		+
+ Fixed an issue where the firewall web interface became unresponsive + while adding a description that contained 1062 bytes of character data + in a Security policy rule instead of displaying an error message when + the description exceeded the maximum allowed length. +
+
+
PAN-285672
+ 		+
+ Fixed an issue on Panorama managed firewalls where CLI commands to + convert a LSVPN to Serial Number and IP address authentication were + not applied if the GlobalProtect portal name contained a space. +
+
+
PAN-285213
+ 		+
+ Fixed an issue where proxy requests for certificate status (OCSP/CRL) + from + sslmgr + contained incorrect values that caused unknown certificates to be + blocked. +
+
+
PAN-285208
+ 		+
+ Fixed an issue where the firewall did not automatically recover after + a machine check exception (MCE) occurred. +
+
+
PAN-285181
+ 		+
+ Fixed an issue where the wifclient was not configured to utilize the + GOMEMLIMIT feature. +
+
+
PAN-285169
+ 		+
+ Fixed an issue on Panorama where Kerberos superusers were unable to + edit policy rules because the target device tab was grayed out. +
+
+
PAN-283704
+ 		+
+ Fixed an issue where the PAN-OS DoS protection feature by default + blacklisted specific IP addresses, which caused outbound traffic + domain resolution to fail for clusters. +
+
+
PAN-283311
+ 		+
+ Fixed an issue where log forwarding to all syslog servers failed if + one syslog server that used TLS as the protocol became unreachable. +
+
+
PAN-283237
+ 		+
+ Fixed an issue where traffic logs incorrectly displayed the action as + allow for traffic matching a + Security policy rule configured with the action set to + deny. This issue occurred due to the + child session being used for policy rule lookup when a configuration + update triggered a rematch if the FTP-data application was not in the + rule. +
+
+
PAN-283101
+ 		+
+ (Firewalls in HA configurations only) Fixed an + issue where the + show wildfire status CLI command + displayed an incorrect maximum file size of 4 KB for WildFire script + uploads even though the configured value was different. +
+
+
PAN-283053
+ 		+
+ Fixed an issue where the firewall experienced high disk space + utilization, which caused the firewall to become non-functional. +
+
+
PAN-282956
+ 		+
+ Fixed an issue on firewalls running PAN-OS 11.1 and later PAN-OS + releases where the portal and gateway configuration view did not + display rows and columns. +
+
+
PAN-282687
+ 		+
+ Fixed an issue on Panorama where performing a selective revert of + configuration changes resulted in all configuration changes being + reverted. +
+
+
PAN-281721
+ 		+
+ Fixed an issue where the firewall generated high-severity system + alerts indicating that the configuration size exceeded the maximum + recommended size, even when the configuration size was within the + expected limits. +
+
+
PAN-281588
+ 		+
+ Fixed an issue where packet buffer depletion occurred due to the a + high number of + tcp_pkt_queued packets when Jumbo + was enabled. +
+
+
PAN-281371
+ 		+
+ Added an enhancement to the + show interface cellular CLI + command to display all required information. +
+
+
PAN-280536
+ 		+
+ Fixed an issue where firewalls that were connected to the same Cloud + Identity Engine displayed inconsistent group membership information, + with some firewalls showing only a subset of users belonging to a + group. This occurred due to a full or incremental group sync failure. +
+
+ This fix introduces a retry mechanism for failed group queries to the + Cloud Identity Engine. To use this feature, run the following CLI + commands. +
+
+ To enable the retry mechanism: + debug user-id dscd retry-enable on. +
+
+ To set the retry time: + debug user-id dscd retry-time set-time <1-10>. The default value is 5 seconds. +
+
+ To set the number of retry attempts: + debug user-id dscd retry attempts set-attempts <3-10>. The default value is 5 attempts. +
+
+ To disable the retry mechanism: + debug user-id dscd retry-enable off. +
+
+ Additionally, a system log is now generated when a group sync fails, + and you are able to monitor the group sync status with the following + CLI commands: +
+
    +
  • + show user group count list cloud-identity-engine +
    • +
  • + show user group count name <group_name> +
    • +
+
+
PAN-279552
+ 		+
+ Fixed an issue where configuring a custom vulnerability object + signature condition failed to commit when the + negate option was disabled on the + condition, and changes made to a custom vulnerability object were + successfully committed to Panorama but not pushed to the firewall. + This occurred when a vulnerability object contained two signatures. +
+
+
PAN-278288
+ 		+
+ Fixed an issue where IPv6 BGP peering established between virtual + routers even without dataplane connectivity. This occurred because the + firewall used the kernel for lookups instead of the dataplane. The CLI + set system setting loopback-workaround enable is mandatory then for + this lookup to be forced. +
+
+
PAN-277178
+ 		+
+ Fixed an issue on Panorama where you were unable to delete a shared + object due to the rulebase incorrectly referencing the shared object + instead of the device group-specific object when the name was used. +
+
+ To use this fix, delete the original shared object after cloning it to + a device group with the same name. +
+
+
PAN-276745
+ 		+
+ Fixed an issue where GlobalProtect clients on Windows endpoints sent + an empty cookie to the gateway after a user logged out of the Windows + machine or rebooted. This triggered a full re-authentication instead + of using the existing authentication cookie, which resulted in the + generation of a new authentication cookie upon each login. +
+
+
PAN-275050
+ 		+
+ Fixed an issue where the Japanese translation for the URL filtering + option to add a trailing slash to entries and the device license + status error was incorrect. +
+
+
PAN-274484
+ 		+
+ Fixed an issue where commits failed when + Data Services was in a Service route + configuration was configured with the + MGMT interface. +
+
+
PAN-274333
+ 		+
+ Fixed an issue where the Logging Service License Status displayed as + red even though a valid license was installed on the firewall. +
+
+
PAN-273195
+ 		+
+ Fixed an issue where the firewall did not log the correct NAT IP + address and source zone for HTTP2 traffic with SSL decryption enabled + on RNHP nodes. +
+
+
PAN-273158
+ 		+
+ (PA-7000 Series firewalls only) Fixed an issue + where an incorrect ASIC configuration caused silent packet drops or + application slowness when receiving a mix of jumbo and non-jumbo + packets. +
+
+
PAN-272605
+ 		+
+ Fixed an issue where the firewall did not display VPC endpoints when + there was a large amount of VPC endpoints to interface mappings. +
+
+
PAN-272175
+ 		+
+ Fixed an issue where session rematch caused ACE cloud application + traffic to match the wrong policy. +
+
+
PAN-267965
+ 		+
+ (Firewalls on Amazon Web Services (AWS) environments only) Fixed an issue where newly bootstrapped firewalls sent an + incorrect, non-DHCP-assigned hostname to the SNMP server. This + occurred because the SNMP process referred to a configuration file + that was not updated due to a missing configuration commit. +
+
+
PAN-267450
+ 		+
+ Fixed an issue where the + reportd + process stopped responding with a SIGSEGV at + schedule_report_es_response. +
+
+
PAN-264349
+ 		+
+ Fixed an issue where the Management Processor Card (MPC) on modular + firewalls became unresponsive when a disk drive entered a low-power + state and failed to wake up. +
+
+
PAN-259853
+ 		+
+ Fixed an issue where, when the DHCP server was enabled for + GlobalProtect, the commit error message was not properly displayed + when Any was selected as the source + interface in the service router configuration (Device > Setup > Service > Service Router + Configuration). +
+
+
PAN-257195
+ 		+
+ (PA-5400 Series firewalls only) Fixed an issue + where the mp-monitor logs did not print disk SMART data. +
+
+
PAN-248913
+ 		+
+ Fixed an issue where the Elasticsearch client certificate was not auto + renewed, which caused it to enter a Red state, and logs were not + displayed in Panorama. +
+
+
PAN-242952
+ 		+
+ Fixed an issue where high SSL traffic depleted flex memory, which + prevented the firewall from revalidating SSLVPN client CAs during + configuration pushes. +
+
+
PAN-241953
+ 		+
+ Fixed an issue where the firewall did not have a heartbeat mechanism + for the + authd + process, which caused the firewall to become unresponsive if the + authd + process stopped responding. +
+
+
PAN-185731
+ 		+
+ Fixed an issue where the firewall was unable to parse the URL path and + host when the host header was located in a different packet, which + resulted in the firewall not logging the URL path in the first packet. +
+
+ The fix is disabled by default. The following CLI commands can be used + to enable/disable the feature: +
    +
  • + set system setting ctd url-crosspkt-host-path-caching + enable +
    • +
  • + set system setting ctd url-crosspkt-host-path-caching + disable +
    • +
  • + set system setting ctd url-crosspkt-host-path-caching + default +
    • +
+ set system setting ctd url-crosspkt-host-path-caching enable set + system setting ctd url-crosspkt-host-path-caching disable set system + setting ctd url-crosspkt-host-path-caching default +
+
diff --git a/reference/PAN-OS/addressed/12.1.6.html b/reference/PAN-OS/addressed/12.1.6.html new file mode 100644 index 0000000..34317e8 --- /dev/null +++ b/reference/PAN-OS/addressed/12.1.6.html @@ -0,0 +1,198 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-316911
+ 		+
+ (VM-Series firewalls on Amazon Web Services (AWS) environments + only) Fixed an issue where a newly bootstrapped firewall required a + management server restart, relicensing, or license push from Panorama + to invoke the device certificate. +
+
+
PAN-314201
+ 		+
+ Fixed an issue on PAN-OS 12.1 releases where intermittent traffic + drops occurred over IPSec VPN tunnels to third-party firewalls during + the IPSec rekey due to the firewall failing to inform the peer to + delete the old SA after moving to the new one. +
+
+
PAN-313216
+ 		+
+ Fixed an issue where firewalls with Prisma Access incorrectly + displayed some traffic as unsanctioned in traffic logs for cloud + applications that were tagged as + sanctioned. +
+
+
PAN-311512
+ 		+
+ Fixed an issue where HIP (Host Information Profile) reports were + blocked on GlobalProtect when + Authentication Cookie Usage Restrictions + was enabled and the Prisma Access Agent protocol was in use. This + occurred because the system failed to correctly process HIP messages + that were relayed via IPSec tunnels with a Virtual IP as the source, + leading to their rejection. +
+
+
PAN-311412
+ 		+
+ Fixed an issue where the + show advanced-routing resource + CLI command failed to execute successfully when invoked through the + XML API and returned an error message. +
+
+
PAN-311261
+ 		+
+ Fixed an issue where the firewall generated duplicate URL Filtering + logs due to an error condition when the new XFF feature was + enabled. +
+
+
PAN-311250
+ 		+
+ (Panorama appliances and Log Collectors only) + Fixed an issue where logs from multiple devices were not visible on + Panorama even though the Elasticsearch health status on the dedicated + Log Collectors appeared green. +
+
+
PAN-310362
+ 		+
+ Fixed an issue where IPv6 Routed HA did not function correctly when + the HA1 (control link) was configured with an IPv6 routed connection. +
+
+
PAN-310240
+ 		+
+ Fixed an issue where software packet buffers were completely utilized + when performing a Data Loss Prevention longevity test. +
+
+
PAN-308507
+ 		+
+ (Panorama managed firewalls only) Fixed an + issue where the firewall intermittently failed to maintain active log + forwarding streams to Strata Logging Service (SLS) even when duplicate + logging and enhanced application logging were enabled. +
+
+
PAN-308418
+ 		+
+ Fixed an issue where, when Advanced DNS Security was enabled and + experienced unusually high loads, DNS resolution failures occurred + with the error + resources-unavailable. +
+
+
PAN-308261
+ 		+
+ Fixed an issue where the firewall failed to send SNMPv3 traps when the + SNMP destination was configured with an FQDN that resolved to multiple + IP address through DNS load balancing. +
+
diff --git a/reference/PAN-OS/known/12.1.2.html b/reference/PAN-OS/known/12.1.2.html new file mode 100644 index 0000000..f71e319 --- /dev/null +++ b/reference/PAN-OS/known/12.1.2.html @@ -0,0 +1,1049 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-314201
