aaron.axvig/firewallissues
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Discard the crawler, manually collect reference material for processing

Browse Source
This commit is contained in:
aaron.axvig
2026-04-13 13:38:18 -05:00
parent e53a813713
commit 37eaffba3f
19 changed files with 11895 additions and 783 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crawler/README.md
-261
View File
@@ -1,261 +0,0 @@
# Crawler: Common Crawl Ingestion Pipeline
This folder contains a two-step ingestion pipeline that downloads Palo Alto release-note issue tables from Common Crawl snapshots, then converts those HTML tables into the markdown files consumed by this repository.
The goal is to avoid repeatedly scraping live vendor pages while still keeping issue data current and reproducible. The HTML tables scraped from Common Crawl are not intended to be checked in to source control.
## What This Crawler Does
The crawler workflow has two stages:
1. Download stage (Python)
- Script: code/crawl_cc.py
- Queries Common Crawl index data for PAN-OS release-note issue pages.
- Fetches archived WARC records from Common Crawl.
- Extracts the issue table HTML from each page.
- Stores one HTML table file per version/type in crawler/data.
2. Process stage (Node.js)
- Script: code/process_issues.mjs
- Reads downloaded HTML table files.
- Reuses the existing parser/markdown generator from web/js.
- Writes markdown issue files to web/data/issues.
After processing, you typically run scripts/update_products_from_issues.py to refresh product index mappings.
## Why
- Lower load on vendor infrastructure.
- Reproducibility by pinning to a crawl snapshot (for example CC-MAIN-2026-12).
- Repeatable local processing from downloaded artifacts.
## Folder Structure
crawler/
- README.md This guide
- code/
- crawl_cc.py Download issue table HTML from CC
- process_issues.mjs Convert table HTML into markdown files
- entry_points.json Product/branch entry points
- requirements.txt Python dependencies for downloader
- data/
- CC-MAIN-2026-12/
- PAN-OS/
- 10.2.1-addressed.html
- 10.2.1-known.html
- ...
Notes:
- data/ contents are gitignored.
- Each crawl snapshot is stored in its own top-level folder under data/.
## Prerequisites
Python
- Python 3.10+ recommended.
- Install downloader dependencies:
pip install -r crawler/code/requirements.txt
Node.js
- Use project dependencies from root package.json.
- If needed:
npm install
## Entry Points Configuration
File: crawler/code/entry_points.json
This file defines:
- Product key (currently PAN-OS).
- URL slug prefix used for version extraction.
- Branch entry points (release-note root pages).
The downloader uses these entry points for branch-mode discovery.
## Download Script: crawl_cc.py
### What it does internally
Branch mode:
1. Takes a branch entry point URL.
2. Converts it to the release-notes directory prefix.
3. Calls CC index with prefix matching to discover archived URLs.
4. Filters for URLs containing:
- -addressed-issues
- -known-issues
5. Deduplicates by URL and keeps the latest timestamp.
6. Downloads WARC slices via byte-range requests.
7. Extracts HTML and finds the issue table.
8. Writes output as:
- crawler/data/<crawl>/<product>/<version>-<type>.html
Single URL mode:
- Accepts one issue-page URL.
- Tries URL normalization fallbacks (scheme and trailing slash variants).
- Falls back to parent prefix search if exact lookup misses.
- Downloads and saves one file when found.
### Rate limiting and reliability
Built-in request controls include:
- Minimum interval between HTTP requests.
- Retry logic for transient errors (429, 5xx).
- Skip-on-failure behavior so one bad record does not kill the whole branch.
### CLI options
Common options:
- --crawl
Common Crawl snapshot ID.
Default: CC-MAIN-2026-12
- --product
Product key from entry_points.json.
Default: PAN-OS
- --min-request-interval
Minimum seconds between outbound CC requests.
Default: 1.0
Branch-mode options:
- --branch
Restrict to one branch from entry_points.json, such as 10.2.
- --max-results
In branch mode, stop after N successful downloads.
Default: 0 (no limit).
This is ideal for safe smoke tests.
Single-page option:
- --url
Download exactly one issue-page URL.
Useful for targeted debugging.
### Example commands
One-branch smoke test (download 1 successful file):
python crawler/code/crawl_cc.py --branch 10.2 --max-results 1 --min-request-interval 2.0
One-branch small run:
python crawler/code/crawl_cc.py --branch 10.2 --max-results 5 --min-request-interval 1.5
One specific page:
python crawler/code/crawl_cc.py --url https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-release-notes/pan-os-10-2-1-known-and-addressed-issues/pan-os-10-2-1-addressed-issues --min-request-interval 2.0
Full configured product run:
python crawler/code/crawl_cc.py --min-request-interval 1.5
## Processing Script: process_issues.mjs
Script path:
- crawler/code/process_issues.mjs
### What it does internally
1. Reads HTML files in:
- crawler/data/<crawl>/<product>/
2. Expects file naming:
- <version>-addressed.html
- <version>-known.html
3. Parses each table using existing project parser logic from web/js/process.js.
4. Builds markdown using web/js/markdown.js.
5. Writes output to:
- web/data/issues/<product>/addressed/<version>_<date>.md
- web/data/issues/<product>/known/<version>_<date>.md
6. Adds source metadata in frontmatter:
- source: common-crawl
- crawl: <crawl id>
7. Date behavior:
- Default output date is inferred from crawl ID (CC-MAIN-YYYY-WW -> ISO week start date).
- You can override with --date.
### CLI options
- --crawl
Crawl snapshot folder to read from.
Default: CC-MAIN-2026-12
- --product
Product folder under crawler/data/<crawl>/.
Default: PAN-OS
- --date
Optional override for filename date suffix.
If omitted, date is derived from crawl ID when possible.
### Example commands
Process files from one crawl snapshot:
node crawler/code/process_issues.mjs --crawl CC-MAIN-2026-12 --product PAN-OS
Process with explicit date override:
node crawler/code/process_issues.mjs --crawl CC-MAIN-2026-12 --product PAN-OS --date 2026-03-20
## Typical End-to-End Workflow
1. Install dependencies:
- pip install -r crawler/code/requirements.txt
- npm install
2. Download a small sample safely:
- python crawler/code/crawl_cc.py --branch 10.2 --max-results 1 --min-request-interval 2.0
3. Process downloaded HTML to markdown:
- node crawler/code/process_issues.mjs --crawl CC-MAIN-2026-12 --product PAN-OS
4. Update products mapping:
- python scripts/update_products_from_issues.py
5. Run tests:
- npm test
## Recommended Testing Strategy
Use these modes while iterating:
- Fast syntax check:
python -m py_compile crawler/code/crawl_cc.py
- Safe download smoke test:
python crawler/code/crawl_cc.py --branch 10.2 --max-results 1 --min-request-interval 2.0
- Processing smoke test:
node crawler/code/process_issues.mjs --crawl CC-MAIN-2026-12 --product PAN-OS
- Verify generated frontmatter quickly:
grep -R "^source:\|^crawl:" web/data/issues/PAN-OS | head
## Troubleshooting
No issue links found in branch mode
- Cause: release-note navigation is often JS-rendered and not available in archived HTML.
- Current behavior: branch mode uses CC prefix discovery directly, so this should be rare.
No CC record for a specific URL
- Cause: URL canonicalization differences (slash/scheme/path form).
- Current behavior: single URL mode tries normalized variants and fallback prefix matching.
Transient 503 or 429 errors from CC
- Increase --min-request-interval.
- Keep retries enabled (default behavior).
- Rerun; script skips failed pages and continues.
No table found on a discovered page
- Some legacy pages may be non-standard or combined pages.
- Current behavior: page is skipped with a warning.
Wrong date suffix in generated markdown
- By default, date is inferred from crawl ID.
- Pass --date if you intentionally want a different date.
## Design Notes
- The download stage stores raw extracted table artifacts, not final markdown.
- The process stage intentionally reuses existing parser logic to avoid drift from manual workflow.
- Source provenance is kept in markdown frontmatter using source and crawl keys.
- Each Common Crawl snapshot is isolated in its own data subfolder to support repeatability and comparison.
crawler/code/crawl_cc.py
-472
View File
@@ -1,472 +0,0 @@
#!/usr/bin/env python3
"""Download issue table HTML from Common Crawl for PA docs release note pages.
Usage:
python crawl_cc.py [--crawl CC-MAIN-2026-12] [--product PAN-OS] [--branch 10.2]
"""
import argparse
import gzip
import io
import json
import logging
import re
import sys
import time
from pathlib import Path
from urllib.parse import urlparse
import requests
from bs4 import BeautifulSoup
from warcio.archiveiterator import ArchiveIterator
CC_INDEX_URL = "https://index.commoncrawl.org/{crawl}-index"
CC_DATA_URL = "https://data.commoncrawl.org/{filename}"
SCRIPT_DIR = Path(__file__).parent
DATA_DIR = SCRIPT_DIR.parent / "data"
ENTRY_POINTS_FILE = SCRIPT_DIR / "entry_points.json"
DEFAULT_MIN_REQUEST_INTERVAL = 1.0
_MIN_REQUEST_INTERVAL_SECONDS = DEFAULT_MIN_REQUEST_INTERVAL
_LAST_REQUEST_TS = 0.0
ISSUE_TYPE_SLUGS = {
"addressed": "-addressed-issues",
"known": "-known-issues",
}
def get_issue_type_from_url(url: str) -> str | None:
"""Return issue type from the final path slug, not parent path segments."""
slug = urlparse(url).path.rstrip("/").rsplit("/", 1)[-1]
for issue_type, suffix in ISSUE_TYPE_SLUGS.items():
if slug.endswith(suffix):
return issue_type
return None
def load_entry_points():
with open(ENTRY_POINTS_FILE) as f:
return json.load(f)
def set_request_rate_limit(min_interval_seconds: float) -> None:
global _MIN_REQUEST_INTERVAL_SECONDS
_MIN_REQUEST_INTERVAL_SECONDS = max(0.0, float(min_interval_seconds))
def rate_limited_get(url: str, **kwargs):
global _LAST_REQUEST_TS
if _MIN_REQUEST_INTERVAL_SECONDS > 0:
elapsed = time.monotonic() - _LAST_REQUEST_TS
sleep_for = _MIN_REQUEST_INTERVAL_SECONDS - elapsed
if sleep_for > 0:
time.sleep(sleep_for)
response = requests.get(url, **kwargs)
_LAST_REQUEST_TS = time.monotonic()
return response
def query_cc_index(crawl: str, url: str) -> list[dict]:
"""Query the CC index for all records matching *url* exactly. Returns [] if not found."""
return _query_cc_index(crawl, url, match_type="exact")
def query_cc_index_prefix(crawl: str, prefix_url: str) -> list[dict]:
"""Query the CC index for all records whose URL starts with *prefix_url*.