+
+ This issue is now resolved. See PAN-OS 12.1.6 Addressed Issues. +
+ 		+
+ On firewalls running PAN-OS 12.1, IPsec VPN tunnels to third-party + peer devices may experience intermittent traffic loss during rekey + operations. When a new Security Association (SA) forms before the old + SA expires, traffic may stop flowing until the older SA naturally + expires or you manually clear it. During this time, the output of show + vpn ipsec-sa may show two SAs for the same proxy ID. This issue + primarily affects tunnels to third-party peer devices and does not + occur with Palo Alto Networks to Palo Alto Networks tunnels. +
+
+ Workaround: Manually clear the affected Security + Association using the command + clear vpn ipsec-sa tunnel <tunnel-name> + to restore connectivity. +
+
+
PAN-309602
+ 		+
+ (PA-5500 series only) When the firewall is + initially powered on, the FAN-0 LED does not turn on. The fan + functions correctly, but the LED doesn't reflect the status. +
+
+ Workaround: Remove and reinsert the fan to turn on + the LED. +
+
+
PAN-308564
+ 		+
+ Packets are dropped on SD-WAN interfaces if they require fragmentation + for an interface but have the + Don't Fragment (DF) bit set. This + results in unexpected packet drops. This affects client to server + sessions when using SD-WAN for NGFW. +
+
+ Workaround: Allow fragmenting packets with DF bit + set (debug dataplane set ip4-ignore-df yes). +
+
+
PAN-308507
+
+ This issue is now resolved. See PAN-OS 12.1.6 Addressed Issues. +
+ 		+
+ Strata Logging Service (SLS) log-forwarding streams intermittently + show as inactive. When checking the status of log-forwarding + connections, one or more streams are reported as inactive. Restarting + the + log-receiver + process temporarily resolves the issue, but the streams become + inactive again after approximately 1-2 hours. This intermittent + inactivity results in log loss. +
+
+
PAN-307702
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ When LACP pre-negotiation is enabled on firewalls in HA + configurations, traffic passing through aggregate Ethernet (AE) + interfaces may be interrupted for several minutes during HA failovers. + This occurs because the suspended (formerly active) firewall continues + to forward packets for active sessions even after the failover + completes, causing MAC address flapping on neighboring switches. +
+
+
PAN-305301
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ The timing of GlobalProtect lifetime expiry or inactivity logout + notifications used for GlobalProtect SSL tunnels may cause the + pan_task + process to stop responding and the dataplane to restart. +
+
+ Workaround: Select + Network > GlobalProtect > Gateways > + <gateway-config> > Agent > <agent-config> > + Connection Settings + and change the value of both + Notify Before Lifetime Expires (min) + and + Notify Before Inactivity Logout (min) + to 0. +
+
+
PAN-304718
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ When using GlobalProtect Clientless VPN, the firewall may restart + unexpectedly, causing routing protocol (OSPF and BGP) outages. This + issue occurs during web content processing for clientless VPN + sessions. +
+
+ Workaround: To prevent this issue until you can + upgrade to a fixed release, disable clientless VPN in your + GlobalProtect portal configuration. +
+
+
PAN-303959
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ Traffic that is incorrectly identified as unknown-tcp/unknown-udp + eventually drops due to an App-ID resource limitation issue. +
+
+
PAN-303663
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ After upgrading to an affected release, SNMP monitoring systems such + as SolarWinds may report 100% usage for hardware packet buffers on + PA-3400 Series and PA-5450 firewalls, even when the firewall is idle + and packet buffer utilization is normal. The packet buffer utilization + oid is fixed to not show incorrect values. +
+
+
PAN-300850
+ 		+
+ Manual scheduling of cloud verdicts is required if a new host in an + Host Compliance Service-enabled environment has a refresh event entry + without a corresponding update event entry. +
+
+
PAN-300809
+ 		+
+ Host Compliance Service connectivity will not work if it is connected + with management IP which is configured with DHCP mode. +
+
+
PAN-300677
+ 		+
+ Panorama cannot display Threat log entries (Monitor > Logs > Threat) when the managed log collector is running a lower PAN-OS release + than Panorama. +
+
+ Workaround: Upgrade the log collectors to the same version as + Panorama. +
+
+
PAN-300671
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ Traffic reports that display destination/source IP addresses or + destination/source hostnames may incorrectly show IPv4 addresses in + IPv6 format (for example, ::ffff:x.x.x.x). This issue affects both + custom reports and scheduled reports, including PDF exports. +
+
+
PAN-300627
+ 		+
+ AutoCommit fails when the Traffic Object is used on AI Runtime + Security, which consequently impacts the workloads that utilize + overlapping subnets. +
+
+
PAN-300483
+ 		+
+ (PA-7500 firewall only) Enabling FIPS-CC mode + causes the firewall to go into maintenance mode. +
+
+ Workaround: After the firewall goes into + maintenance mode, perform an additional reboot. The firewall will + successfully start up in FIPS-CC mode. +
+
+
PAN-300467
+ 		+
+ WildFire WF-500 appliances running PAN-OS 10.x or PAN-OS 11.x cannot + be managed by Panorama running PAN-OS 12.1.2 due to connectivity + issues. +
+
+ Workaround: Upgrade your WildFire appliances to + PAN-OS 12.1.2 or later. +
+
+
PAN-300407
+ 		+
+ The Release Note URL column in the Panorama > Plugins page is + empty. +
+
+ Release Notes for the plugins are available in the + plugins release notes + or in their individual product release notes. +
+
+
PAN-300334
+
+ This issue is now resolved. See PAN-OS 12.1.3 Addressed Issues. +
+ 		+
+ The ADEM plugin is incompatible with PAN-OS version 12.1.2, which + means that upgrading to PAN-OS 12.1.2 will prevent installation of the + plugin and disable the ability to monitor remote sites on + next-generation firewalls using ADEM functionality. +
+
+
PAN-300230
+ 		+
+ (NGFW Cluster) In an NGFW cluster, your pings + to the HSCI-B link might fail, even when the link indicates it is up. + In the event that the HSCI-A link is brought down or unplugged, the + cluster node will transition to failed state, avoiding split brain as + both HSCI links are down in this case. +
+
+ Workaround: Reboot the cluster node to resolve the + HSCI-B ping issue. +
+
+
PAN-300192
+ 		+
+ If the Host Compliance Service is configured with a service route + pointing to an unreachable IP address, the + gp_broker process may stop + working when you enable-disable the Host Compliance Service. +
+
+
PAN-300114
+ 		+
+ VM entered maintenance mode during a downgrade from version 12.1.2 to + 11.2.7, when executed through the CLI. +
+
+ Workaround: Download and install the required + version of PAN-OS through the UI instead of the CLI. +
+
+
PAN-300069
+ 		+
+ (PA-410 firewall only) Loading a saved config + file can take up to 5 minutes. +
+
+
PAN-300053
+ 		+
+ When you use the CLI command + request system fqdn refresh to + trigger another IP address resolution of configured FQDN entries, the + firewall might get into an error state where the DNS Proxy cache + received and stored a new IP address for a particular FQDN entry via + this command. However, the Device-Server (and the Security rule) still + have the old IP address for that FQDN entry. +
+
+ Workaround: Avoid using the CLI command: + request system fqdn refresh. Use the + following command instead (for a particular domain-name or an entire + list): + clear dns-proxy cache all domain-name <domain_name>. To correct the error state where the DNS Proxy cache and + Device-Server and Security rule are already storing different IP + addresses, use the following CLI command: + debug device-server dump fqdn type resync vsys <vsys_name> + fqdn-name <domain_name> +
+
+
PAN-300025
+ 		+
+ If Azure hotplug events occur, the firewall may experience a + brdagent crash and data interfaces + may transition to an unknown state, leading to traffic disruption. +
+
+ Workaround: Reboot the VM if the + brdagent crash does not trigger a + device reboot. +
+
+
PAN-299562
+ 		+
+ SSL proxy sessions fail when clients send a Client Hello with TLSv1.2 + and TLSv1.3, and exclusively prefer the secp192 elliptic curve. +
+
+ Workaround: To address this, configure a + decryption profile to use TLSv1.2 as the maximum supported TLS + version. Then, apply this profile to the decryption policy rules for + the affected clients and servers. This enables the client to modify + its preferred curves, facilitating successful session establishment. +
+
PAN-299387 +
+ (NGFW Cluster) When an NGFW cluster has only + one firewall node present and powered up, that node is stuck in + UNKNOWN state after you reboot it and it comes back up. The issue + occurs in two scenarios: +
+
    +
  • + When there is only one node configured in the cluster (no peer is + available or configured). +
    • +
  • + When the peer device in the cluster is completely powered down or + unable to autonegotiate its connected HSCI ports. That is, two nodes + are in the cluster, but only one node is booting up while the other + remains down completely. +
    • +
+
+ The expected behavior is that if no peer device is available (at a + port autonegotiation or link level for HSCI-A or HSCI-B), then a + cluster device should go to INITIAL state, followed by ONLINE state + (and not remain in UNKNOWN state). +
+
+ Workaround: To avoid this issue, connect the + HSCI-A to HSCI-B in loopback to create a link partner. +
+
PAN-299229 +
+ On PA-5400 Series and PA-7500 Series firewalls, if you run certain + types of CLI commands during or shortly after a commit, the commands + will time out. The types of CLI commands impacted by this issue are + IoT, Cloud-User-ID, and App-ID Cloud Engine CLI commands. +
+
+ Workaround: Don't execute IoT, Cloud-User-ID, or + App-ID Cloud Engine CLI commands during or shortly after a commit on a + PA-5400 Series or PA-7500 Series firewall. +
+
PAN-299170 +
+ The remediation link included in the generated PDF of an upgrade check + report might be pruned due to a text length limitation of the export + function. The link remains fully functional and works correctly on the + Panorama web interface. +
+
PAN-299114 +
+ After you enable the + Enable Duplicate Logging (Cloud and On-Premise) setting on a firewall, clicking + Status for Cloud Logging, does not + display the logging service connection status. +
+
PAN-298540 +
+ (PA-5500 Series firewalls only) The + Monitor tab in the Web Interface + does not display a pop-up to indicate that high-speed log forwarding + is enabled and that logs are only viewable from Panorama. +
+
PAN-298083 +
+ After you change the system mode on an M-700 appliance from Panorama + mode to PAN-DB private cloud mode, the + snmpd process fails to work. +
+
PAN-298047 +
+ In an AI Runtime Security environment, the Azure Container outbound + traffic does not seem to be functional and the egress traffic is being + misdirected to an incorrect cluster node port. +
+
PAN-297772 +
+ When an Intel e810 NIC is configured in SR-IOV mode, sharing Virtual + Functions (VFs) among multiple HSF cluster nodes and subsequently + rebooting a cluster node while traffic is active may result in traffic + disruption on other HSF cluster nodes utilizing the same NIC. It is + recommended to refrain from sharing Intel e810 VFs across cluster + nodes and to allocate one VF per Intel e810 PF. +
+
+
PAN-297610
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ A firewall may become unresponsive after an upgrade due to the `fsck` + command scanning drive partitions in parallel with the root partition, + causing the process to take an extended amount of time. +
+
+
PAN-297114
+ 		+
+ After successfully generating a health check report for managed + firewalls from Panorama, the progress bar does not appear and the + latest health check reports are not displayed (Panorama > Device Deployment > Upgrade Check). +
+
+ Workaround: Manually refresh the page to see the + latest reports. +
+
+
PAN-294687
+ 		+
+ (NGFW Clusters) In an NGFW cluster, the leader + can't retrieve the HIP Report from Panorama, nor synchronize it to the + non-leader nodes. Unlike HA Active/Passive mode, both leader and + non-leader nodes receive traffic in cluster mode. If the relevant HIP + Report is missing, policies involving HIP may not work properly. The + expected behavior is that when a non-leader node receives related + traffic, it should request the corresponding HIP Report from the + leader. +
+
+
PAN-293754
+ 		+
+ (NGFW Clusters) Firewalls in an NGFW cluster + indicate they are in ONLINE state even though their configurations are + different (they aren't synchronized). +
+
+ Workaround: Push the configuration from Panorama + to all cluster members at the same time; don't push to an individual + firewall. If a cluster member isn't connected to Panorama during the + push, the push will fail to the disconnected firewall, but will + succeed to all connected firewalls. +
+
+
PAN-293718
+ 		+
+ When high speed logging is enabled on a PA-5560 device, the expected + warning message is not displayed on the web interface. This prevents + administrators from being notified that logs can only be viewed from + Panorama. +
+
+
PAN-292601
+ 		+
+ PAN-OS 12.1.2 and later 12.1 releases support a Load Balanced DNS + configuration for an address object. If there are two address objects + with same FQDN, but one object has Load Balanced DNS enabled and other + object has Load Balanced DNS disabled, then the policy match for the + removed IP addresses doesn't work as expected. +
+
+ Workaround: Enable (or disable) Load Balanced DNS + consistently for an FQDN that is used with multiple address objects. +
+
+
PAN-290692
+ 		+
+ In Host Compliance Service, when you create a 'Shared' type Host + Compliance Object for the 'Disk-Encryption' category, the State + drop-down is automatically selected and cannot be edited. However, you + can change the state later by editing the object, if required. +
+
+
PAN-289524
+ 		+
+ In PAN-OS 12.1.2 and later 12.1 releases, PAN-OS can obtain resolved + IP addresses from a Load balanced DNS server and use them in a policy + match. However, this functionality does not work as intended when the + DNS cache reuse flag is enabled. When the DNS cache reuse flag is + enabled, the DNS resolution works as if the Load balanced DNS flag + (for an Address object) is disabled. +
+
+
PAN-286496
+ 		+
+ (NGFW Clusters) URL-continue and override + continue selections will function like a general URL-block action. +
+
+
PAN-283429
+ 		+
+ When you use custom certificates for the connection between Panorama + and a log collector, the automated renewal for the predefined + ElasticSearch certificates gets disrupted. +
+
+ Workaround: Remove the custom certificates before + the ElasticSearch certificates expire. This allows the system to + correctly identify and renew the predefined ElasticSearch + certificates. After the renewal is complete, re-install the custom + certificates. +
+
+
PAN-283053
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ (PA-7000 Series with Log Forwarding Card only) + When the firewall is configured to forward logs to an external log + collector or Strata Logging Service, the firewall root partition may + reach high disk utilization, which can cause the firewall to become + non-functional. This occurs when the log collector is temporarily + unavailable or unable to process logs at the rate the firewall is + sending them. +
+
+ Workaround: To help prevent this issue, ensure + network connectivity between the firewall and log collector is stable + and verify that the log collector has sufficient capacity to handle + the volume of logs generated by your deployment. +
+
+
PAN-237106
+ 		+
+ LSVPN satellite certificates may be generated with serial numbers + exceeding 40 hexadecimal characters. This causes certificate + revocation and deletion operations to fail with the following error + messages: +
+
    +
  • + db-serialno can be at most 40 characters +
    • +
  • + db-serialno is invalid +
    • +
+ Workaround: +
+ To resolve this issue, use the following CLI commands with the LSVPN + satellite serial number to manually delete or revoke the affected + certificates: +
+
+ Delete certificate information:delete sslmgr-store certificate-info portal name + <name> serialno + <satellite_serial> +
+
+ Revoke satellite certificates:delete sslmgr-store satellite-info-revoke-certificate portal + <name> serialno + <list_of_satellite_serials> +
+
+
PLUG-21065
+ 		+
+ In a PA-VM or AI Runtime Security environment, it is observed that the + Software Firewall Orchestration plugin deployed with a VM-Flex license + and configured with 8-14 GB of memory may encounter traffic + disruptions when jumbo frames are enabled. It is recommended to + disable jumbo frames on these lower-end VMs in version 12.1.2 by + executing the command: set system setting jumbo-frame off. +
+
+
PLUG-19238
+ 		+
+ Enabling Advanced Routing through bootstrap on VM-Series and Prisma + AIRS is not supported. +
+ Workaround: After the firewall boots up, enable + advanced routing using the CLI command set device-management + general-settings advance-routing yes or enable + advanced routing + through the UI. +
+
DRS-6556
+ 		+
+ For Host Compliance Service, while configuring Mappings & Tags in + CIE and when you click on the + HIP Report tab, the following error + message is displayed even when the response is successful: +
+
+ getaddrinfo ENOTFOUND null +
+
diff --git a/reference/PAN-OS/known/12.1.3.html b/reference/PAN-OS/known/12.1.3.html new file mode 100644 index 0000000..02b21c8 --- /dev/null +++ b/reference/PAN-OS/known/12.1.3.html @@ -0,0 +1,1123 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-314201
+
+ This issue is now resolved. See PAN-OS 12.1.6 Addressed Issues +
+ 		+
+ On firewalls running PAN-OS 12.1, IPsec VPN tunnels to third-party + peer devices may experience intermittent traffic loss during rekey + operations. When a new Security Association (SA) forms before the old + SA expires, traffic may stop flowing until the older SA naturally + expires or you manually clear it. During this time, the output of show + vpn ipsec-sa may show two SAs for the same proxy ID. This issue + primarily affects tunnels to third-party peer devices and does not + occur with Palo Alto Networks to Palo Alto Networks tunnels. +
+
+ Workaround: Manually clear the affected Security + Association using the command + clear vpn ipsec-sa tunnel <tunnel-name> + to restore connectivity. +
+
+
PAN-313623
+ 		+
+ On firewalls with TPM (Trusted Platform Module) support, device + certificate renewals may fail due to a disk partition being full. This + latter occurs because temporary files aren't being deleted during + device certificate status checks. +
+
+
PAN-309604
+ 		+
+ (PA-5500 series only) In some rare cases, the + front panel PSU status LED might show amber, even when the LEDs on the + PSU show green. +
+
+
PAN-309602
+ 		+
+ (PA-5500 series only) When the firewall is + initially powered on, the FAN-0 LED does not turn on. The fan + functions correctly, but the LED doesn't reflect the status. +
+
+ Workaround: Remove and reinsert the fan to turn on + the LED. +
+
+
PAN-308564
+ 		+
+ Packets are dropped on SD-WAN interfaces if they require fragmentation + for an interface but have the + Don't Fragment (DF) bit set. This + results in unexpected packet drops. This affects client to server + sessions when using SD-WAN for NGFW. +
+
+ Workaround: Allow fragmenting packets with DF bit + set (debug dataplane set ip4-ignore-df yes). +
+
+
PAN-308507
+
+ This issue is now resolved. See PAN-OS 12.1.6 Addressed Issues. +
+ 		+
+ Strata Logging Service (SLS) log-forwarding streams intermittently + show as inactive. When checking the status of log-forwarding + connections, one or more streams are reported as inactive. Restarting + the + log-receiver + process temporarily resolves the issue, but the streams become + inactive again after approximately 1-2 hours. This intermittent + inactivity results in log loss. +
+
+
PAN-307702
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ When LACP pre-negotiation is enabled on firewalls in HA + configurations, traffic passing through aggregate Ethernet (AE) + interfaces may be interrupted for several minutes during HA failovers. + This occurs because the suspended (formerly active) firewall continues + to forward packets for active sessions even after the failover + completes, causing MAC address flapping on neighboring switches. +
+
+
PAN-305880
+ 		+
+ (PA-7500 firewalls only) Intermittent internet + connectivity failures on the logging interface might trigger a + dataplane disconnect from Strata Logging Service (SLS) and WildFire + cloud. +
+
+
PAN-305301
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ The timing of GlobalProtect lifetime expiry or inactivity logout + notifications used for GlobalProtect SSL tunnels may cause the + pan_task + process to stop responding and the dataplane to restart. +
+
+ Workaround: Select + Network > GlobalProtect > Gateways > + <gateway-config> > Agent > <agent-config> > + Connection Settings + and change the value of both + Notify Before Lifetime Expires (min) + and + Notify Before Inactivity Logout (min) + to 0. +
+
+
PAN-304718
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ When using GlobalProtect Clientless VPN, the firewall may restart + unexpectedly, causing routing protocol (OSPF and BGP) outages. This + issue occurs during web content processing for clientless VPN + sessions. +
+
+ Workaround: To prevent this issue until you can + upgrade to a fixed release, disable clientless VPN in your + GlobalProtect portal configuration. +
+
+
PAN-304576
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ Traffic interruption may occur when inspection of HTTP/2 traffic is + enabled. +
+
+ Workaround: Disable HTTP/2 server push using the + set deviceconfig setting http2 server-push no + CLI command. +
+
+
PAN-303959
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ Traffic that is incorrectly identified as unknown-tcp/unknown-udp + eventually drops due to an App-ID resource limitation issue. +
+
+
PAN-303663
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ After upgrading to an affected release, SNMP monitoring systems such + as SolarWinds may report 100% usage for hardware packet buffers on + PA-3400 Series and PA-5450 firewalls, even when the firewall is idle + and packet buffer utilization is normal. The packet buffer utilization + oid is fixed to not show incorrect values. +
+
+
PAN-300850
+ 		+
+ Manual scheduling of cloud verdicts is required if a new host in an + Host Compliance Service-enabled environment has a refresh event entry + without a corresponding update event entry. +
+
+
PAN-300809
+ 		+
+ Host Compliance Service connectivity will not work if it is connected + with management IP which is configured with DHCP mode. +
+
+
PAN-300677
+ 		+
+ Panorama cannot display Threat log entries (Monitor > Logs > Threat) when the managed log collector is running a lower PAN-OS release + than Panorama. +
+
+ Workaround: Upgrade the log collectors to the same version as + Panorama. +
+
+
PAN-300671
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ Traffic reports that display destination/source IP addresses or + destination/source hostnames may incorrectly show IPv4 addresses in + IPv6 format (for example, ::ffff:x.x.x.x). This issue affects both + custom reports and scheduled reports, including PDF exports. +
+
+
PAN-300627
+ 		+
+ AutoCommit fails when the Traffic Object is used on AI Runtime + Security, which consequently impacts the workloads that utilize + overlapping subnets. +
+
+
PAN-300483
+ 		+
+ (PA-7500 firewall only) Enabling FIPS-CC mode + causes the firewall to go into maintenance mode. +
+
+ Workaround: After the firewall goes into + maintenance mode, perform an additional reboot. The firewall will + successfully start up in FIPS-CC mode. +
+
+
PAN-300467
+ 		+
+ WildFire WF-500 appliances running PAN-OS 10.x or PAN-OS 11.x cannot + be managed by Panorama running PAN-OS 12.1.2 due to connectivity + issues. +
+
+ Workaround: Upgrade your WildFire appliances to + PAN-OS 12.1.2 or later. +
+
+
PAN-300407
+ 		+
+ The Release Note URL column in the Panorama > Plugins page is + empty. +
+
+ Release Notes for the plugins are available in the + plugins release notes + or in their individual product release notes. +
+
+
PAN-300230
+ 		+