Returns a flat list of all matching records (may be large).
"""
return _query_cc_index(crawl, prefix_url, match_type="prefix")
def _query_cc_index(crawl: str, url: str, match_type: str) -> list[dict]:
index_url = CC_INDEX_URL.format(crawl=crawl)
resp = rate_limited_get(
index_url,
params={"url": url, "matchType": match_type, "output": "json"},
timeout=60,
)
if resp.status_code == 404:
return []
resp.raise_for_status()
records = []
for line in resp.text.strip().splitlines():
line = line.strip()
if line:
try:
records.append(json.loads(line))
except json.JSONDecodeError:
continue
return records
def pick_latest_record(records: list[dict]) -> dict | None:
"""Return the record with the most recent timestamp."""
if not records:
return None
return max(records, key=lambda r: r.get("timestamp", ""))
def _url_candidates(url: str) -> list[str]:
stripped = url.rstrip("/")
with_slash = stripped + "/"
candidates = [stripped, with_slash]
if stripped.startswith("https://"):
alt = "http://" + stripped[len("https://") :]
candidates.extend([alt, alt + "/"])
elif stripped.startswith("http://"):
alt = "https://" + stripped[len("http://") :]
candidates.extend([alt, alt + "/"])
seen = set()
out = []
for candidate in candidates:
if candidate not in seen:
seen.add(candidate)
out.append(candidate)
return out
def find_latest_record_for_url(crawl: str, url: str) -> dict | None:
"""Find the latest CC record for a URL, with normalization fallbacks."""
for candidate in _url_candidates(url):
record = pick_latest_record(query_cc_index(crawl, candidate))
if record:
return record
# Fallback: search the parent path with prefix match and pick the closest URL.
parent_prefix = url.rsplit("/", 1)[0] + "/"
slug = urlparse(url).path.rstrip("/").rsplit("/", 1)[-1]
pref_records = query_cc_index_prefix(crawl, parent_prefix)
if not pref_records:
return None
candidates = []
normalized_targets = set(_url_candidates(url))
for rec in pref_records:
rec_url = str(rec.get("url", "")).split("?", 1)[0].split("#", 1)[0]
if rec_url in normalized_targets:
candidates.append(rec)
continue
rec_slug = urlparse(rec_url).path.rstrip("/").rsplit("/", 1)[-1]
if rec_slug == slug:
candidates.append(rec)
return pick_latest_record(candidates)
def fetch_warc_record(filename: str, offset: int, length: int) -> bytes:
"""Fetch a WARC record via HTTP range request and return the raw WARC bytes.
Retries transient 5xx/429 failures a few times before giving up.
"""
url = CC_DATA_URL.format(filename=filename)
headers = {"Range": f"bytes={offset}-{offset + length - 1}"}
last_error = None
for attempt in range(1, 5):
try:
resp = rate_limited_get(url, headers=headers, timeout=60)
if resp.status_code in (429, 500, 502, 503, 504):
raise requests.HTTPError(
f"Transient HTTP {resp.status_code}", response=resp
)
resp.raise_for_status()
return resp.content
except requests.RequestException as exc:
last_error = exc
if attempt == 4:
break
wait_seconds = attempt * 2
logging.warning(
"Retrying WARC fetch (%d/4) after error for %s: %s",
attempt,
filename,
exc,
)
time.sleep(wait_seconds)
raise RuntimeError(f"Failed to fetch WARC record after retries: {filename}") from last_error
def extract_html_from_warc(warc_bytes: bytes) -> str | None:
"""Extract the HTTP response body from a WARC record (handles gzip body encoding)."""
for record in ArchiveIterator(io.BytesIO(warc_bytes)):
if record.rec_type == "response":
body = record.content_stream().read()
# Handle Content-Encoding: gzip on the HTTP response body
encoding = ""
if record.http_headers:
encoding = record.http_headers.get_header("Content-Encoding", "").lower()
if "gzip" in encoding:
try:
body = gzip.decompress(body)
except Exception:
pass
# Determine charset from Content-Type
charset = "utf-8"
if record.http_headers:
ct = record.http_headers.get_header("Content-Type", "")
m = re.search(r"charset=([^\s;]+)", ct, re.I)
if m:
charset = m.group(1)
return body.decode(charset, errors="replace")
return None
def extract_version_from_slug(page_slug: str, slug_prefix: str) -> str | None:
"""
Extract a dotted version string from a PA docs page slug.
Examples (slug_prefix='pan-os-'):
pan-os-10-2-1-addressed-issues -> 10.2.1
pan-os-10-2-1-h3-addressed-issues -> 10.2.1-h3
pan-os-10-2-known-issues -> 10.2
"""
# Strip issue type suffix
stripped = page_slug
for suffix in ISSUE_TYPE_SLUGS.values():
if stripped.endswith(suffix):
stripped = stripped[: -len(suffix)]
break
# Strip product prefix
if stripped.startswith(slug_prefix):
stripped = stripped[len(slug_prefix):]
else:
return None
if not stripped:
return None
# Convert "10-2-1-h3" -> "10.2.1-h3"
parts = stripped.split("-")
numeric_parts = []
remainder = []
for part in parts:
if part.isdigit() and not remainder:
numeric_parts.append(part)
else:
remainder.append(part)
if not numeric_parts:
return None
version = ".".join(numeric_parts)
if remainder:
version += "-" + "-".join(remainder)
return version
def find_issue_table(html: str) -> str | None:
"""
Find the issue table in an HTML page. Prefers a table whose header row
contains both 'Issue ID' and 'Description'. Falls back to the first table.
"""
soup = BeautifulSoup(html, "html.parser")
for table in soup.find_all("table"):
header_text = " ".join(
th.get_text(separator=" ", strip=True) for th in table.find_all("th")
).lower()
if "issue" in header_text and "description" in header_text:
return str(table)
table = soup.find("table")
return str(table) if table else None
def download_version_page(
record: dict, url: str, issue_type: str, slug_prefix: str, out_dir: Path
) -> bool:
"""
Download and save the issue table HTML for one version page.
Returns True on success, False if skipped.
"""
page_slug = urlparse(url).path.rstrip("/").rsplit("/", 1)[-1]
version = extract_version_from_slug(page_slug, slug_prefix)
if not version:
logging.warning("Could not extract version from URL %s — skipping", url)
return False
out_file = out_dir / f"{version}-{issue_type}.html"
if out_file.exists():
logging.info("Already downloaded %s", out_file.relative_to(DATA_DIR.parent))
return False
try:
warc_bytes = fetch_warc_record(
record["filename"],
int(record["offset"]),
int(record["length"]),
)
except Exception as exc:
logging.warning("Could not fetch WARC for %s — skipping (%s)", url, exc)
return False
html = extract_html_from_warc(warc_bytes)
if not html:
logging.warning("Could not extract HTML from WARC for %s — skipping", url)
return False
table_html = find_issue_table(html)
if not table_html:
logging.warning("No issue table found in %s — skipping", url)
return False
out_dir.mkdir(parents=True, exist_ok=True)
out_file.write_text(table_html, encoding="utf-8")
logging.info("Saved %s", out_file.relative_to(DATA_DIR.parent))
return True
def process_branch(
crawl: str,
product: str,
product_cfg: dict,
branch_cfg: dict,
max_results: int = 0,
) -> None:
branch = branch_cfg["branch"]
main_page = branch_cfg["main_page"]
slug_prefix = product_cfg.get("slug_prefix", "")
out_dir = DATA_DIR / crawl / product
# Derive the release-notes directory URL for a prefix query.
# e.g. ".../pan-os/10-2/pan-os-release-notes/features-introduced-in-pan-os"
# -> ".../pan-os/10-2/pan-os-release-notes/"
notes_dir = main_page.rsplit("/", 1)[0] + "/"
logging.info("=== Branch %s ===", branch)
logging.info("Querying CC index (prefix) for %s", notes_dir)
all_records = query_cc_index_prefix(crawl, notes_dir)
if not all_records:
logging.warning("No CC records found under %s — skipping branch", notes_dir)
return
# Deduplicate: keep the latest record per URL.
latest_by_url: dict[str, dict] = {}
for rec in all_records:
url = rec.get("url", "")
if url not in latest_by_url or rec.get("timestamp", "") > latest_by_url[url].get("timestamp", ""):
latest_by_url[url] = rec
# Filter for issue pages.
issue_urls: dict[str, str] = {}
for url in latest_by_url:
issue_type = get_issue_type_from_url(url)
if issue_type:
issue_urls[url] = issue_type
if not issue_urls:
logging.warning("No issue page URLs found under %s", notes_dir)
return
selected_issue_items = sorted(issue_urls.items())
if max_results > 0:
logging.info(
"Found %d issue page URLs (will stop after %d successful downloads)",
len(issue_urls),
max_results,
)
else:
logging.info("Found %d issue page URLs", len(issue_urls))
successful_downloads = 0
for url, issue_type in selected_issue_items:
if max_results > 0 and successful_downloads >= max_results:
break
try:
saved = download_version_page(latest_by_url[url], url, issue_type, slug_prefix, out_dir)
if saved:
successful_downloads += 1
except Exception as exc:
logging.warning("Unexpected error while processing %s — skipping (%s)", url, exc)
def process_single_url(crawl: str, product: str, product_cfg: dict, url: str) -> None:
slug_prefix = product_cfg.get("slug_prefix", "")
out_dir = DATA_DIR / crawl / product
issue_type = get_issue_type_from_url(url)
if not issue_type:
logging.error(
"URL does not look like a known/addressed issue page: %s",
url,
)
return
record = find_latest_record_for_url(crawl, url)
if not record:
logging.warning("No CC record for %s (including normalized fallbacks)", url)
return
download_version_page(record, url, issue_type, slug_prefix, out_dir)
def main():
logging.basicConfig(level=logging.INFO, format="%(levelname)s %(message)s")
parser = argparse.ArgumentParser(
description="Download PA docs issue tables from Common Crawl."