+ (NGFW Cluster) In an NGFW cluster, your pings + to the HSCI-B link might fail, even when the link indicates it is up. + In the event that the HSCI-A link is brought down or unplugged, the + cluster node will transition to failed state, avoiding split brain as + both HSCI links are down in this case. +
+
+ Workaround: Reboot the cluster node to resolve the + HSCI-B ping issue. +
+
+
PAN-300192
+ 		+
+ If the Host Compliance Service is configured with a service route + pointing to an unreachable IP address, the + gp_broker process may stop + working when you enable-disable the Host Compliance Service. +
+
+
PAN-300114
+ 		+
+ VM entered maintenance mode during a downgrade from version 12.1.2 to + 11.2.7, when executed through the CLI. +
+
+ Workaround: Download and install the required + version of PAN-OS through the UI instead of the CLI. +
+
+
PAN-300069
+ 		+
+ (PA-410 firewall only) Loading a saved config + file can take up to 5 minutes. +
+
+
PAN-300053
+ 		+
+ When you use the CLI command + request system fqdn refresh to + trigger another IP address resolution of configured FQDN entries, the + firewall might get into an error state where the DNS Proxy cache + received and stored a new IP address for a particular FQDN entry via + this command. However, the Device-Server (and the Security rule) still + have the old IP address for that FQDN entry. +
+
+ Workaround: Avoid using the CLI command: + request system fqdn refresh. Use the + following command instead (for a particular domain-name or an entire + list): + clear dns-proxy cache all domain-name <domain_name>. To correct the error state where the DNS Proxy cache and + Device-Server and Security rule are already storing different IP + addresses, use the following CLI command: + debug device-server dump fqdn type resync vsys <vsys_name> + fqdn-name <domain_name> +
+
+
PAN-300025
+ 		+
+ If Azure hotplug events occur, the firewall may experience a + brdagent crash and data interfaces + may transition to an unknown state, leading to traffic disruption. +
+
+ Workaround: Reboot the VM if the + brdagent crash does not trigger a + device reboot. +
+
+
PAN-299562
+ 		+
+ SSL proxy sessions fail when clients send a Client Hello with TLSv1.2 + and TLSv1.3, and exclusively prefer the secp192 elliptic curve. +
+
+ Workaround: To address this, configure a + decryption profile to use TLSv1.2 as the maximum supported TLS + version. Then, apply this profile to the decryption policy rules for + the affected clients and servers. This enables the client to modify + its preferred curves, facilitating successful session establishment. +
+
PAN-299387 +
+ (NGFW Cluster) When an NGFW cluster has only + one firewall node present and powered up, that node is stuck in + UNKNOWN state after you reboot it and it comes back up. The issue + occurs in two scenarios: +
+
    +
  • + When there is only one node configured in the cluster (no peer is + available or configured). +
    • +
  • + When the peer device in the cluster is completely powered down or + unable to autonegotiate its connected HSCI ports. That is, two nodes + are in the cluster, but only one node is booting up while the other + remains down completely. +
    • +
+
+ The expected behavior is that if no peer device is available (at a + port autonegotiation or link level for HSCI-A or HSCI-B), then a + cluster device should go to INITIAL state, followed by ONLINE state + (and not remain in UNKNOWN state). +
+
+ Workaround: To avoid this issue, connect the + HSCI-A to HSCI-B in loopback to create a link partner. +
+
PAN-299229 +
+ On PA-5400 Series and PA-7500 Series firewalls, if you run certain + types of CLI commands during or shortly after a commit, the commands + will time out. The types of CLI commands impacted by this issue are + IoT, Cloud-User-ID, and App-ID Cloud Engine CLI commands. +
+
+ Workaround: Don't execute IoT, Cloud-User-ID, or + App-ID Cloud Engine CLI commands during or shortly after a commit on a + PA-5400 Series or PA-7500 Series firewall. +
+
PAN-299170 +
+ The remediation link included in the generated PDF of an upgrade check + report might be pruned due to a text length limitation of the export + function. The link remains fully functional and works correctly on the + Panorama web interface. +
+
PAN-299114 +
+ After you enable the + Enable Duplicate Logging (Cloud and On-Premise) setting on a firewall, clicking + Status for Cloud Logging, does not + display the logging service connection status. +
+
PAN-298540 +
+ (PA-5500 Series firewalls only) The + Monitor tab in the Web Interface + does not display a pop-up to indicate that high-speed log forwarding + is enabled and that logs are only viewable from Panorama. +
+
+
PAN-298083
+ 		+
+ After you change the system mode on an M-700 appliance from Panorama + mode to PAN-DB private cloud mode, the + snmpd process fails to work. +
+
PAN-298047 +
+ In an AI Runtime Security environment, the Azure Container outbound + traffic does not seem to be functional and the egress traffic is being + misdirected to an incorrect cluster node port. +
+
PAN-297772 +
+ When an Intel e810 NIC is configured in SR-IOV mode, sharing Virtual + Functions (VFs) among multiple HSF cluster nodes and subsequently + rebooting a cluster node while traffic is active may result in traffic + disruption on other HSF cluster nodes utilizing the same NIC. It is + recommended to refrain from sharing Intel e810 VFs across cluster + nodes and to allocate one VF per Intel e810 PF. +
+
+
PAN-297610
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ A firewall may become unresponsive after an upgrade due to the `fsck` + command scanning drive partitions in parallel with the root partition, + causing the process to take an extended amount of time. +
+
+
PAN-297114
+ 		+
+ After successfully generating a health check report for managed + firewalls from Panorama, the progress bar does not appear and the + latest health check reports are not displayed (Panorama > Device Deployment > Upgrade Check). +
+
+ Workaround: Manually refresh the page to see the + latest reports. +
+
+
PAN-295803
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues +
+ 		+
+ A configd memory leak occurs post + commit (during Panorama connectivity check), potentially leading to + OOM (out of memory condition) and device reboot. +
+
+
PAN-294687
+ 		+
+ (NGFW Clusters) In an NGFW cluster, the leader + can't retrieve the HIP Report from Panorama, nor synchronize it to the + non-leader nodes. Unlike HA Active/Passive mode, both leader and + non-leader nodes receive traffic in cluster mode. If the relevant HIP + Report is missing, policies involving HIP may not work properly. The + expected behavior is that when a non-leader node receives related + traffic, it should request the corresponding HIP Report from the + leader. +
+
+
PAN-293754
+ 		+
+ (NGFW Clusters) Firewalls in an NGFW cluster + indicate they are in ONLINE state even though their configurations are + different (they aren't synchronized). +
+
+ Workaround: Push the configuration from Panorama + to all cluster members at the same time; don't push to an individual + firewall. If a cluster member isn't connected to Panorama during the + push, the push will fail to the disconnected firewall, but will + succeed to all connected firewalls. +
+
+
PAN-293718
+ 		+
+ When high speed logging is enabled on a PA-5560 device, the expected + warning message is not displayed on the web interface. This prevents + administrators from being notified that logs can only be viewed from + Panorama. +
+
+
PAN-292601
+ 		+
+ PAN-OS 12.1.2 and later 12.1 releases support a Load Balanced DNS + configuration for an address object. If there are two address objects + with same FQDN, but one object has Load Balanced DNS enabled and other + object has Load Balanced DNS disabled, then the policy match for the + removed IP addresses doesn't work as expected. +
+
+ Workaround: Enable (or disable) Load Balanced DNS + consistently for an FQDN that is used with multiple address objects. +
+
+
PAN-290692
+ 		+
+ In Host Compliance Service, when you create a 'Shared' type Host + Compliance Object for the 'Disk-Encryption' category, the State + drop-down is automatically selected and cannot be edited. However, you + can change the state later by editing the object, if required. +
+
+
PAN-289524
+ 		+
+ In PAN-OS 12.1.2 and later 12.1 releases, PAN-OS can obtain resolved + IP addresses from a Load balanced DNS server and use them in a policy + match. However, this functionality does not work as intended when the + DNS cache reuse flag is enabled. When the DNS cache reuse flag is + enabled, the DNS resolution works as if the Load balanced DNS flag + (for an Address object) is disabled. +
+
+
PAN-286496
+ 		+
+ (NGFW Clusters) URL-continue and override + continue selections will function like a general URL-block action. +
+
+
PAN-283429
+ 		+
+ When you use custom certificates for the connection between Panorama + and a log collector, the automated renewal for the predefined + ElasticSearch certificates gets disrupted. +
+
+ Workaround: Remove the custom certificates before + the ElasticSearch certificates expire. This allows the system to + correctly identify and renew the predefined ElasticSearch + certificates. After the renewal is complete, re-install the custom + certificates. +
+
+
PAN-283053
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ (PA-7000 Series with Log Forwarding Card only) + When the firewall is configured to forward logs to an external log + collector or Strata Logging Service, the firewall root partition may + reach high disk utilization, which can cause the firewall to become + non-functional. This occurs when the log collector is temporarily + unavailable or unable to process logs at the rate the firewall is + sending them. +
+
+ Workaround: To help prevent this issue, ensure + network connectivity between the firewall and log collector is stable + and verify that the log collector has sufficient capacity to handle + the volume of logs generated by your deployment. +
+
+
PAN-237106
+ 		+
+ LSVPN satellite certificates may be generated with serial numbers + exceeding 40 hexadecimal characters. This causes certificate + revocation and deletion operations to fail with the following error + messages: +
+
    +
  • + db-serialno can be at most 40 characters +
    • +
  • + db-serialno is invalid +
    • +
+ Workaround: +
+ To resolve this issue, use the following CLI commands with the LSVPN + satellite serial number to manually delete or revoke the affected + certificates: +
+
+ Delete certificate information:delete sslmgr-store certificate-info portal name + <name> serialno + <satellite_serial> +
+
+ Revoke satellite certificates:delete sslmgr-store satellite-info-revoke-certificate portal + <name> serialno + <list_of_satellite_serials> +
+
+
PLUG-21065
+ 		+
+ In a PA-VM or AI Runtime Security environment, it is observed that the + Software Firewall Orchestration plugin deployed with a VM-Flex license + and configured with 8-14 GB of memory may encounter traffic + disruptions when jumbo frames are enabled. It is recommended to + disable jumbo frames on these lower-end VMs in version 12.1.2 by + executing the command: set system setting jumbo-frame off. +
+
+
PLUG-19238
+ 		+
+ Enabling Advanced Routing through bootstrap on VM-Series and Prisma + AIRS is not supported. +
+ Workaround: After the firewall boots up, enable + advanced routing using the CLI command set device-management + general-settings advance-routing yes or enable + advanced routing + through the UI. +
+
DRS-6556
+ 		+
+ For Host Compliance Service, while configuring Mappings & Tags in + CIE and when you click on the + HIP Report tab, the following error + message is displayed even when the response is successful: +
+
+ getaddrinfo ENOTFOUND null +
+
diff --git a/reference/PAN-OS/known/12.1.4.html b/reference/PAN-OS/known/12.1.4.html new file mode 100644 index 0000000..658a96f --- /dev/null +++ b/reference/PAN-OS/known/12.1.4.html @@ -0,0 +1,1147 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-314201
+
+ This issue is now resolved. See PAN-OS 12.1.6 Addressed Issues +
+ 		+
+ On firewalls running PAN-OS 12.1, IPsec VPN tunnels to third-party + peer devices may experience intermittent traffic loss during rekey + operations. When a new Security Association (SA) forms before the old + SA expires, traffic may stop flowing until the older SA naturally + expires or you manually clear it. During this time, the output of show + vpn ipsec-sa may show two SAs for the same proxy ID. This issue + primarily affects tunnels to third-party peer devices and does not + occur with Palo Alto Networks to Palo Alto Networks tunnels. +
+
+ Workaround: Manually clear the affected Security + Association using the command + clear vpn ipsec-sa tunnel <tunnel-name> + to restore connectivity. +
+
+
PAN-313623
+ 		+
+ On firewalls with TPM (Trusted Platform Module) support, device + certificate renewals may fail due to a disk partition being full. This + latter occurs because temporary files aren't being deleted during + device certificate status checks. +
+
+
PAN-312706
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ Firewalls may restart unexpectedly due to an internal error in content + inspection processing. This issue can occur when the firewall is + performing antivirus scanning, URL filtering, or WildFire analysis. +
+
+
PAN-309604
+ 		+
+ (PA-5500 series only) In some rare cases, the + front panel PSU status LED might show amber, even when the LEDs on the + PSU show green. +
+
+
PAN-309602
+ 		+
+ (PA-5500 series only) When the firewall is + initially powered on, the FAN-0 LED does not turn on. The fan + functions correctly, but the LED doesn't reflect the status. +
+
+ Workaround: Remove and reinsert the fan to turn on + the LED. +
+
+
PAN-308564
+ 		+
+ Packets are dropped on SD-WAN interfaces if they require fragmentation + for an interface but have the + Don't Fragment (DF) bit set. This + results in unexpected packet drops. This affects client to server + sessions when using SD-WAN for NGFW. +
+
+ Workaround: Allow fragmenting packets with DF bit + set (debug dataplane set ip4-ignore-df yes). +
+
+
PAN-308507
+
+ This issue is now resolved. See PAN-OS 12.1.6 Addressed Issues. +
+ 		+
+ Strata Logging Service (SLS) log-forwarding streams intermittently + show as inactive. When checking the status of log-forwarding + connections, one or more streams are reported as inactive. Restarting + the + log-receiver + process temporarily resolves the issue, but the streams become + inactive again after approximately 1-2 hours. This intermittent + inactivity results in log loss. +
+
+
PAN-307702
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ When LACP pre-negotiation is enabled on firewalls in HA + configurations, traffic passing through aggregate Ethernet (AE) + interfaces may be interrupted for several minutes during HA failovers. + This occurs because the suspended (formerly active) firewall continues + to forward packets for active sessions even after the failover + completes, causing MAC address flapping on neighboring switches. +
+
+
PAN-305880
+ 		+
+ (PA-7500 firewalls only) Intermittent internet + connectivity failures on the logging interface might trigger a + dataplane disconnect from Strata Logging Service (SLS) and WildFire + cloud. +
+
+
PAN-305301
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ The timing of GlobalProtect lifetime expiry or inactivity logout + notifications used for GlobalProtect SSL tunnels may cause the + pan_task + process to stop responding and the dataplane to restart. +
+
+ Workaround: Select + Network > GlobalProtect > Gateways > + <gateway-config> > Agent > <agent-config> > + Connection Settings + and change the value of both + Notify Before Lifetime Expires (min) + and + Notify Before Inactivity Logout (min) + to 0. +
+
+
PAN-304718
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ When using GlobalProtect Clientless VPN, the firewall may restart + unexpectedly, causing routing protocol (OSPF and BGP) outages. This + issue occurs during web content processing for clientless VPN + sessions. +
+
+ Workaround: To prevent this issue until you can + upgrade to a fixed release, disable clientless VPN in your + GlobalProtect portal configuration. +
+
+
PAN-304576
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ Traffic interruption may occur when inspection of HTTP/2 traffic is + enabled. +
+
+ Workaround: Disable HTTP/2 server push using the + set deviceconfig setting http2 server-push no + CLI command. +
+
+
PAN-303959
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ Traffic that is incorrectly identified as unknown-tcp/unknown-udp + eventually drops due to an App-ID resource limitation issue. +
+
+
PAN-303663
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ After upgrading to an affected release, SNMP monitoring systems such + as SolarWinds may report 100% usage for hardware packet buffers on + PA-3400 Series and PA-5450 firewalls, even when the firewall is idle + and packet buffer utilization is normal. The packet buffer utilization + oid is fixed to not show incorrect values. +
+
+
PAN-300850
+ 		+
+ Manual scheduling of cloud verdicts is required if a new host in an + Host Compliance Service-enabled environment has a refresh event entry + without a corresponding update event entry. +
+
+
PAN-300809
+ 		+
+ Host Compliance Service connectivity will not work if it is connected + with management IP which is configured with DHCP mode. +
+
+
PAN-300677
+ 		+
+ Panorama cannot display Threat log entries (Monitor > Logs > Threat) when the managed log collector is running a lower PAN-OS release + than Panorama. +
+
+ Workaround: Upgrade the log collectors to the same version as + Panorama. +
+
+
PAN-300671
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ Traffic reports that display destination/source IP addresses or + destination/source hostnames may incorrectly show IPv4 addresses in + IPv6 format (for example, ::ffff:x.x.x.x). This issue affects both + custom reports and scheduled reports, including PDF exports. +
+
+
PAN-300627
+ 		+
+ AutoCommit fails when the Traffic Object is used on AI Runtime + Security, which consequently impacts the workloads that utilize + overlapping subnets. +
+
+
PAN-300483
+ 		+
+ (PA-7500 firewall only) Enabling FIPS-CC mode + causes the firewall to go into maintenance mode. +
+
+ Workaround: After the firewall goes into + maintenance mode, perform an additional reboot. The firewall will + successfully start up in FIPS-CC mode. +
+
+
PAN-300467
+ 		+
+ WildFire WF-500 appliances running PAN-OS 10.x or PAN-OS 11.x cannot + be managed by Panorama running PAN-OS 12.1.2 due to connectivity + issues. +
+
+ Workaround: Upgrade your WildFire appliances to + PAN-OS 12.1.2 or later. +
+
+
PAN-300407
+ 		+
+ The Release Note URL column in the Panorama > Plugins page is + empty. +
+
+ Release Notes for the plugins are available in the + plugins release notes + or in their individual product release notes. +
+
+
PAN-300230
+ 		+
+ (NGFW Cluster) In an NGFW cluster, your pings + to the HSCI-B link might fail, even when the link indicates it is up. + In the event that the HSCI-A link is brought down or unplugged, the + cluster node will transition to failed state, avoiding split brain as + both HSCI links are down in this case. +
+
+ Workaround: Reboot the cluster node to resolve the + HSCI-B ping issue. +
+
+
PAN-300192
+ 		+
+ If the Host Compliance Service is configured with a service route + pointing to an unreachable IP address, the + gp_broker process may stop + working when you enable-disable the Host Compliance Service. +
+
+
PAN-300114
+ 		+
+ VM entered maintenance mode during a downgrade from version 12.1.2 to + 11.2.7, when executed through the CLI. +
+
+ Workaround: Download and install the required + version of PAN-OS through the UI instead of the CLI. +
+
+
PAN-300069
+ 		+
+ (PA-410 firewall only) Loading a saved config + file can take up to 5 minutes. +
+
+
PAN-300053
+ 		+
+ When you use the CLI command + request system fqdn refresh to + trigger another IP address resolution of configured FQDN entries, the + firewall might get into an error state where the DNS Proxy cache + received and stored a new IP address for a particular FQDN entry via + this command. However, the Device-Server (and the Security rule) still + have the old IP address for that FQDN entry. +
+
+ Workaround: Avoid using the CLI command: + request system fqdn refresh. Use the + following command instead (for a particular domain-name or an entire + list): + clear dns-proxy cache all domain-name <domain_name>. To correct the error state where the DNS Proxy cache and + Device-Server and Security rule are already storing different IP + addresses, use the following CLI command: + debug device-server dump fqdn type resync vsys <vsys_name> + fqdn-name <domain_name> +
+
+
PAN-300025
+ 		+
+ If Azure hotplug events occur, the firewall may experience a + brdagent crash and data interfaces + may transition to an unknown state, leading to traffic disruption. +
+
+ Workaround: Reboot the VM if the + brdagent crash does not trigger a + device reboot. +
+
+
PAN-299562
+ 		+
+ SSL proxy sessions fail when clients send a Client Hello with TLSv1.2 + and TLSv1.3, and exclusively prefer the secp192 elliptic curve. +
+
+ Workaround: To address this, configure a + decryption profile to use TLSv1.2 as the maximum supported TLS + version. Then, apply this profile to the decryption policy rules for + the affected clients and servers. This enables the client to modify + its preferred curves, facilitating successful session establishment. +
+
PAN-299387 +
+ (NGFW Cluster) When an NGFW cluster has only + one firewall node present and powered up, that node is stuck in + UNKNOWN state after you reboot it and it comes back up. The issue + occurs in two scenarios: +
+
    +
  • + When there is only one node configured in the cluster (no peer is + available or configured). +
    • +
  • + When the peer device in the cluster is completely powered down or + unable to autonegotiate its connected HSCI ports. That is, two nodes + are in the cluster, but only one node is booting up while the other + remains down completely. +
    • +
+
+ The expected behavior is that if no peer device is available (at a + port autonegotiation or link level for HSCI-A or HSCI-B), then a + cluster device should go to INITIAL state, followed by ONLINE state + (and not remain in UNKNOWN state). +
+
+ Workaround: To avoid this issue, connect the + HSCI-A to HSCI-B in loopback to create a link partner. +
+
PAN-299229 +
+ On PA-5400 Series and PA-7500 Series firewalls, if you run certain + types of CLI commands during or shortly after a commit, the commands + will time out. The types of CLI commands impacted by this issue are + IoT, Cloud-User-ID, and App-ID Cloud Engine CLI commands. +
+
+ Workaround: Don't execute IoT, Cloud-User-ID, or + App-ID Cloud Engine CLI commands during or shortly after a commit on a + PA-5400 Series or PA-7500 Series firewall. +
+
PAN-299170 +
+ The remediation link included in the generated PDF of an upgrade check + report might be pruned due to a text length limitation of the export + function. The link remains fully functional and works correctly on the + Panorama web interface. +
+
PAN-299114 +
+ After you enable the + Enable Duplicate Logging (Cloud and On-Premise) setting on a firewall, clicking + Status for Cloud Logging, does not + display the logging service connection status. +
+
PAN-298540 +
+ (PA-5500 Series firewalls only) The + Monitor tab in the Web Interface + does not display a pop-up to indicate that high-speed log forwarding + is enabled and that logs are only viewable from Panorama. +
+
PAN-298083 +
+ After you change the system mode on an M-700 appliance from Panorama + mode to PAN-DB private cloud mode, the + snmpd process fails to work. +
+
PAN-298047 +
+ In an AI Runtime Security environment, the Azure Container outbound + traffic does not seem to be functional and the egress traffic is being + misdirected to an incorrect cluster node port. +
+
PAN-297772 +
+ When an Intel e810 NIC is configured in SR-IOV mode, sharing Virtual + Functions (VFs) among multiple HSF cluster nodes and subsequently + rebooting a cluster node while traffic is active may result in traffic + disruption on other HSF cluster nodes utilizing the same NIC. It is + recommended to refrain from sharing Intel e810 VFs across cluster + nodes and to allocate one VF per Intel e810 PF. +
+
+
PAN-297610
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ A firewall may become unresponsive after an upgrade due to the `fsck` + command scanning drive partitions in parallel with the root partition, + causing the process to take an extended amount of time. +
+
+
PAN-297114
+ 		+
+ After successfully generating a health check report for managed + firewalls from Panorama, the progress bar does not appear and the + latest health check reports are not displayed (Panorama > Device Deployment > Upgrade Check). +
+