)
parser.add_argument("--crawl", default="CC-MAIN-2026-12", help="Common Crawl index ID")
parser.add_argument(
"--product",
default="PAN-OS",
help="Product name (must match a key in entry_points.json)",
)
parser.add_argument("--branch", help="Process only this branch (e.g. 10.2)")
parser.add_argument(
"--url",
help="Process exactly one issue page URL (must include -addressed-issues or -known-issues)",
)
parser.add_argument(
"--min-request-interval",
type=float,
default=DEFAULT_MIN_REQUEST_INTERVAL,
help="Minimum seconds between HTTP requests to Common Crawl (default: 1.0)",
)
parser.add_argument(
"--max-results",
type=int,
default=0,
help="When using entry-point branch mode, download only the first N discovered issue pages (0 = no limit)",
)
args = parser.parse_args()
set_request_rate_limit(args.min_request_interval)
logging.info("Using request rate limit: %.2f seconds/request", args.min_request_interval)
entry_points = load_entry_points()
if args.product not in entry_points:
sys.exit(f"Product {args.product!r} not found in entry_points.json")
product_cfg = entry_points[args.product]
if args.url:
process_single_url(args.crawl, args.product, product_cfg, args.url)
return
branches = product_cfg["branches"]
if args.branch:
branches = [b for b in branches if b["branch"] == args.branch]
if not branches:
sys.exit(f"Branch {args.branch!r} not found for product {args.product!r}")
for branch_cfg in branches:
process_branch(
args.crawl,
args.product,
product_cfg,
branch_cfg,
max_results=max(0, args.max_results),
)
if __name__ == "__main__":
main()
crawler/code/entry_points.json
-47
View File
@@ -1,47 +0,0 @@
{
"PAN-OS": {
"slug_prefix": "pan-os-",
"branches": [
{
"branch": "8.1",
"main_page": "https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-release-notes/pan-os-8-1-release-information"
},
{
"branch": "9.0",
"main_page": "https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-release-notes/pan-os-9-0-release-information"
},
{
"branch": "9.1",
"main_page": "https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-release-notes/pan-os-9-1-release-information"
},
{
"branch": "10.0",
"main_page": "https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-release-notes/pan-os-10-0-release-information"
},
{
"branch": "10.1",
"main_page": "https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-release-notes/features-introduced-in-pan-os"
},
{
"branch": "10.2",
"main_page": "https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-release-notes/features-introduced-in-pan-os"
},
{
"branch": "11.0",
"main_page": "https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-release-notes/features-introduced-in-pan-os"
},
{
"branch": "11.1",
"main_page": "https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/features-introduced-in-pan-os"
},
{
"branch": "11.2",
"main_page": "https://docs.paloaltonetworks.com/pan-os/11-2/pan-os-release-notes/features-introduced-in-pan-os"
},
{
"branch": "12.1",
"main_page": "https://docs.paloaltonetworks.com/ngfw/release-notes/12-1/features-introduced-in-pan-os"
}
]
}
}
crawler/code/requirements.txt
-3
View File
@@ -1,3 +0,0 @@
beautifulsoup4
requests
warcio
reference/PAN-OS/addressed/12.1.2.html
+140
View File
@@ -0,0 +1,140 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row rowsep">
<th class="entry">
<div class="p"><b class="ph b">Issue ID</b></div>
</th>
<th class="entry">
<div class="p"><b class="ph b">Description</b></div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-242777</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where users previously reported limitations due to
session count caps when utilizing
<b class="ph b">Web Proxy</b> features on PA-5400 Series Firewalls. To
address these performance complaints and support higher traffic
volumes, we have increased the maximum session capacity on specific
<b class="ph b">PA-5400F</b> series platforms, leveraging available
system memory. This update ensures greater capacity and stability for
high-volume environments.
</div>
<div class="p">
The supported session limits are:
<div style="display: inline"></div>
<div style="display: inline"></div>
<div style="display: inline"></div>
<div style="display: inline"></div>
<div style="display: inline"></div>
<div style="display: inline"></div>
<div style="display: inline"></div>
<div style="display: inline"></div>
<div style="display: inline"></div>
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 50%" />
<col style="width: 50%" />
</colgroup>
<thead class="thead">
<tr class="row">
<th class="entry">Platform</th>
<th class="entry">Max Sessions</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row">
<td class="entry">PA-5410</td>
<td class="entry relcol">95K</td>
</tr>
<tr class="row">
<td class="entry">PA-5420</td>
<td class="entry relcol">95K</td>
</tr>
<tr class="row">
<td class="entry">PA-5430</td>
<td class="entry relcol">95K</td>
</tr>
<tr class="row">
<td class="entry">PA-5440</td>
<td class="entry relcol">225K</td>
</tr>
<tr class="row">
<td class="entry">PA-5445</td>
<td class="entry relcol">250K</td>
</tr>
<tr class="row">
<td class="entry">PA-5450</td>
<td class="entry relcol">1.28M</td>
</tr>
</tbody>
</table>
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-291499</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>VM-Series firewalls on Amazon Web Services (AWS) environments
only</tt
>) Fixed an issue where newly deployed firewalls were unable to
connect to the Strata Logging Service (SLS) until after a reboot,
license fetch, or management server restart.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-288726</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<span class="keyword cmdname">useridd</span> process stopped
responding due to a Security policy rule ID being set to 0, which
caused the last configuration retrieval to fail.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-287133</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue on the Panorama web interface where assigning a policy
rule to a group at the top or bottom of the list changed the order of
other policy rules.
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/addressed/12.1.3-h1.html
+34
View File
@@ -0,0 +1,34 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row rowsep">
<th class="entry">
<div class="p"><b class="ph b">Issue ID</b></div>
</th>
<th class="entry">
<div class="p"><b class="ph b">Description</b></div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-304195</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue on the firewall where performing a private data reset
caused device telemetry to stop working. This issue also occurred
after performing a factory reset and then running the CLI command
<span class="ph systemoutput">set system ztp disable</span>.
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/addressed/12.1.3-h3.html
+90
View File
@@ -0,0 +1,90 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row rowsep">
<th class="entry">
<div class="p"><b class="ph b">Issue ID</b></div>
</th>
<th class="entry">
<div class="p"><b class="ph b">Description</b></div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">—</b></div>
</td>
<td class="entry relcol">
<div class="p">
A fix was made to address
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0227"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0227</a
>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-306534</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue were the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>all_task</a
>
process repeatedly restarted due to memory pool corruption when
processing fragmented DNS over HTTPs (DoH) JSON queries. This occurred
due to incorrect buffer length calculations during memory deallocation
when the query name field spanned multiple packets.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-305480</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>pan_task</a
>
process stopped responding while processing DoH JSON format traffic
with DoH Security enabled, which caused missing cross-packet bytes in
the decoded DNS query type field, and the dataplane went down.
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/addressed/12.1.3.html
+180
View File
@@ -0,0 +1,180 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row rowsep">
<th class="entry">
<div class="p"><b class="ph b">Issue ID</b></div>
</th>
<th class="entry">
<div class="p"><b class="ph b">Description</b></div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300334</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the ADEM plugin was not compatible with PAN-OS
12.1.2, which prevented installation of the plugin and disabled the
ability to monitor remote sites on firewalls using the ADEM
functionality.
</div>
<div class="p">
To use this fix, you need the following compatible versions: ADEM
1.1.0-h3 and SD-WAN plugin 3.4.0.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-298241</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the NAT IP address pool was exhausted, which led
to intermittent connectivity issues with call applications and
outbound call failures. This occurred due to the firewall not properly
releasing NAT dynamic ports back to the address pool.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-296490</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">FIPS CC mode enabled only</tt>) Fixed an issue
where Panorama on GCP rebooted every hour after upgrading to
11.1.6-h10.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-289249</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a memory leak occurred on the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>reportd</a
>
process when a WildFire update was initiated while device telemetry
data collection was in progress. This resulted in an OOM condition.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-286576</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>all_pktproc</a
>
process restarted, which caused heartbeat failures to occur and a slot
to go down due to path monitor failure.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-272245</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>dnsproxy</a
>
process crashed due to memory corruption caused by a race condition
when the allow list downloading was impacted by config change.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-267450</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>reportd</a
>
process stopped responding with a SIGSEGV at
<span class="ph systemoutput">schedule_report_es_response</span>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-262831</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">PA-5400f Series firewalls only</tt>) Fixed an
intermittent issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>all_task</a
>
process stopped responding, which caused the firewall to restart.
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/addressed/12.1.4-h2.html
+77
View File
@@ -0,0 +1,77 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row rowsep">
<th class="entry">
<div class="p"><b class="ph b">Issue ID</b></div>
</th>
<th class="entry">
<div class="p"><b class="ph b">Description</b></div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-311938</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where autocommits failed after an upgrade due to
configuration memory allocation issues and 100% policy rule cache
usage when both DNS Rewrite and URL Custom Category Match were
configured.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-306451</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">VM-Series firewalls on AWS environments only</tt>)
Fixed an issue where, after upgrading the firewall to an affected
release, GlobalProtect clients did not connect with IPSec and instead
connected using SSL due to traffic flow being disabled when checking
for health check packets.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-304496</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, after unregistering an IP tag and registering a
different IP tag for the same IP address via XML API, the dynamic
address group membership was not updated on the dataplane, which
resulted in Security policy rules being enforced incorrectly.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-304195</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue on the firewall where performing a private data reset
caused device telemetry to stop working. This issue also occurred
after performing a factory reset and then running the CLI command
<span class="ph systemoutput">set system ztp disable</span>.
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/addressed/12.1.4-h3.html
+59
View File
@@ -0,0 +1,59 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row rowsep">
<th class="entry">
<div class="p"><b class="ph b">Issue ID</b></div>
</th>
<th class="entry">
<div class="p"><b class="ph b">Description</b></div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-313572</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">VM-Series firewalls only</tt>) Fixed an issue where
the dataplane restarted due to a segmentation fault.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300664</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue on the Panorama and firewall web interface where
Applications pages became unresponsive after activating the SaaS
Inline license.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-292447</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where Panorama did not display data in the
<span class="ph uicontrol">Feature Adoption</span> tab in Strata Cloud
Manager due to the system creating and deleting a CLI user for each
interval instead of reusing a permanent CLI user for telemetry.