+ Workaround: Manually refresh the page to see the + latest reports. +
+
+
+ PAN-295803This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues +
+ 		+
+ A configd memory leak occurs post + commit (during Panorama connectivity check), potentially leading to + OOM (out of memory condition) and device reboot. +
+
+
PAN-294687
+ 		+
+ (NGFW Clusters) In an NGFW cluster, the leader + can't retrieve the HIP Report from Panorama, nor synchronize it to the + non-leader nodes. Unlike HA Active/Passive mode, both leader and + non-leader nodes receive traffic in cluster mode. If the relevant HIP + Report is missing, policies involving HIP may not work properly. The + expected behavior is that when a non-leader node receives related + traffic, it should request the corresponding HIP Report from the + leader. +
+
+
PAN-293754
+ 		+
+ (NGFW Clusters) Firewalls in an NGFW cluster + indicate they are in ONLINE state even though their configurations are + different (they aren't synchronized). +
+
+ Workaround: Push the configuration from Panorama + to all cluster members at the same time; don't push to an individual + firewall. If a cluster member isn't connected to Panorama during the + push, the push will fail to the disconnected firewall, but will + succeed to all connected firewalls. +
+
+
PAN-293718
+ 		+
+ When high speed logging is enabled on a PA-5560 device, the expected + warning message is not displayed on the web interface. This prevents + administrators from being notified that logs can only be viewed from + Panorama. +
+
+
PAN-292601
+ 		+
+ PAN-OS 12.1.2 and later 12.1 releases support a Load Balanced DNS + configuration for an address object. If there are two address objects + with same FQDN, but one object has Load Balanced DNS enabled and other + object has Load Balanced DNS disabled, then the policy match for the + removed IP addresses doesn't work as expected. +
+
+ Workaround: Enable (or disable) Load Balanced DNS + consistently for an FQDN that is used with multiple address objects. +
+
+
PAN-290692
+ 		+
+ In Host Compliance Service, when you create a 'Shared' type Host + Compliance Object for the 'Disk-Encryption' category, the State + drop-down is automatically selected and cannot be edited. However, you + can change the state later by editing the object, if required. +
+
+
PAN-289524
+ 		+
+ In PAN-OS 12.1.2 and later 12.1 releases, PAN-OS can obtain resolved + IP addresses from a Load balanced DNS server and use them in a policy + match. However, this functionality does not work as intended when the + DNS cache reuse flag is enabled. When the DNS cache reuse flag is + enabled, the DNS resolution works as if the Load balanced DNS flag + (for an Address object) is disabled. +
+
+
PAN-286496
+ 		+
+ (NGFW Clusters) URL-continue and override + continue selections will function like a general URL-block action. +
+
+
PAN-283429
+ 		+
+ When you use custom certificates for the connection between Panorama + and a log collector, the automated renewal for the predefined + ElasticSearch certificates gets disrupted. +
+
+ Workaround: Remove the custom certificates before + the ElasticSearch certificates expire. This allows the system to + correctly identify and renew the predefined ElasticSearch + certificates. After the renewal is complete, re-install the custom + certificates. +
+
+
PAN-283053
+
+ This issue is now resolved. See PAN-OS 12.1.5 Addressed Issues. +
+ 		+
+ (PA-7000 Series with Log Forwarding Card only) + When the firewall is configured to forward logs to an external log + collector or Strata Logging Service, the firewall root partition may + reach high disk utilization, which can cause the firewall to become + non-functional. This occurs when the log collector is temporarily + unavailable or unable to process logs at the rate the firewall is + sending them. +
+
+ Workaround: To help prevent this issue, ensure + network connectivity between the firewall and log collector is stable + and verify that the log collector has sufficient capacity to handle + the volume of logs generated by your deployment. +
+
+
PAN-237106
+ 		+
+ LSVPN satellite certificates may be generated with serial numbers + exceeding 40 hexadecimal characters. This causes certificate + revocation and deletion operations to fail with the following error + messages: +
+
    +
  • + db-serialno can be at most 40 characters +
    • +
  • + db-serialno is invalid +
    • +
+ Workaround: +
+ To resolve this issue, use the following CLI commands with the LSVPN + satellite serial number to manually delete or revoke the affected + certificates: +
+
+ Delete certificate information:delete sslmgr-store certificate-info portal name + <name> serialno + <satellite_serial> +
+
+ Revoke satellite certificates:delete sslmgr-store satellite-info-revoke-certificate portal + <name> serialno + <list_of_satellite_serials> +
+
+
PLUG-21065
+ 		+
+ In a PA-VM or AI Runtime Security environment, it is observed that the + Software Firewall Orchestration plugin deployed with a VM-Flex license + and configured with 8-14 GB of memory may encounter traffic + disruptions when jumbo frames are enabled. It is recommended to + disable jumbo frames on these lower-end VMs in version 12.1.2 by + executing the command: set system setting jumbo-frame off. +
+
+
PLUG-19238
+ 		+
+ Enabling Advanced Routing through bootstrap on VM-Series and Prisma + AIRS is not supported. +
+ Workaround: After the firewall boots up, enable + advanced routing using the CLI command set device-management + general-settings advance-routing yes or enable + advanced routing + through the UI. +
+
DRS-6556
+ 		+
+ For Host Compliance Service, while configuring Mappings & Tags in + CIE and when you click on the + HIP Report tab, the following error + message is displayed even when the response is successful: +
+
+ getaddrinfo ENOTFOUND null +
+
diff --git a/reference/PAN-OS/known/12.1.5.html b/reference/PAN-OS/known/12.1.5.html new file mode 100644 index 0000000..1c50df9 --- /dev/null +++ b/reference/PAN-OS/known/12.1.5.html @@ -0,0 +1,876 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-314201
+
+ This issue is now resolved. See PAN-OS 12.1.6 Addressed Issues +
+ 		+
+ On firewalls running PAN-OS 12.1, IPsec VPN tunnels to third-party + peer devices may experience intermittent traffic loss during rekey + operations. When a new Security Association (SA) forms before the old + SA expires, traffic may stop flowing until the older SA naturally + expires or you manually clear it. During this time, the output of show + vpn ipsec-sa may show two SAs for the same proxy ID. This issue + primarily affects tunnels to third-party peer devices and does not + occur with Palo Alto Networks to Palo Alto Networks tunnels. +
+
+ Workaround: Manually clear the affected Security + Association using the command + clear vpn ipsec-sa tunnel <tunnel-name> + to restore connectivity. +
+
+
PAN-313779
+ 		+
+ (PA-7500 series only) PA-7500 series firewalls + running PAN-OS 12.1.5 release do not support encryption on HA1 and + HA1-backup interfaces. As a result, attempting to execute the + request high-availability session-reestablish + command will fail with the following error. +
+
+ 
+ERROR: Encryption is not enabled for HA
+
+
+
PAN-313669
+ 		+
+ (PA-5500 Series firewalls in cluster configurations only) When a firewall node is removed from a PA-5500 Series cluster, + after the cluster commit and reboot, the node starts in standalone + mode with a default virtual wire (vwire) configuration loaded. This + default configuration is missing zone assignments for ports eth1/1 and + eth1/2, which causes commit operations to fail. Even if zones are + manually assigned to these ports, subsequent commit attempts will fail + with a + no UUId for rule1 + error. +
+
+ Workaround: To resolve this, either: +
+
+
    +
  • + Manually assign zone configurations to ports eth1/1 (for example, + untrust) and eth1/2 (for example, trust), then open and close + security policy rule1 without making changes, and + Commit. +
    • +
  • + Delete the default rule and the default virtual wire Ethernet + interfaces, then commit. +
    • +
+
+
+
PAN-313623
+ 		+
+ On firewalls with TPM (Trusted Platform Module) support, device + certificate renewals may fail due to a disk partition being full. This + latter occurs because temporary files aren't being deleted during + device certificate status checks. +
+
+
PAN-312247
+ 		+
+ In generated PDF upgrade check reports, long remediation URLs might be + truncated due to UI framework export limitations, leaving only the + first line hyperlinked. However, these links remain fully functional + within the Panorama web interface. The PDF link directs to the correct + destination if the complete URL is copied from the PDF and pasted in + the browser. +
+
+
PAN-309604
+ 		+
+ (PA-5500 series only) In some rare cases, the + front panel PSU status LED might show amber, even when the LEDs on the + PSU show green. +
+
+
PAN-309602
+ 		+
+ (PA-5500 series only) When the firewall is + initially powered on, the FAN-0 LED does not turn on. The fan + functions correctly, but the LED doesn't reflect the status. +
+
+ Workaround: Remove and reinsert the fan to turn on + the LED. +
+
+
PAN-308564
+ 		+
+ Packets are dropped on SD-WAN interfaces if they require fragmentation + for an interface but have the + Don't Fragment (DF) bit set. This + results in unexpected packet drops. This affects client to server + sessions when using SD-WAN for NGFW. +
+
+ Workaround: Allow fragmenting packets with DF bit + set (debug dataplane set ip4-ignore-df yes). +
+
+
PAN-308507
+
+ This issue is now resolved. See PAN-OS 12.1.6 Addressed Issues. +
+ 		+
+ Strata Logging Service (SLS) log-forwarding streams intermittently + show as inactive. When checking the status of log-forwarding + connections, one or more streams are reported as inactive. Restarting + the + log-receiver + process temporarily resolves the issue, but the streams become + inactive again after approximately 1-2 hours. This intermittent + inactivity results in log loss. +
+
+
PAN-300850
+ 		+
+ Manual scheduling of cloud verdicts is required if a new host in an + Host Compliance Service-enabled environment has a refresh event entry + without a corresponding update event entry. +
+
+
PAN-300809
+ 		+
+ Host Compliance Service connectivity will not work if it is connected + with management IP which is configured with DHCP mode. +
+
+
PAN-300677
+ 		+
+ Panorama cannot display Threat log entries (Monitor > Logs > Threat) when the managed log collector is running a lower PAN-OS release + than Panorama. +
+
+ Workaround: Upgrade the log collectors to the same version as + Panorama. +
+
+
PAN-300627
+ 		+
+ AutoCommit fails when the Traffic Object is used on AI Runtime + Security, which consequently impacts the workloads that utilize + overlapping subnets. +
+
+
PAN-300483
+ 		+
+ (PA-7500 firewall only) Enabling FIPS-CC mode + causes the firewall to go into maintenance mode. +
+
+ Workaround: After the firewall goes into + maintenance mode, perform an additional reboot. The firewall will + successfully start up in FIPS-CC mode. +
+
+
PAN-300467
+ 		+
+ WildFire WF-500 appliances running PAN-OS 10.x or PAN-OS 11.x cannot + be managed by Panorama running PAN-OS 12.1.2 due to connectivity + issues. +
+
+ Workaround: Upgrade your WildFire appliances to + PAN-OS 12.1.2 or later. +
+
+
PAN-300407
+ 		+
+ The Release Note URL column in the Panorama > Plugins page is + empty. +
+
+ Release Notes for the plugins are available in the + plugins release notes + or in their individual product release notes. +
+
+
PAN-300230
+ 		+
+ (NGFW Cluster) In an NGFW cluster, your pings + to the HSCI-B link might fail, even when the link indicates it is up. + In the event that the HSCI-A link is brought down or unplugged, the + cluster node will transition to failed state, avoiding split brain as + both HSCI links are down in this case. +
+
+ Workaround: Reboot the cluster node to resolve the + HSCI-B ping issue. +
+
+
PAN-300192
+ 		+
+ If the Host Compliance Service is configured with a service route + pointing to an unreachable IP address, the + gp_broker process may stop + working when you enable-disable the Host Compliance Service. +
+
+
PAN-300114
+ 		+
+ VM entered maintenance mode during a downgrade from version 12.1.2 to + 11.2.7, when executed through the CLI. +
+
+ Workaround: Download and install the required + version of PAN-OS through the UI instead of the CLI. +
+
+
PAN-300069
+ 		+
+ (PA-410 firewall only) Loading a saved config + file can take up to 5 minutes. +
+
+
PAN-300053
+ 		+
+ When you use the CLI command + request system fqdn refresh to + trigger another IP address resolution of configured FQDN entries, the + firewall might get into an error state where the DNS Proxy cache + received and stored a new IP address for a particular FQDN entry via + this command. However, the Device-Server (and the Security rule) still + have the old IP address for that FQDN entry. +
+
+ Workaround: Avoid using the CLI command: + request system fqdn refresh. Use the + following command instead (for a particular domain-name or an entire + list): + clear dns-proxy cache all domain-name <domain_name>. To correct the error state where the DNS Proxy cache and + Device-Server and Security rule are already storing different IP + addresses, use the following CLI command: + debug device-server dump fqdn type resync vsys <vsys_name> + fqdn-name <domain_name> +
+
+
PAN-300025
+ 		+
+ If Azure hotplug events occur, the firewall may experience a + brdagent crash and data interfaces + may transition to an unknown state, leading to traffic disruption. +
+
+ Workaround: Reboot the VM if the + brdagent crash does not trigger a + device reboot. +
+
+
PAN-299562
+ 		+
+ SSL proxy sessions fail when clients send a Client Hello with TLSv1.2 + and TLSv1.3, and exclusively prefer the secp192 elliptic curve. +
+
+ Workaround: To address this, configure a + decryption profile to use TLSv1.2 as the maximum supported TLS + version. Then, apply this profile to the decryption policy rules for + the affected clients and servers. This enables the client to modify + its preferred curves, facilitating successful session establishment. +
+
PAN-299387 +
+ (NGFW Cluster) When an NGFW cluster has only + one firewall node present and powered up, that node is stuck in + UNKNOWN state after you reboot it and it comes back up. The issue + occurs in two scenarios: +
+
    +
  • + When there is only one node configured in the cluster (no peer is + available or configured). +
    • +
  • + When the peer device in the cluster is completely powered down or + unable to autonegotiate its connected HSCI ports. That is, two nodes + are in the cluster, but only one node is booting up while the other + remains down completely. +
    • +
+
+ The expected behavior is that if no peer device is available (at a + port autonegotiation or link level for HSCI-A or HSCI-B), then a + cluster device should go to INITIAL state, followed by ONLINE state + (and not remain in UNKNOWN state). +
+
+ Workaround: To avoid this issue, connect the + HSCI-A to HSCI-B in loopback to create a link partner. +
+
PAN-299229 +
+ On PA-5400 Series and PA-7500 Series firewalls, if you run certain + types of CLI commands during or shortly after a commit, the commands + will time out. The types of CLI commands impacted by this issue are + IoT, Cloud-User-ID, and App-ID Cloud Engine CLI commands. +
+
+ Workaround: Don't execute IoT, Cloud-User-ID, or + App-ID Cloud Engine CLI commands during or shortly after a commit on a + PA-5400 Series or PA-7500 Series firewall. +
+
PAN-299170 +
+ The remediation link included in the generated PDF of an upgrade check + report might be pruned due to a text length limitation of the export + function. The link remains fully functional and works correctly on the + Panorama web interface. +
+
PAN-299114 +
+ After you enable the + Enable Duplicate Logging (Cloud and On-Premise) setting on a firewall, clicking + Status for Cloud Logging, does not + display the logging service connection status. +
+
PAN-298540 +
+ (PA-5500 Series firewalls only) The + Monitor tab in the Web Interface + does not display a pop-up to indicate that high-speed log forwarding + is enabled and that logs are only viewable from Panorama. +
+
PAN-298083 +
+ After you change the system mode on an M-700 appliance from Panorama + mode to PAN-DB private cloud mode, the + snmpd process fails to work. +
+
PAN-298047 +
+ In an AI Runtime Security environment, the Azure Container outbound + traffic does not seem to be functional and the egress traffic is being + misdirected to an incorrect cluster node port. +
+
PAN-297772 +
+ When an Intel e810 NIC is configured in SR-IOV mode, sharing Virtual + Functions (VFs) among multiple HSF cluster nodes and subsequently + rebooting a cluster node while traffic is active may result in traffic + disruption on other HSF cluster nodes utilizing the same NIC. It is + recommended to refrain from sharing Intel e810 VFs across cluster + nodes and to allocate one VF per Intel e810 PF. +
+
+
PAN-297114
+ 		+
+ After successfully generating a health check report for managed + firewalls from Panorama, the progress bar does not appear and the + latest health check reports are not displayed (Panorama > Device Deployment > Upgrade Check). +
+
+ Workaround: Manually refresh the page to see the + latest reports. +
+
+
PAN-294687
+ 		+
+ (NGFW Clusters) In an NGFW cluster, the leader + can't retrieve the HIP Report from Panorama, nor synchronize it to the + non-leader nodes. Unlike HA Active/Passive mode, both leader and + non-leader nodes receive traffic in cluster mode. If the relevant HIP + Report is missing, policies involving HIP may not work properly. The + expected behavior is that when a non-leader node receives related + traffic, it should request the corresponding HIP Report from the + leader. +
+
+
PAN-293754
+ 		+
+ (NGFW Clusters) Firewalls in an NGFW cluster + indicate they are in ONLINE state even though their configurations are + different (they aren't synchronized). +
+
+ Workaround: Push the configuration from Panorama + to all cluster members at the same time; don't push to an individual + firewall. If a cluster member isn't connected to Panorama during the + push, the push will fail to the disconnected firewall, but will + succeed to all connected firewalls. +
+
+
PAN-293718
+ 		+
+ When high speed logging is enabled on a PA-5560 device, the expected + warning message is not displayed on the web interface. This prevents + administrators from being notified that logs can only be viewed from + Panorama. +
+
+
PAN-292601
+ 		+
+ PAN-OS 12.1.2 and later 12.1 releases support a Load Balanced DNS + configuration for an address object. If there are two address objects + with same FQDN, but one object has Load Balanced DNS enabled and other + object has Load Balanced DNS disabled, then the policy match for the + removed IP addresses doesn't work as expected. +
+
+ Workaround: Enable (or disable) Load Balanced DNS + consistently for an FQDN that is used with multiple address objects. +
+
+
PAN-290692
+ 		+
+ In Host Compliance Service, when you create a 'Shared' type Host + Compliance Object for the 'Disk-Encryption' category, the State + drop-down is automatically selected and cannot be edited. However, you + can change the state later by editing the object, if required. +
+
+
PAN-289524
+ 		+
+ In PAN-OS 12.1.2 and later 12.1 releases, PAN-OS can obtain resolved + IP addresses from a Load balanced DNS server and use them in a policy + match. However, this functionality does not work as intended when the + DNS cache reuse flag is enabled. When the DNS cache reuse flag is + enabled, the DNS resolution works as if the Load balanced DNS flag + (for an Address object) is disabled. +
+
+
PAN-286496
+ 		+
+ (NGFW Clusters) URL-continue and override + continue selections will function like a general URL-block action. +
+
+
PAN-283429
+ 		+
+ When you use custom certificates for the connection between Panorama + and a log collector, the automated renewal for the predefined + ElasticSearch certificates gets disrupted. +
+
+ Workaround: Remove the custom certificates before + the ElasticSearch certificates expire. This allows the system to + correctly identify and renew the predefined ElasticSearch + certificates. After the renewal is complete, re-install the custom + certificates. +
+
+
PAN-237106
+ 		+
+ LSVPN satellite certificates may be generated with serial numbers + exceeding 40 hexadecimal characters. This causes certificate + revocation and deletion operations to fail with the following error + messages: +
+
    +
  • + db-serialno can be at most 40 characters +
    • +
  • + db-serialno is invalid +
    • +
+ Workaround: +
+ To resolve this issue, use the following CLI commands with the LSVPN + satellite serial number to manually delete or revoke the affected + certificates: +
+
+ Delete certificate information:delete sslmgr-store certificate-info portal name + <name> serialno + <satellite_serial> +
+
+ Revoke satellite certificates:delete sslmgr-store satellite-info-revoke-certificate portal + <name> serialno + <list_of_satellite_serials> +
+
+
PLUG-21065
+ 		+
+ In a PA-VM or AI Runtime Security environment, it is observed that the + Software Firewall Orchestration plugin deployed with a VM-Flex license + and configured with 8-14 GB of memory may encounter traffic + disruptions when jumbo frames are enabled. It is recommended to + disable jumbo frames on these lower-end VMs in version 12.1.2 by + executing the command: set system setting jumbo-frame off. +
+
+
PLUG-19238
+ 		+
+ Enabling Advanced Routing through bootstrap on VM-Series and Prisma + AIRS is not supported. +
+ Workaround: After the firewall boots up, enable + advanced routing using the CLI command set device-management + general-settings advance-routing yes or enable + advanced routing + through the UI. +
+
DRS-6556
+ 		+
+ For Host Compliance Service, while configuring Mappings & Tags in + CIE and when you click on the + HIP Report tab, the following error + message is displayed even when the response is successful: +
+
+ getaddrinfo ENOTFOUND null +
+
diff --git a/reference/PAN-OS/known/12.1.6.html b/reference/PAN-OS/known/12.1.6.html new file mode 100644 index 0000000..3f497ce --- /dev/null +++ b/reference/PAN-OS/known/12.1.6.html @@ -0,0 +1,797 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-313779
+ 		+
+ (PA-7500 series only) PA-7500 series firewalls + running PAN-OS 12.1.5 release do not support encryption on HA1 and + HA1-backup interfaces. As a result, attempting to execute the + request high-availability session-reestablish + command will fail with the following error. +
+
+ 
+ERROR: Encryption is not enabled for HA
+
+
+
PAN-313669
+ 		+
+ (PA-5500 Series firewalls in cluster configurations only) When a firewall node is removed from a PA-5500 Series cluster, + after the cluster commit and reboot, the node starts in standalone + mode with a default virtual wire (vwire) configuration loaded. This + default configuration is missing zone assignments for ports eth1/1 and + eth1/2, which causes commit operations to fail. Even if zones are + manually assigned to these ports, subsequent commit attempts will fail + with a + no UUId for rule1 + error. +
+
+ Workaround: To resolve this, either: +
+
+
    +
  • + Manually assign zone configurations to ports eth1/1 (for example, + untrust) and eth1/2 (for example, trust), then open and close + security policy rule1 without making changes, and + Commit. +
    • +
  • + Delete the default rule and the default virtual wire Ethernet + interfaces, then commit. +
    • +
+
+
+
PAN-313623
+ 		+
+ On firewalls with TPM (Trusted Platform Module) support, device + certificate renewals may fail due to a disk partition being full. This + latter occurs because temporary files aren't being deleted during + device certificate status checks. +
+
+
PAN-312247
+ 		+
+ In generated PDF upgrade check reports, long remediation URLs might be + truncated due to UI framework export limitations, leaving only the + first line hyperlinked. However, these links remain fully functional + within the Panorama web interface. The PDF link directs to the correct + destination if the complete URL is copied from the PDF and pasted in + the browser. +
+
+
PAN-309604
+ 		+
+ (PA-5500 series only) In some rare cases, the + front panel PSU status LED might show amber, even when the LEDs on the + PSU show green. +
+
+
PAN-309602
+ 		+
+ (PA-5500 series only) When the firewall is + initially powered on, the FAN-0 LED does not turn on. The fan + functions correctly, but the LED doesn't reflect the status. +
+
+ Workaround: Remove and reinsert the fan to turn on + the LED. +
+
+
PAN-308564
+ 		+
+ Packets are dropped on SD-WAN interfaces if they require fragmentation + for an interface but have the + Don't Fragment (DF) bit set. This + results in unexpected packet drops. This affects client to server + sessions when using SD-WAN for NGFW. +