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/addressed/12.1.4.html
+623
View File
@@ -0,0 +1,623 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row rowsep">
<th class="entry">
<div class="p"><b class="ph b">Issue ID</b></div>
</th>
<th class="entry">
<div class="p"><b class="ph b">Description</b></div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">—</b></div>
</td>
<td class="entry relcol">
<div class="p">
A fix was made to address
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0227"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0227</a
>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-305480</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>pan_task</a
>
process stopped responding while processing DoH JSON format traffic
with DoH Security enabled, which caused missing cross-packet bytes in
the decoded DNS query type field, and the dataplane went down.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-305151</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the configuration was not updated on the AI
Firewall in AWS after a successful configuration push from Strata
Cloud Manager (SCM).
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-304195</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue on the firewall where performing a private data reset
caused device telemetry to stop working. This issue also occurred
after performing a factory reset and then running the CLI command
<span class="ph systemoutput">set system ztp disable</span>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-304075</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall did not detect evasions due to TCP
checksum offloading not being enabled.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-303836</b></div>
</td>
<td class="entry relcol">
<div class="p">
Resolved an issue in which intermittent session-table resets on the
AIRS VM triggered packet drops, leading to packet loss in egress
response traffic
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-303700</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where GlobalProtect users were incorrectly dropped by
the default Security policy rule after upgrading to PAN-OS 12.1.2 when
IPv6 firewalling was disabled. This occurred due to policy rules
configured with geographic regions matching traffic incorrectly.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-303559</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, after manuallly creating a device telemetry
bundle, the
<span class="ph systemoutput">hour_cli_output.txt</span> file within
the bundle had a file size of 0 bytes. This occurred when checking the
bundle content after enabling device telemetry and setting the device
telemetry upload endpoint.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-302908</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall did not forward STP frames on Layer
2 VLAN interfaces, which prevented the construction of loop-free
topologies with connected switches.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-301801</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue on Log Collectors where the Elasticsearch process
fluctuated intermittently between green and red states, which led to
interruptions in log collection. This issue occurred when the number
of shards exceeded the cluster's maximum supported threshold of
greater than 1000 shards per Elasticsearch instance.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-301496</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the DNS cache capacity was insufficient for
environments with a large number of FQDN address objects, which caused
the firewall to repeatedly send DNS requests for the same FQDN objects
even after it received valid responses.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-300837</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where firewalls experienced multiple reboots due to the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>pan_task</a
>
process restarting with a SIGSEGV signal. This occurred because the
client-to-firewall side assumed TLS 1.3 for the firewall-server side.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-300372</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Panorama virtual appliances only</tt>) Fixed an
issue where maintenance mode was not accessible to do Factory Reset or
switch to FIPSCC mode.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-300096</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a local commit on a firewall breaks template
stack overrides, preventing the enabling of LACP (Link Aggregation
Control Protocol). After a local commit, the LACP enable check was
unexpectedly unchecked, causing an outage. Attempting to re-enable
LACP through the web interface was unsuccessful, requiring manual
removal of the LACP configuration from the Panorama CLI.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-299815</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue on multi-vsys firewalls where a host was not removed
from the quarantine list after receiving a redistribution message from
Panorama. This occurred when Panorama was configured to redistribute
quarantine messages to a firewall cluster, and the GlobalProtect
configuration and redistribution were built out in a vsys other than
vsys1.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-299678</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall repeatedly rebooted when downgrading
to an affected release.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-299193</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue on the firewall where, after upgrading, autocommits
repeatedly failed until after a second reboot due to a timing issue
between content loading on the management plane card (MPC) and the log
receiver startup.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-298684</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where an Application Override policy rule was not
applied using an IPv4 source IP address with IPv6 enabled and
<span class="ph uicontrol">Network</span> &gt;
<span class="ph uicontrol">Zones</span> &gt;
<span class="ph uicontrol">Pre-NAT Identification</span> enabled.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-298654</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall generated false positive threat logs
during updates to a large domain list (EDL) when a DNS lookup for a
domain being added or removed occurred during the update process. This
resulted in a threat log being generated for a different, unrelated
domain that remained on the list.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-298514</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where WildFire clusters operating in FIPS-CC mode were
not supported in earlier PAN-OS 12.1 releases.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-297972</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a dataplane crash occurred when traffic matched
Inline Cloud Analysis prefiltering signatures, even when Inline Cloud
Analysis features were not enabled.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-297797</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, during a refresh of a large External Dynamic
List (EDL), traffic that matched a domain on the list was incorrectly
identified as a different domain, which resulted in false positive
threat logs.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-297708</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a long-lived session with many Machine Learning
(ML) model triggers caused a memory leak of feature states associated
with the ML model runs. This resulted in Spyware_State failure
increases, allocation max outs, and impaired policy matching.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-297005</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where exporting custom reports resulted in empty CSV
files.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-296635</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>reportd</a
>
process on passive Panorama management servers leaked memory due to
scheduled report handling from the Strata Logging Service (SLS). This
memory leak occurred daily, consuming available memory until the
process was restarted.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-296478</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, after upgrading to PAN-OS 10.2.13-h10,
GlobalProtect Clientless VPN on PA-3250 firewalls failed to execute
JavaScript links, resulting in an authorization error. This occurred
because the firewall was incorrectly injecting text into URLs when
JavaScript buttons or dropdown menus were clicked within the
Clientless VPN portal.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-296453</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where decryption exclusion lists were not working for
untrusted certificates, and SSL sessions were still being decrypted
even after adding them to the exclusion list. This occurred because
the firewall was not adding sessions to the exclude cache until after
receiving a non-RFC alert (BadCertificate) from the server. The fix
ensures that the first session is added to the exclude cache, allowing
subsequent sessions to skip decryption. This issue affects firewalls
configured as clients in server-client communication.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-296202</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Firewalls in active/active HA configurations only</tt
>) Fixed an issue where, when a commit operation was in progress,
newly deployed IP address tags that used the XML API were not
immediately reflected in address group resolution, which delayed IP
address mapping to address groups and caused traffic to be incorrectly
allowed or denied.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-295221</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, after upgrading Panorama and Log Collectors from
PAN-OS 10.2.9 to PAN-OS 11.1.6-h6, Traffic and Threat logs were not
forwarded to a Splunk server over UDP.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-292393</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where TFTP file transfers intermittently timed out in
active-active HA pairs when the TFTP control channel was processed by
one firewall and the data channel was processed by the other. This
occurred because the firewall receiving the data channel failed to
match the predicted session due to asynchronous processing of HA
messages.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-291716</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where during a commit, the firewall experienced an
out-of-memory (OOM) condition due to a memory leak and displayed an
error message. This issue caused the device to stop responding and
reboot unexpectedly.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-291661</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue on Panorama appliances and Log Collectors where, after
an upgrade, Elasticsearch intermittently entered into a Red state
before automatically recovering.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-290665</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue with firewalls enabled with Security profiles where
certain traffic conditions caused high dataplane CPU utilization and
packet buffer exhaustion, which caused LACP flapping conditions.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-290640</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>VM-Series firewalls on Microsoft Azure environments in HA
configurations only</tt
>) Fixed an issue where, when an interface was configured with IPv6,
the firewall displayed the message
<span class="ph uicontrol">Unknown error</span> during validation
after the client secret expired, which caused DNS resolution to fail
when resolving FQDNs and HA failovers to occur.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-290453</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where PA-7500 firewalls experienced silent traffic
drops. During migration from PA-7050 to PA-7500 firewalls connected in
series, intermittent connection losses occurred for some applications.
Traffic leaving the PA-7050 was not received or processed by the
PA-7500, even with direct connections and replaced cables/SFPs. Global
counters did not indicate any drops on the PA-7500.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-288598</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where Panorama exported the serial number of a managed
collector instead of the collector name when exporting a PDF or CSV
file.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-287387</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue on Panorama where API jobs failed with the error
message
<span class="ph systemoutput"
>Server error: Timed out while getting config lock</span
>. This occurred due to slow set request performance when setting a
large number of address objects in a single set call.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-282640</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where custom reports showed incomplete data when
exported in CSV format from Panorama.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-274333</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the Logging Service License Status displayed as
red even though a valid license was installed on the firewall.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-262353</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, when Panorama was upgraded but log collectors
were on an earlier version, logs from a log collector group were not
viewable on a Panorama.
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/addressed/12.1.5.html
+5502
View File
File diff suppressed because it is too large Load Diff
reference/PAN-OS/addressed/12.1.6.html
+198
View File
@@ -0,0 +1,198 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row rowsep">
<th class="entry">
<div class="p"><b class="ph b">Issue ID</b></div>
</th>
<th class="entry">
<div class="p"><b class="ph b">Description</b></div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-316911</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>VM-Series firewalls on Amazon Web Services (AWS) environments
only</tt
>) Fixed an issue where a newly bootstrapped firewall required a
management server restart, relicensing, or license push from Panorama
to invoke the device certificate.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-314201</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue on PAN-OS 12.1 releases where intermittent traffic
drops occurred over IPSec VPN tunnels to third-party firewalls during
the IPSec rekey due to the firewall failing to inform the peer to
delete the old SA after moving to the new one.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-313216</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where firewalls with Prisma Access incorrectly
displayed some traffic as unsanctioned in traffic logs for cloud
applications that were tagged as
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>sanctioned</a
>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-311512</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where HIP (Host Information Profile) reports were
blocked on GlobalProtect when
<span class="ph uicontrol"
>Authentication Cookie Usage Restrictions</span
>
was enabled and the Prisma Access Agent protocol was in use. This
occurred because the system failed to correctly process HIP messages
that were relayed via IPSec tunnels with a Virtual IP as the source,
leading to their rejection.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-311412</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<span class="ph systemoutput">show advanced-routing resource</span>
CLI command failed to execute successfully when invoked through the
XML API and returned an error message.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-311261</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall generated duplicate URL Filtering
logs due to an error condition&nbsp;when the new XFF feature was
enabled.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-311250</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Panorama appliances and Log Collectors only</tt>)
Fixed an issue where logs from multiple devices were not visible on
Panorama even though the Elasticsearch health status on the dedicated
Log Collectors appeared green.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-310362</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where IPv6 Routed HA did not function correctly when
the HA1 (control link) was configured with an IPv6 routed connection.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-310240</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where software packet buffers were completely utilized
when performing a Data Loss Prevention longevity test.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-308507</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Panorama managed firewalls only</tt>) Fixed an
issue where the firewall intermittently failed to maintain active log
forwarding streams to Strata Logging Service (SLS) even when duplicate
logging and enhanced application logging were enabled.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-308418</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, when Advanced DNS Security was enabled and
experienced unusually high loads, DNS resolution failures occurred
with the error
<span class="ph uicontrol">resources-unavailable</span>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-308261</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall failed to send SNMPv3 traps when the
SNMP destination was configured with an FQDN that resolved to multiple
IP address through DNS load balancing.
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/known/12.1.2.html
+1049
View File
File diff suppressed because it is too large Load Diff
reference/PAN-OS/known/12.1.3.html
+1123
View File
File diff suppressed because it is too large Load Diff
reference/PAN-OS/known/12.1.4.html
+1147
View File
File diff suppressed because it is too large Load Diff
reference/PAN-OS/known/12.1.5.html
+876
View File
@@ -0,0 +1,876 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 34%" />
<col style="width: 66%" />
</colgroup>
<thead class="thead">
<tr class="row rowsep">
<th class="entry">
<div class="p"><b class="ph b">Issue ID</b></div>
</th>
<th class="entry">
<div class="p"><b class="ph b">Description</b></div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-314201</b></div>
<div class="p">
<tt class="ph tt">This issue is now resolved. See </tt
><a
class="xref"
href="/content/techdocs/en_US/ngfw/release-notes/12-1/pan-os-12-1-6-known-and-addressed-issues/pan-os-12-1-6-addressed-issues.html"
title=""
data-scope="local"
data-format="dita"
data-type=""
target="_self"
>PAN-OS 12.1.6 Addressed Issues</a
>
</div>
</td>
<td class="entry relcol">
<div class="p">
On firewalls running PAN-OS 12.1, IPsec VPN tunnels to third-party
peer devices may experience intermittent traffic loss during rekey
operations. When a new Security Association (SA) forms before the old
SA expires, traffic may stop flowing until the older SA naturally
expires or you manually clear it. During this time, the output of show
vpn ipsec-sa may show two SAs for the same proxy ID. This issue
primarily affects tunnels to third-party peer devices and does not
occur with Palo Alto Networks to Palo Alto Networks tunnels.
</div>
<div class="p">
<b class="ph b">Workaround:</b> Manually clear the affected Security
Association using the command
<span class="ph userinput"
>clear vpn ipsec-sa tunnel &lt;tunnel-name&gt;</span
>
to restore connectivity.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-313779</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">PA-7500 series only</tt>) PA-7500 series firewalls
running PAN-OS 12.1.5 release do not support encryption on HA1 and
HA1-backup interfaces. As a result, attempting to execute the
<span class="ph codeph"
>request high-availability session-reestablish</span
>
command will fail with the following error.
</div>
<div class="p">
<pre
id="panos-known-issues-12.1.5_screen-ilq_djv_h3c"
class="pre screen"
>
ERROR: Encryption is not enabled for HA</pre
>
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-313669</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>PA-5500 Series firewalls in cluster configurations only</tt
>) When a firewall node is removed from a PA-5500 Series cluster,
after the cluster commit and reboot, the node starts in standalone
mode with a default virtual wire (vwire) configuration loaded. This
default configuration is missing zone assignments for ports eth1/1 and
eth1/2, which causes commit operations to fail. Even if zones are
manually assigned to these ports, subsequent commit attempts will fail
with a
<span data-outputclass="response" class="ph systemoutput"
>no UUId for rule1</span
>
error.
</div>
<div class="p">
<b class="ph b">Workaround:</b> To resolve this, either:
</div>
<div class="p">
<ul id="panos-known-issues-12.1.5_ul-ybs_j3g_k3c" class="ul">
<li class="li">
Manually assign zone configurations to ports eth1/1 (for example,
untrust) and eth1/2 (for example, trust), then open and close
security policy rule1 without making changes, and
<span class="ph uicontrol">Commit</span>.
</li>
<li class="li">
Delete the default rule and the default virtual wire Ethernet
interfaces, then commit.
</li>
</ul>
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-313623</b></div>
</td>
<td class="entry relcol">
<div class="p">
On firewalls with TPM (Trusted Platform Module) support, device
certificate renewals may fail due to a disk partition being full. This
latter occurs because temporary files aren't being deleted during
device certificate status checks.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-312247</b></div>
</td>
<td class="entry relcol">
<div class="p">
In generated PDF upgrade check reports, long remediation URLs might be
truncated due to UI framework export limitations, leaving only the
first line hyperlinked. However, these links remain fully functional
within the Panorama web interface. The PDF link directs to the correct
destination if the complete URL is copied from the PDF and pasted in
the browser.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-309604</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">PA-5500 series only</tt>) In some rare cases, the
front panel PSU status LED might show amber, even when the LEDs on the
PSU show green.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-309602</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">PA-5500 series only</tt>) When the firewall is
initially powered on, the FAN-0 LED does not turn on. The fan
functions correctly, but the LED doesn't reflect the status.
</div>
<div class="p">
<b class="ph b">Workaround:</b> Remove and reinsert the fan to turn on
the LED.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-308564</b></div>
</td>
<td class="entry relcol">
<div class="p">
Packets are dropped on SD-WAN interfaces if they require fragmentation
for an interface but have the
<span class="ph uicontrol">Don't Fragment (DF)</span> bit set. This
results in unexpected packet drops. This affects client to server
sessions when using SD-WAN for NGFW.
</div>
<div class="p">
<b class="ph b">Workaround:</b> Allow fragmenting packets with DF bit
set (<span class="ph userinput"
>debug dataplane set ip4-ignore-df yes</span
>).
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-308507</b></div>
<div class="p">
<tt class="ph tt">This issue is now resolved. See </tt
><a
class="xref"
href="/content/techdocs/en_US/ngfw/release-notes/12-1/pan-os-12-1-6-known-and-addressed-issues/pan-os-12-1-6-addressed-issues.html"
title=""
data-scope="local"
data-format="dita"
data-type=""
target="_self"
>PAN-OS 12.1.6 Addressed Issues</a
>.
</div>
</td>
<td class="entry relcol">
<div class="p">
Strata Logging Service (SLS) log-forwarding streams intermittently
show as inactive. When checking the status of log-forwarding
connections, one or more streams are reported as inactive. Restarting
the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>log-receiver</a
>
process temporarily resolves the issue, but the streams become
inactive again after approximately 1-2 hours. This intermittent
inactivity results in log loss.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300850</b></div>
</td>
<td class="entry relcol">
<div class="p">
Manual scheduling of cloud verdicts is required if a new host in an
Host Compliance Service-enabled environment has a refresh event entry
without a corresponding update event entry.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300809</b></div>
</td>
<td class="entry relcol">
<div class="p">
Host Compliance Service connectivity will not work if it is connected
with management IP which is configured with DHCP mode.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300677</b></div>
</td>
<td class="entry relcol">
<div class="p">
Panorama cannot display Threat log entries (<b class="ph b"
>Monitor &gt; Logs &gt; Threat</b
>) when the managed log collector is running a lower PAN-OS release
than Panorama.
</div>
<div class="p">
Workaround: Upgrade the log collectors to the same version as
Panorama.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300627</b></div>
</td>
<td class="entry relcol">
<div class="p">
AutoCommit fails when the Traffic Object is used on AI Runtime
Security, which consequently impacts the workloads that utilize
overlapping subnets.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300483</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">PA-7500 firewall only</tt>) Enabling FIPS-CC mode
causes the firewall to go into maintenance mode.
</div>
<div class="p">
<b class="ph b">Workaround</b>: After the firewall goes into
maintenance mode, perform an additional reboot. The firewall will
successfully start up in FIPS-CC mode.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300467</b></div>
</td>
<td class="entry relcol">
<div class="p">
WildFire WF-500 appliances running PAN-OS 10.x or PAN-OS 11.x cannot
be managed by Panorama running PAN-OS 12.1.2 due to connectivity
issues.
</div>
<div class="p">
<b class="ph b">Workaround:</b> Upgrade your WildFire appliances to
PAN-OS 12.1.2 or later.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300407</b></div>
</td>
<td class="entry relcol">
<div class="p">
The Release Note URL column in the Panorama &gt; Plugins page is
empty.
</div>
<div class="p">
Release Notes for the plugins are available in the
<a
class="xref"
href="https://docs.paloaltonetworks.com/plugins/vm-series-and-panorama-plugins-release-notes"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>plugins release notes</a
>
or in their individual product release notes.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300230</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">NGFW Cluster</tt>) In an NGFW cluster, your pings
to the HSCI-B link might fail, even when the link indicates it is up.
In the event that the HSCI-A link is brought down or unplugged, the
cluster node will transition to failed state, avoiding split brain as
both HSCI links are down in this case.
</div>
<div class="p">
<b class="ph b">Workaround</b>: Reboot the cluster node to resolve the
HSCI-B ping issue.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300192</b></div>
</td>
<td class="entry relcol">
<div class="p">
If the Host Compliance Service is configured with a service route
pointing to an unreachable IP address, the
<span class="ph systemoutput">gp_broker</span> process may stop
working when you enable-disable the Host Compliance Service.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300114</b></div>
</td>
<td class="entry relcol">
<div class="p">
VM entered maintenance mode during a downgrade from version 12.1.2 to
11.2.7, when executed through the CLI.
</div>
<div class="p">
<b class="ph b">Workaround</b>: Download and install the required
version of PAN-OS through the UI instead of the CLI.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300069</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">PA-410 firewall only</tt>) Loading a saved config
file can take up to 5 minutes.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300053</b></div>
</td>
<td class="entry relcol">
<div class="p">
When you use the CLI command
<span class="ph userinput">request system fqdn refresh</span> to
trigger another IP address resolution of configured FQDN entries, the
firewall might get into an error state where the DNS Proxy cache
received and stored a new IP address for a particular FQDN entry via
this command. However, the Device-Server (and the Security rule) still
have the old IP address for that FQDN entry.