+
+ Workaround: Allow fragmenting packets with DF bit + set (debug dataplane set ip4-ignore-df yes). +
+
+
PAN-300850
+ 		+
+ Manual scheduling of cloud verdicts is required if a new host in an + Host Compliance Service-enabled environment has a refresh event entry + without a corresponding update event entry. +
+
+
PAN-300809
+ 		+
+ Host Compliance Service connectivity will not work if it is connected + with management IP which is configured with DHCP mode. +
+
+
PAN-300677
+ 		+
+ Panorama cannot display Threat log entries (Monitor > Logs > Threat) when the managed log collector is running a lower PAN-OS release + than Panorama. +
+
+ Workaround: Upgrade the log collectors to the same version as + Panorama. +
+
+
PAN-300627
+ 		+
+ AutoCommit fails when the Traffic Object is used on AI Runtime + Security, which consequently impacts the workloads that utilize + overlapping subnets. +
+
+
PAN-300483
+ 		+
+ (PA-7500 firewall only) Enabling FIPS-CC mode + causes the firewall to go into maintenance mode. +
+
+ Workaround: After the firewall goes into + maintenance mode, perform an additional reboot. The firewall will + successfully start up in FIPS-CC mode. +
+
+
PAN-300467
+ 		+
+ WildFire WF-500 appliances running PAN-OS 10.x or PAN-OS 11.x cannot + be managed by Panorama running PAN-OS 12.1.2 due to connectivity + issues. +
+
+ Workaround: Upgrade your WildFire appliances to + PAN-OS 12.1.2 or later. +
+
+
PAN-300407
+ 		+
+ The Release Note URL column in the Panorama > Plugins page is + empty. +
+
+ Release Notes for the plugins are available in the + plugins release notes + or in their individual product release notes. +
+
+
PAN-300230
+ 		+
+ (NGFW Cluster) In an NGFW cluster, your pings + to the HSCI-B link might fail, even when the link indicates it is up. + In the event that the HSCI-A link is brought down or unplugged, the + cluster node will transition to failed state, avoiding split brain as + both HSCI links are down in this case. +
+
+ Workaround: Reboot the cluster node to resolve the + HSCI-B ping issue. +
+
+
PAN-300192
+ 		+
+ If the Host Compliance Service is configured with a service route + pointing to an unreachable IP address, the + gp_broker process may stop + working when you enable-disable the Host Compliance Service. +
+
+
PAN-300114
+ 		+
+ VM entered maintenance mode during a downgrade from version 12.1.2 to + 11.2.7, when executed through the CLI. +
+
+ Workaround: Download and install the required + version of PAN-OS through the UI instead of the CLI. +
+
+
PAN-300069
+ 		+
+ (PA-410 firewall only) Loading a saved config + file can take up to 5 minutes. +
+
+
PAN-300053
+ 		+
+ When you use the CLI command + request system fqdn refresh to + trigger another IP address resolution of configured FQDN entries, the + firewall might get into an error state where the DNS Proxy cache + received and stored a new IP address for a particular FQDN entry via + this command. However, the Device-Server (and the Security rule) still + have the old IP address for that FQDN entry. +
+
+ Workaround: Avoid using the CLI command: + request system fqdn refresh. Use the + following command instead (for a particular domain-name or an entire + list): + clear dns-proxy cache all domain-name <domain_name>. To correct the error state where the DNS Proxy cache and + Device-Server and Security rule are already storing different IP + addresses, use the following CLI command: + debug device-server dump fqdn type resync vsys <vsys_name> + fqdn-name <domain_name> +
+
+
PAN-300025
+ 		+
+ If Azure hotplug events occur, the firewall may experience a + brdagent crash and data interfaces + may transition to an unknown state, leading to traffic disruption. +
+
+ Workaround: Reboot the VM if the + brdagent crash does not trigger a + device reboot. +
+
+
PAN-299562
+ 		+
+ SSL proxy sessions fail when clients send a Client Hello with TLSv1.2 + and TLSv1.3, and exclusively prefer the secp192 elliptic curve. +
+
+ Workaround: To address this, configure a + decryption profile to use TLSv1.2 as the maximum supported TLS + version. Then, apply this profile to the decryption policy rules for + the affected clients and servers. This enables the client to modify + its preferred curves, facilitating successful session establishment. +
+
PAN-299387 +
+ (NGFW Cluster) When an NGFW cluster has only + one firewall node present and powered up, that node is stuck in + UNKNOWN state after you reboot it and it comes back up. The issue + occurs in two scenarios: +
+
    +
  • + When there is only one node configured in the cluster (no peer is + available or configured). +
    • +
  • + When the peer device in the cluster is completely powered down or + unable to autonegotiate its connected HSCI ports. That is, two nodes + are in the cluster, but only one node is booting up while the other + remains down completely. +
    • +
+
+ The expected behavior is that if no peer device is available (at a + port autonegotiation or link level for HSCI-A or HSCI-B), then a + cluster device should go to INITIAL state, followed by ONLINE state + (and not remain in UNKNOWN state). +
+
+ Workaround: To avoid this issue, connect the + HSCI-A to HSCI-B in loopback to create a link partner. +
+
PAN-299229 +
+ On PA-5400 Series and PA-7500 Series firewalls, if you run certain + types of CLI commands during or shortly after a commit, the commands + will time out. The types of CLI commands impacted by this issue are + IoT, Cloud-User-ID, and App-ID Cloud Engine CLI commands. +
+
+ Workaround: Don't execute IoT, Cloud-User-ID, or + App-ID Cloud Engine CLI commands during or shortly after a commit on a + PA-5400 Series or PA-7500 Series firewall. +
+
PAN-299170 +
+ The remediation link included in the generated PDF of an upgrade check + report might be pruned due to a text length limitation of the export + function. The link remains fully functional and works correctly on the + Panorama web interface. +
+
PAN-299114 +
+ After you enable the + Enable Duplicate Logging (Cloud and On-Premise) setting on a firewall, clicking + Status for Cloud Logging, does not + display the logging service connection status. +
+
PAN-298540 +
+ (PA-5500 Series firewalls only) The + Monitor tab in the Web Interface + does not display a pop-up to indicate that high-speed log forwarding + is enabled and that logs are only viewable from Panorama. +
+
PAN-298083 +
+ After you change the system mode on an M-700 appliance from Panorama + mode to PAN-DB private cloud mode, the + snmpd process fails to work. +
+
PAN-298047 +
+ In an AI Runtime Security environment, the Azure Container outbound + traffic does not seem to be functional and the egress traffic is being + misdirected to an incorrect cluster node port. +
+
PAN-297772 +
+ When an Intel e810 NIC is configured in SR-IOV mode, sharing Virtual + Functions (VFs) among multiple HSF cluster nodes and subsequently + rebooting a cluster node while traffic is active may result in traffic + disruption on other HSF cluster nodes utilizing the same NIC. It is + recommended to refrain from sharing Intel e810 VFs across cluster + nodes and to allocate one VF per Intel e810 PF. +
+
+
PAN-297114
+ 		+
+ After successfully generating a health check report for managed + firewalls from Panorama, the progress bar does not appear and the + latest health check reports are not displayed (Panorama > Device Deployment > Upgrade Check). +
+
+ Workaround: Manually refresh the page to see the + latest reports. +
+
+
PAN-294687
+ 		+
+ (NGFW Clusters) In an NGFW cluster, the leader + can't retrieve the HIP Report from Panorama, nor synchronize it to the + non-leader nodes. Unlike HA Active/Passive mode, both leader and + non-leader nodes receive traffic in cluster mode. If the relevant HIP + Report is missing, policies involving HIP may not work properly. The + expected behavior is that when a non-leader node receives related + traffic, it should request the corresponding HIP Report from the + leader. +
+
+
PAN-293754
+ 		+
+ (NGFW Clusters) Firewalls in an NGFW cluster + indicate they are in ONLINE state even though their configurations are + different (they aren't synchronized). +
+
+ Workaround: Push the configuration from Panorama + to all cluster members at the same time; don't push to an individual + firewall. If a cluster member isn't connected to Panorama during the + push, the push will fail to the disconnected firewall, but will + succeed to all connected firewalls. +
+
+
PAN-293718
+ 		+
+ When high speed logging is enabled on a PA-5560 device, the expected + warning message is not displayed on the web interface. This prevents + administrators from being notified that logs can only be viewed from + Panorama. +
+
+
PAN-292601
+ 		+
+ PAN-OS 12.1.2 and later 12.1 releases support a Load Balanced DNS + configuration for an address object. If there are two address objects + with same FQDN, but one object has Load Balanced DNS enabled and other + object has Load Balanced DNS disabled, then the policy match for the + removed IP addresses doesn't work as expected. +
+
+ Workaround: Enable (or disable) Load Balanced DNS + consistently for an FQDN that is used with multiple address objects. +
+
+
PAN-290692
+ 		+
+ In Host Compliance Service, when you create a 'Shared' type Host + Compliance Object for the 'Disk-Encryption' category, the State + drop-down is automatically selected and cannot be edited. However, you + can change the state later by editing the object, if required. +
+
+
PAN-289524
+ 		+
+ In PAN-OS 12.1.2 and later 12.1 releases, PAN-OS can obtain resolved + IP addresses from a Load balanced DNS server and use them in a policy + match. However, this functionality does not work as intended when the + DNS cache reuse flag is enabled. When the DNS cache reuse flag is + enabled, the DNS resolution works as if the Load balanced DNS flag + (for an Address object) is disabled. +
+
+
PAN-286496
+ 		+
+ (NGFW Clusters) URL-continue and override + continue selections will function like a general URL-block action. +
+
+
PAN-283429
+ 		+
+ When you use custom certificates for the connection between Panorama + and a log collector, the automated renewal for the predefined + ElasticSearch certificates gets disrupted. +
+
+ Workaround: Remove the custom certificates before + the ElasticSearch certificates expire. This allows the system to + correctly identify and renew the predefined ElasticSearch + certificates. After the renewal is complete, re-install the custom + certificates. +
+
+
PAN-237106
+ 		+
+ LSVPN satellite certificates may be generated with serial numbers + exceeding 40 hexadecimal characters. This causes certificate + revocation and deletion operations to fail with the following error + messages: +
+
    +
  • + db-serialno can be at most 40 characters +
    • +
  • + db-serialno is invalid +
    • +
+ Workaround: +
+ To resolve this issue, use the following CLI commands with the LSVPN + satellite serial number to manually delete or revoke the affected + certificates: +
+
+ Delete certificate information:delete sslmgr-store certificate-info portal name + <name> serialno + <satellite_serial> +
+
+ Revoke satellite certificates:delete sslmgr-store satellite-info-revoke-certificate portal + <name> serialno + <list_of_satellite_serials> +
+
+
PLUG-21065
+ 		+
+ In a PA-VM or AI Runtime Security environment, it is observed that the + Software Firewall Orchestration plugin deployed with a VM-Flex license + and configured with 8-14 GB of memory may encounter traffic + disruptions when jumbo frames are enabled. It is recommended to + disable jumbo frames on these lower-end VMs in version 12.1.2 by + executing the command: set system setting jumbo-frame off. +
+
+
PLUG-19238
+ 		+
+ Enabling Advanced Routing through bootstrap on VM-Series and Prisma + AIRS is not supported. +
+ Workaround: After the firewall boots up, enable + advanced routing using the CLI command set device-management + general-settings advance-routing yes or enable + advanced routing + through the UI. +
+
DRS-6556
+ 		+
+ For Host Compliance Service, while configuring Mappings & Tags in + CIE and when you click on the + HIP Report tab, the following error + message is displayed even when the response is successful: +
+
+ getaddrinfo ENOTFOUND null +
+
diff --git a/crawler/code/process_issues.mjs b/reference/process_issues.mjs similarity index 100% rename from crawler/code/process_issues.mjs rename to reference/process_issues.mjs