</div>
<div class="p">
<b class="ph b">Workaround</b>: Avoid using the CLI command:
<span class="ph userinput">request system fqdn refresh</span>. Use the
following command instead (for a particular domain-name or an entire
list):
<span class="ph userinput"
>clear dns-proxy cache all domain-name &lt;domain_name&gt;</span
>. To correct the error state where the DNS Proxy cache and
Device-Server and Security rule are already storing different IP
addresses, use the following CLI command:
<span class="ph userinput"
>debug device-server dump fqdn type resync vsys &lt;vsys_name&gt;
fqdn-name &lt;domain_name&gt;</span
>
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300025</b></div>
</td>
<td class="entry relcol">
<div class="p">
If Azure hotplug events occur, the firewall may experience a
<span class="ph userinput">brdagent</span> crash and data interfaces
may transition to an unknown state, leading to traffic disruption.
</div>
<div class="p">
<b class="ph b">Workaround</b>: Reboot the VM if the
<span class="ph userinput">brdagent</span> crash does not trigger a
device reboot.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-299562</b></div>
</td>
<td class="entry relcol">
<div class="p">
SSL proxy sessions fail when clients send a Client Hello with TLSv1.2
and TLSv1.3, and exclusively prefer the secp192 elliptic curve.
</div>
<div class="p">
<b class="ph b">Workaround</b>: To address this, configure a
decryption profile to use TLSv1.2 as the maximum supported TLS
version. Then, apply this profile to the decryption policy rules for
the affected clients and servers. This enables the client to modify
its preferred curves, facilitating successful session establishment.
</div>
</td>
</tr>
<tr class="row">
<td class="entry"><b class="ph b">PAN-299387</b></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">NGFW Cluster</tt>) When an NGFW cluster has only
one firewall node present and powered up, that node is stuck in
UNKNOWN state after you reboot it and it comes back up. The issue
occurs in two scenarios:
</div>
<ul id="panos-known-issues-12.1.5_ul-pfz_hyt_tgc" class="ul">
<li class="li">
When there is only one node configured in the cluster (no peer is
available or configured).
</li>
<li class="li">
When the peer device in the cluster is completely powered down or
unable to autonegotiate its connected HSCI ports. That is, two nodes
are in the cluster, but only one node is booting up while the other
remains down completely.
</li>
</ul>
<div class="p">
The expected behavior is that if no peer device is available (at a
port autonegotiation or link level for HSCI-A or HSCI-B), then a
cluster device should go to INITIAL state, followed by ONLINE state
(and not remain in UNKNOWN state).
</div>
<div class="p">
<b class="ph b">Workaround</b>: To avoid this issue, connect the
HSCI-A to HSCI-B in loopback to create a link partner.
</div>
</td>
</tr>
<tr class="row">
<td class="entry"><b class="ph b">PAN-299229</b></td>
<td class="entry relcol">
<div class="p">
On PA-5400 Series and PA-7500 Series firewalls, if you run certain
types of CLI commands during or shortly after a commit, the commands
will time out. The types of CLI commands impacted by this issue are
IoT, Cloud-User-ID, and App-ID Cloud Engine CLI commands.
</div>
<div class="p">
<b class="ph b">Workaround</b>: Don't execute IoT, Cloud-User-ID, or
App-ID Cloud Engine CLI commands during or shortly after a commit on a
PA-5400 Series or PA-7500 Series firewall.
</div>
</td>
</tr>
<tr class="row">
<td class="entry"><b class="ph b">PAN-299170</b></td>
<td class="entry relcol">
<div class="p">
The remediation link included in the generated PDF of an upgrade check
report might be pruned due to a text length limitation of the export
function. The link remains fully functional and works correctly on the
Panorama web interface.
</div>
</td>
</tr>
<tr class="row">
<td class="entry"><b class="ph b">PAN-299114</b></td>
<td class="entry relcol">
<div class="p">
After you enable the
<span class="ph uicontrol"
>Enable Duplicate Logging (Cloud and On-Premise) </span
>setting on a firewall, clicking
<span class="ph uicontrol">Status for Cloud Logging</span>, does not
display the logging service connection status.
</div>
</td>
</tr>
<tr class="row">
<td class="entry"><b class="ph b">PAN-298540</b></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">PA-5500 Series firewalls only</tt>) The
<span class="ph uicontrol">Monitor</span> tab in the Web Interface
does not display a pop-up to indicate that high-speed log forwarding
is enabled and that logs are only viewable from Panorama.
</div>
</td>
</tr>
<tr class="row">
<td class="entry"><b class="ph b">PAN-298083</b></td>
<td class="entry relcol">
<div class="p">
After you change the system mode on an M-700 appliance from Panorama
mode to PAN-DB private cloud mode, the
<span class="ph codeph">snmpd</span> process fails to work.
</div>
</td>
</tr>
<tr class="row">
<td class="entry"><b class="ph b">PAN-298047</b></td>
<td class="entry relcol">
<div class="p">
In an AI Runtime Security environment, the Azure Container outbound
traffic does not seem to be functional and the egress traffic is being
misdirected to an incorrect cluster node port.
</div>
</td>
</tr>
<tr class="row">
<td class="entry"><b class="ph b">PAN-297772</b></td>
<td class="entry relcol">
<div class="p">
When an Intel e810 NIC is configured in SR-IOV mode, sharing Virtual
Functions (VFs) among multiple HSF cluster nodes and subsequently
rebooting a cluster node while traffic is active may result in traffic
disruption on other HSF cluster nodes utilizing the same NIC. It is
recommended to refrain from sharing Intel e810 VFs across cluster
nodes and to allocate one VF per Intel e810 PF.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-297114</b></div>
</td>
<td class="entry relcol">
<div class="p">
After successfully generating a health check report for managed
firewalls from Panorama, the progress bar does not appear and the
latest health check reports are not displayed (<span
class="ph uicontrol"
>Panorama &gt; Device Deployment &gt; Upgrade Check</span
>).
</div>
<div class="p">
<b class="ph b">Workaround</b>: Manually refresh the page to see the
latest reports.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-294687</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">NGFW Clusters</tt>) In an NGFW cluster, the leader
can't retrieve the HIP Report from Panorama, nor synchronize it to the
non-leader nodes. Unlike HA Active/Passive mode, both leader and
non-leader nodes receive traffic in cluster mode. If the relevant HIP
Report is missing, policies involving HIP may not work properly. The
expected behavior is that when a non-leader node receives related
traffic, it should request the corresponding HIP Report from the
leader.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-293754</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">NGFW Clusters</tt>) Firewalls in an NGFW cluster
indicate they are in ONLINE state even though their configurations are
different (they aren't synchronized).
</div>
<div class="p">
<b class="ph b">Workaround</b>: Push the configuration from Panorama
to all cluster members at the same time; don't push to an individual
firewall. If a cluster member isn't connected to Panorama during the
push, the push will fail to the disconnected firewall, but will
succeed to all connected firewalls.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-293718</b></div>
</td>
<td class="entry relcol">
<div class="p">
When high speed logging is enabled on a PA-5560 device, the expected
warning message is not displayed on the web interface. This prevents
administrators from being notified that logs can only be viewed from
Panorama.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-292601</b></div>
</td>
<td class="entry relcol">
<div class="p">
PAN-OS 12.1.2 and later 12.1 releases support a Load Balanced DNS
configuration for an address object. If there are two address objects
with same FQDN, but one object has Load Balanced DNS enabled and other
object has Load Balanced DNS disabled, then the policy match for the
removed IP addresses doesn't work as expected.
</div>
<div class="p">
<b class="ph b">Workaround</b>: Enable (or disable) Load Balanced DNS
consistently for an FQDN that is used with multiple address objects.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-290692</b></div>
</td>
<td class="entry relcol">
<div class="p">
In Host Compliance Service, when you create a 'Shared' type Host
Compliance Object for the 'Disk-Encryption' category, the State
drop-down is automatically selected and cannot be edited. However, you
can change the state later by editing the object, if required.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-289524</b></div>
</td>
<td class="entry relcol">
<div class="p">
In PAN-OS 12.1.2 and later 12.1 releases, PAN-OS can obtain resolved
IP addresses from a Load balanced DNS server and use them in a policy
match. However, this functionality does not work as intended when the
DNS cache reuse flag is enabled. When the DNS cache reuse flag is
enabled, the DNS resolution works as if the Load balanced DNS flag
(for an Address object) is disabled.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-286496</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">NGFW Clusters</tt>) URL-continue and override
continue selections will function like a general URL-block action.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-283429</b></div>
</td>
<td class="entry relcol">
<div class="p">
When you use custom certificates for the connection between Panorama
and a log collector, the automated renewal for the predefined
ElasticSearch certificates gets disrupted.
</div>
<div class="p">
<b class="ph b">Workaround</b>: Remove the custom certificates before
the ElasticSearch certificates expire. This allows the system to
correctly identify and renew the predefined ElasticSearch
certificates. After the renewal is complete, re-install the custom
certificates.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-237106</b></div>
</td>
<td class="entry relcol">
<div class="p">
LSVPN satellite certificates may be generated with serial numbers
exceeding 40 hexadecimal characters. This causes certificate
revocation and deletion operations to fail with the following error
messages:
</div>
<ul id="panos-known-issues-12.1.5_ul-t2x_dxs_wgc" class="ul">
<li class="li">
<span class="ph systemoutput"
>db-serialno can be at most 40 characters</span
>
</li>
<li class="li">
<span class="ph systemoutput">db-serialno is invalid</span>
</li>
</ul>
<b class="ph b">Workaround:</b>
<div class="p">
To resolve this issue, use the following CLI commands with the LSVPN
satellite serial number to manually delete or revoke the affected
certificates:
</div>
<div class="p">
<b class="ph b">Delete certificate information</b>:<span
class="ph userinput"
>delete sslmgr-store certificate-info portal name
<var class="keyword varname">&lt;name&gt;</var> serialno
<var class="keyword varname">&lt;satellite_serial&gt;</var></span
>
</div>
<div class="p">
<b class="ph b">Revoke satellite certificates</b>:<span
class="ph userinput"
>delete sslmgr-store satellite-info-revoke-certificate portal
<var class="keyword varname">&lt;name&gt;</var> serialno
<var class="keyword varname"
>&lt;list_of_satellite_serials&gt;</var
></span
>
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PLUG-21065</b></div>
</td>
<td class="entry relcol">
<div dir="ltr" class="p">
In a PA-VM or AI Runtime Security environment, it is observed that the
Software Firewall Orchestration plugin deployed with a VM-Flex license
and configured with 8-14 GB of memory may encounter traffic
disruptions when jumbo frames are enabled. It is recommended to
disable jumbo frames on these lower-end VMs in version 12.1.2 by
executing the command: set system setting jumbo-frame off.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PLUG-19238</b></div>
</td>
<td class="entry relcol">
<div class="p">
Enabling Advanced Routing through bootstrap on VM-Series and Prisma
AIRS is not supported.
</div>
<b class="ph b">Workaround</b>: After the firewall boots up, enable
advanced routing using the CLI command set device-management
general-settings advance-routing yes or enable
<a
class="xref"
href="https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-networking-admin/advanced-routing/enable-advanced-routing"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>advanced routing</a
>
through the UI.
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">DRS-6556</b></div>
</td>
<td class="entry relcol">
<div class="p">
For Host Compliance Service, while configuring Mappings &amp; Tags in
CIE and when you click on the
<span class="ph uicontrol">HIP Report</span> tab, the following error
message is displayed even when the response is successful:
</div>
<div class="p">
<span class="ph uicontrol">getaddrinfo ENOTFOUND null</span>
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/known/12.1.6.html
+797
View File
@@ -0,0 +1,797 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 34%" />
<col style="width: 66%" />
</colgroup>
<thead class="thead">
<tr class="row rowsep">
<th class="entry">
<div class="p"><b class="ph b">Issue ID</b></div>
</th>
<th class="entry">
<div class="p"><b class="ph b">Description</b></div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-313779</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">PA-7500 series only</tt>) PA-7500 series firewalls
running PAN-OS 12.1.5 release do not support encryption on HA1 and
HA1-backup interfaces. As a result, attempting to execute the
<span class="ph codeph"
>request high-availability session-reestablish</span
>
command will fail with the following error.
</div>
<div class="p">
<pre
id="panos-known-issues-12.1.6_screen-ilq_djv_h3c"
class="pre screen"
>
ERROR: Encryption is not enabled for HA</pre
>
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-313669</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>PA-5500 Series firewalls in cluster configurations only</tt
>) When a firewall node is removed from a PA-5500 Series cluster,
after the cluster commit and reboot, the node starts in standalone
mode with a default virtual wire (vwire) configuration loaded. This
default configuration is missing zone assignments for ports eth1/1 and
eth1/2, which causes commit operations to fail. Even if zones are
manually assigned to these ports, subsequent commit attempts will fail
with a
<span data-outputclass="response" class="ph systemoutput"
>no UUId for rule1</span
>
error.
</div>
<div class="p">
<b class="ph b">Workaround:</b> To resolve this, either:
</div>
<div class="p">
<ul id="panos-known-issues-12.1.6_ul-ybs_j3g_k3c" class="ul">
<li class="li">
Manually assign zone configurations to ports eth1/1 (for example,
untrust) and eth1/2 (for example, trust), then open and close
security policy rule1 without making changes, and
<span class="ph uicontrol">Commit</span>.
</li>
<li class="li">
Delete the default rule and the default virtual wire Ethernet
interfaces, then commit.
</li>
</ul>
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-313623</b></div>
</td>
<td class="entry relcol">
<div class="p">
On firewalls with TPM (Trusted Platform Module) support, device
certificate renewals may fail due to a disk partition being full. This
latter occurs because temporary files aren't being deleted during
device certificate status checks.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-312247</b></div>
</td>
<td class="entry relcol">
<div class="p">
In generated PDF upgrade check reports, long remediation URLs might be
truncated due to UI framework export limitations, leaving only the
first line hyperlinked. However, these links remain fully functional
within the Panorama web interface. The PDF link directs to the correct
destination if the complete URL is copied from the PDF and pasted in
the browser.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-309604</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">PA-5500 series only</tt>) In some rare cases, the
front panel PSU status LED might show amber, even when the LEDs on the
PSU show green.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-309602</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">PA-5500 series only</tt>) When the firewall is
initially powered on, the FAN-0 LED does not turn on. The fan
functions correctly, but the LED doesn't reflect the status.
</div>
<div class="p">
<b class="ph b">Workaround:</b> Remove and reinsert the fan to turn on
the LED.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-308564</b></div>
</td>
<td class="entry relcol">
<div class="p">
Packets are dropped on SD-WAN interfaces if they require fragmentation
for an interface but have the
<span class="ph uicontrol">Don't Fragment (DF)</span> bit set. This
results in unexpected packet drops. This affects client to server
sessions when using SD-WAN for NGFW.
</div>
<div class="p">
<b class="ph b">Workaround:</b> Allow fragmenting packets with DF bit
set (<span class="ph userinput"
>debug dataplane set ip4-ignore-df yes</span
>).
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300850</b></div>
</td>
<td class="entry relcol">
<div class="p">
Manual scheduling of cloud verdicts is required if a new host in an
Host Compliance Service-enabled environment has a refresh event entry
without a corresponding update event entry.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300809</b></div>
</td>
<td class="entry relcol">
<div class="p">
Host Compliance Service connectivity will not work if it is connected
with management IP which is configured with DHCP mode.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300677</b></div>
</td>
<td class="entry relcol">
<div class="p">
Panorama cannot display Threat log entries (<b class="ph b"
>Monitor &gt; Logs &gt; Threat</b
>) when the managed log collector is running a lower PAN-OS release
than Panorama.
</div>
<div class="p">
Workaround: Upgrade the log collectors to the same version as
Panorama.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300627</b></div>
</td>
<td class="entry relcol">
<div class="p">
AutoCommit fails when the Traffic Object is used on AI Runtime
Security, which consequently impacts the workloads that utilize
overlapping subnets.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300483</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">PA-7500 firewall only</tt>) Enabling FIPS-CC mode
causes the firewall to go into maintenance mode.
</div>
<div class="p">
<b class="ph b">Workaround</b>: After the firewall goes into
maintenance mode, perform an additional reboot. The firewall will
successfully start up in FIPS-CC mode.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300467</b></div>
</td>
<td class="entry relcol">
<div class="p">
WildFire WF-500 appliances running PAN-OS 10.x or PAN-OS 11.x cannot
be managed by Panorama running PAN-OS 12.1.2 due to connectivity
issues.
</div>
<div class="p">
<b class="ph b">Workaround:</b> Upgrade your WildFire appliances to
PAN-OS 12.1.2 or later.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300407</b></div>
</td>
<td class="entry relcol">
<div class="p">
The Release Note URL column in the Panorama &gt; Plugins page is
empty.
</div>
<div class="p">
Release Notes for the plugins are available in the
<a
class="xref"
href="https://docs.paloaltonetworks.com/plugins/vm-series-and-panorama-plugins-release-notes"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>plugins release notes</a
>
or in their individual product release notes.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300230</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">NGFW Cluster</tt>) In an NGFW cluster, your pings
to the HSCI-B link might fail, even when the link indicates it is up.
In the event that the HSCI-A link is brought down or unplugged, the
cluster node will transition to failed state, avoiding split brain as
both HSCI links are down in this case.
</div>
<div class="p">
<b class="ph b">Workaround</b>: Reboot the cluster node to resolve the
HSCI-B ping issue.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300192</b></div>
</td>
<td class="entry relcol">
<div class="p">
If the Host Compliance Service is configured with a service route
pointing to an unreachable IP address, the
<span class="ph systemoutput">gp_broker</span> process may stop
working when you enable-disable the Host Compliance Service.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300114</b></div>
</td>
<td class="entry relcol">
<div class="p">
VM entered maintenance mode during a downgrade from version 12.1.2 to
11.2.7, when executed through the CLI.
</div>
<div class="p">
<b class="ph b">Workaround</b>: Download and install the required
version of PAN-OS through the UI instead of the CLI.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300069</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">PA-410 firewall only</tt>) Loading a saved config
file can take up to 5 minutes.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300053</b></div>
</td>
<td class="entry relcol">
<div class="p">
When you use the CLI command
<span class="ph userinput">request system fqdn refresh</span> to
trigger another IP address resolution of configured FQDN entries, the
firewall might get into an error state where the DNS Proxy cache
received and stored a new IP address for a particular FQDN entry via
this command. However, the Device-Server (and the Security rule) still
have the old IP address for that FQDN entry.
</div>
<div class="p">
<b class="ph b">Workaround</b>: Avoid using the CLI command:
<span class="ph userinput">request system fqdn refresh</span>. Use the
following command instead (for a particular domain-name or an entire
list):
<span class="ph userinput"
>clear dns-proxy cache all domain-name &lt;domain_name&gt;</span
>. To correct the error state where the DNS Proxy cache and
Device-Server and Security rule are already storing different IP
addresses, use the following CLI command:
<span class="ph userinput"
>debug device-server dump fqdn type resync vsys &lt;vsys_name&gt;
fqdn-name &lt;domain_name&gt;</span
>
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-300025</b></div>
</td>
<td class="entry relcol">
<div class="p">
If Azure hotplug events occur, the firewall may experience a
<span class="ph userinput">brdagent</span> crash and data interfaces
may transition to an unknown state, leading to traffic disruption.
</div>
<div class="p">
<b class="ph b">Workaround</b>: Reboot the VM if the
<span class="ph userinput">brdagent</span> crash does not trigger a
device reboot.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-299562</b></div>
</td>
<td class="entry relcol">
<div class="p">
SSL proxy sessions fail when clients send a Client Hello with TLSv1.2
and TLSv1.3, and exclusively prefer the secp192 elliptic curve.
</div>
<div class="p">
<b class="ph b">Workaround</b>: To address this, configure a
decryption profile to use TLSv1.2 as the maximum supported TLS
version. Then, apply this profile to the decryption policy rules for
the affected clients and servers. This enables the client to modify
its preferred curves, facilitating successful session establishment.
</div>
</td>
</tr>
<tr class="row">
<td class="entry"><b class="ph b">PAN-299387</b></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">NGFW Cluster</tt>) When an NGFW cluster has only
one firewall node present and powered up, that node is stuck in
UNKNOWN state after you reboot it and it comes back up. The issue
occurs in two scenarios:
</div>
<ul id="panos-known-issues-12.1.6_ul-pfz_hyt_tgc" class="ul">
<li class="li">
When there is only one node configured in the cluster (no peer is
available or configured).
</li>
<li class="li">
When the peer device in the cluster is completely powered down or
unable to autonegotiate its connected HSCI ports. That is, two nodes
are in the cluster, but only one node is booting up while the other
remains down completely.
</li>
</ul>
<div class="p">
The expected behavior is that if no peer device is available (at a
port autonegotiation or link level for HSCI-A or HSCI-B), then a
cluster device should go to INITIAL state, followed by ONLINE state
(and not remain in UNKNOWN state).
</div>
<div class="p">
<b class="ph b">Workaround</b>: To avoid this issue, connect the
HSCI-A to HSCI-B in loopback to create a link partner.
</div>
</td>
</tr>
<tr class="row">
<td class="entry"><b class="ph b">PAN-299229</b></td>
<td class="entry relcol">
<div class="p">
On PA-5400 Series and PA-7500 Series firewalls, if you run certain
types of CLI commands during or shortly after a commit, the commands
will time out. The types of CLI commands impacted by this issue are
IoT, Cloud-User-ID, and App-ID Cloud Engine CLI commands.
</div>
<div class="p">
<b class="ph b">Workaround</b>: Don't execute IoT, Cloud-User-ID, or
App-ID Cloud Engine CLI commands during or shortly after a commit on a
PA-5400 Series or PA-7500 Series firewall.
</div>
</td>
</tr>
<tr class="row">
<td class="entry"><b class="ph b">PAN-299170</b></td>
<td class="entry relcol">
<div class="p">
The remediation link included in the generated PDF of an upgrade check
report might be pruned due to a text length limitation of the export
function. The link remains fully functional and works correctly on the
Panorama web interface.
</div>
</td>
</tr>
<tr class="row">
<td class="entry"><b class="ph b">PAN-299114</b></td>
<td class="entry relcol">
<div class="p">
After you enable the
<span class="ph uicontrol"
>Enable Duplicate Logging (Cloud and On-Premise) </span
>setting on a firewall, clicking
<span class="ph uicontrol">Status for Cloud Logging</span>, does not
display the logging service connection status.
</div>
</td>
</tr>
<tr class="row">
<td class="entry"><b class="ph b">PAN-298540</b></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">PA-5500 Series firewalls only</tt>) The
<span class="ph uicontrol">Monitor</span> tab in the Web Interface
does not display a pop-up to indicate that high-speed log forwarding
is enabled and that logs are only viewable from Panorama.
</div>
</td>
</tr>
<tr class="row">
<td class="entry"><b class="ph b">PAN-298083</b></td>
<td class="entry relcol">
<div class="p">
After you change the system mode on an M-700 appliance from Panorama
mode to PAN-DB private cloud mode, the
<span class="ph codeph">snmpd</span> process fails to work.
</div>
</td>
</tr>
<tr class="row">
<td class="entry"><b class="ph b">PAN-298047</b></td>
<td class="entry relcol">
<div class="p">
In an AI Runtime Security environment, the Azure Container outbound
traffic does not seem to be functional and the egress traffic is being
misdirected to an incorrect cluster node port.
</div>
</td>
</tr>
<tr class="row">
<td class="entry"><b class="ph b">PAN-297772</b></td>
<td class="entry relcol">
<div class="p">
When an Intel e810 NIC is configured in SR-IOV mode, sharing Virtual
Functions (VFs) among multiple HSF cluster nodes and subsequently
rebooting a cluster node while traffic is active may result in traffic
disruption on other HSF cluster nodes utilizing the same NIC. It is
recommended to refrain from sharing Intel e810 VFs across cluster
nodes and to allocate one VF per Intel e810 PF.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-297114</b></div>
</td>
<td class="entry relcol">
<div class="p">
After successfully generating a health check report for managed
firewalls from Panorama, the progress bar does not appear and the
latest health check reports are not displayed (<span
class="ph uicontrol"
>Panorama &gt; Device Deployment &gt; Upgrade Check</span
>).
</div>
<div class="p">
<b class="ph b">Workaround</b>: Manually refresh the page to see the
latest reports.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-294687</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">NGFW Clusters</tt>) In an NGFW cluster, the leader
can't retrieve the HIP Report from Panorama, nor synchronize it to the
non-leader nodes. Unlike HA Active/Passive mode, both leader and
non-leader nodes receive traffic in cluster mode. If the relevant HIP
Report is missing, policies involving HIP may not work properly. The
expected behavior is that when a non-leader node receives related
traffic, it should request the corresponding HIP Report from the
leader.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-293754</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">NGFW Clusters</tt>) Firewalls in an NGFW cluster
indicate they are in ONLINE state even though their configurations are
different (they aren't synchronized).
</div>
<div class="p">
<b class="ph b">Workaround</b>: Push the configuration from Panorama
to all cluster members at the same time; don't push to an individual
firewall. If a cluster member isn't connected to Panorama during the
push, the push will fail to the disconnected firewall, but will
succeed to all connected firewalls.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-293718</b></div>
</td>
<td class="entry relcol">
<div class="p">
When high speed logging is enabled on a PA-5560 device, the expected
warning message is not displayed on the web interface. This prevents
administrators from being notified that logs can only be viewed from
Panorama.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-292601</b></div>
</td>
<td class="entry relcol">
<div class="p">
PAN-OS 12.1.2 and later 12.1 releases support a Load Balanced DNS
configuration for an address object. If there are two address objects
with same FQDN, but one object has Load Balanced DNS enabled and other
object has Load Balanced DNS disabled, then the policy match for the
removed IP addresses doesn't work as expected.
</div>
<div class="p">
<b class="ph b">Workaround</b>: Enable (or disable) Load Balanced DNS
consistently for an FQDN that is used with multiple address objects.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-290692</b></div>
</td>
<td class="entry relcol">
<div class="p">
In Host Compliance Service, when you create a 'Shared' type Host
Compliance Object for the 'Disk-Encryption' category, the State
drop-down is automatically selected and cannot be edited. However, you
can change the state later by editing the object, if required.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-289524</b></div>
</td>
<td class="entry relcol">
<div class="p">
In PAN-OS 12.1.2 and later 12.1 releases, PAN-OS can obtain resolved
IP addresses from a Load balanced DNS server and use them in a policy
match. However, this functionality does not work as intended when the
DNS cache reuse flag is enabled. When the DNS cache reuse flag is
enabled, the DNS resolution works as if the Load balanced DNS flag
(for an Address object) is disabled.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-286496</b></div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">NGFW Clusters</tt>) URL-continue and override
continue selections will function like a general URL-block action.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-283429</b></div>
</td>
<td class="entry relcol">
<div class="p">
When you use custom certificates for the connection between Panorama
and a log collector, the automated renewal for the predefined
ElasticSearch certificates gets disrupted.
</div>
<div class="p">
<b class="ph b">Workaround</b>: Remove the custom certificates before
the ElasticSearch certificates expire. This allows the system to
correctly identify and renew the predefined ElasticSearch
certificates. After the renewal is complete, re-install the custom
certificates.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-237106</b></div>
</td>
<td class="entry relcol">
<div class="p">
LSVPN satellite certificates may be generated with serial numbers
exceeding 40 hexadecimal characters. This causes certificate
revocation and deletion operations to fail with the following error
messages:
</div>
<ul id="panos-known-issues-12.1.6_ul-t2x_dxs_wgc" class="ul">
<li class="li">
<span class="ph systemoutput"
>db-serialno can be at most 40 characters</span
>
</li>
<li class="li">
<span class="ph systemoutput">db-serialno is invalid</span>
</li>
</ul>
<b class="ph b">Workaround:</b>
<div class="p">
To resolve this issue, use the following CLI commands with the LSVPN
satellite serial number to manually delete or revoke the affected
certificates:
</div>
<div class="p">
<b class="ph b">Delete certificate information</b>:<span
class="ph userinput"
>delete sslmgr-store certificate-info portal name
<var class="keyword varname">&lt;name&gt;</var> serialno
<var class="keyword varname">&lt;satellite_serial&gt;</var></span
>
</div>
<div class="p">
<b class="ph b">Revoke satellite certificates</b>:<span
class="ph userinput"
>delete sslmgr-store satellite-info-revoke-certificate portal
<var class="keyword varname">&lt;name&gt;</var> serialno
<var class="keyword varname"
>&lt;list_of_satellite_serials&gt;</var
></span
>
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PLUG-21065</b></div>
</td>
<td class="entry relcol">
<div dir="ltr" class="p">
In a PA-VM or AI Runtime Security environment, it is observed that the
Software Firewall Orchestration plugin deployed with a VM-Flex license
and configured with 8-14 GB of memory may encounter traffic
disruptions when jumbo frames are enabled. It is recommended to
disable jumbo frames on these lower-end VMs in version 12.1.2 by
executing the command: set system setting jumbo-frame off.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PLUG-19238</b></div>
</td>
<td class="entry relcol">
<div class="p">
Enabling Advanced Routing through bootstrap on VM-Series and Prisma
AIRS is not supported.
</div>
<b class="ph b">Workaround</b>: After the firewall boots up, enable
advanced routing using the CLI command set device-management
general-settings advance-routing yes or enable
<a
class="xref"
href="https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-networking-admin/advanced-routing/enable-advanced-routing"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>advanced routing</a
>
through the UI.
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">DRS-6556</b></div>
</td>
<td class="entry relcol">
<div class="p">
For Host Compliance Service, while configuring Mappings &amp; Tags in
CIE and when you click on the
<span class="ph uicontrol">HIP Report</span> tab, the following error
message is displayed even when the response is successful:
</div>
<div class="p">
<span class="ph uicontrol">getaddrinfo ENOTFOUND null</span>
</div>
</td>
</tr>
</tbody>
</table>
crawler/code/process_issues.mjs → reference/process_issues.mjs
View File