Add Prisma Access Agent known and addressed issues
This commit is contained in:
@@ -0,0 +1,14 @@
|
||||
---
|
||||
type: Addressed
|
||||
product: Prisma Access Agent
|
||||
version: 25.3.1
|
||||
---
|
||||
|
||||
## PANG-7012
|
||||
|
||||
Fixed an issue where the embedded browser for Prisma Access Agent
|
||||
did not reuse the Windows Hello token for reauthentication, forcing
|
||||
users to manually enter their credentials despite having Windows
|
||||
Hello enabled on their devices. The embedded browser now properly
|
||||
leverages existing Windows Hello authentication tokens for seamless
|
||||
reauthentication without requiring manual credential entry.
|
||||
@@ -0,0 +1,26 @@
|
||||
---
|
||||
type: Addressed
|
||||
product: Prisma Access Agent
|
||||
version: 25.3
|
||||
---
|
||||
|
||||
## PANG-6738
|
||||
|
||||
Fixed an issue where certificate authentication failed on Windows
|
||||
devices when certificates were stored in the machine certificate
|
||||
store, preventing the Prisma Access Agent from properly
|
||||
authenticating users with machine-level certificates. The agent now
|
||||
correctly accesses and utilizes client certificates from the machine
|
||||
certificate store, eliminating the need to manually import
|
||||
certificates to the user's personal certificate store as a
|
||||
workaround.
|
||||
|
||||
## EPM-4616
|
||||
|
||||
Fixed an issue where newly added internal gateways weren’t
|
||||
visible in existing Prisma Access Agent settings, preventing
|
||||
administrators from updating agent configurations with recently
|
||||
added internal gateways. The agent settings now automatically
|
||||
refresh to display all available internal gateways, including those
|
||||
added after the initial configuration, eliminating the need to
|
||||
create new agent settings to access newly added gateways.
|
||||
@@ -0,0 +1,51 @@
|
||||
---
|
||||
type: Addressed
|
||||
product: Prisma Access Agent
|
||||
version: 25.4
|
||||
---
|
||||
|
||||
## PANG-7949
|
||||
|
||||
Fixed an issue where the Dynamic Privilege Access enabled Prisma
|
||||
Access Agent was unable to connect to a gateway after upgrading an
|
||||
endpoint to Windows 11 24H2. Following the Windows upgrade, the
|
||||
Prisma Access Agent would lose the ability to establish gateway
|
||||
connections, even though the Endpoint Manager (EPM) connection
|
||||
remained functional. This issue occurred consistently across systems
|
||||
that had undergone the Windows 11 24H2 upgrade, affecting the
|
||||
agent's ability to connect to any configured gateways while
|
||||
maintaining normal endpoint manager connectivity.
|
||||
|
||||
## PANG-7865
|
||||
|
||||
Fixed an issue where the Prisma Access Agent on Windows did not
|
||||
properly honor updated session timers after a user extended their
|
||||
session through the embedded browser. The agent now correctly adopts
|
||||
the newly extended session duration when users authenticate through
|
||||
the session expiry banner, preventing premature session termination
|
||||
and ensuring the Prisma Access Agent icon remains responsive in the
|
||||
system tray throughout the extended session period.
|
||||
|
||||
## PANG-7960
|
||||
|
||||
Fixed an issue where the Prisma Access Agent on Windows blocked
|
||||
authentication in the embedded browser due to the
|
||||
Best Available - Fail Safe mechanism
|
||||
in the forwarding profile triggering during the initial
|
||||
connection attempt. The embedded browser now properly bypasses
|
||||
the fail-safe mechanism when the agent is configured to run in
|
||||
on-demand mode, enabling successful authentication on the first
|
||||
attempt without requiring users to cancel and retry the
|
||||
authentication process after a reboot.
|
||||
|
||||
## PANG-7309
|
||||
|
||||
Fixed an issue where the Prisma Access Agent on Windows failed to
|
||||
automatically switch from an external gateway to an internal gateway
|
||||
when the user's device woke from sleep mode after being connected to
|
||||
different network environments. The agent now properly detects
|
||||
network changes upon waking from sleep. It also automatically
|
||||
switches to the appropriate internal gateway without requiring
|
||||
manual sign-out via the pacli epm signout
|
||||
command and subsequent reauthentication through the Prisma Access
|
||||
Agent app.
|
||||
@@ -0,0 +1,84 @@
|
||||
---
|
||||
type: Addressed
|
||||
product: Prisma Access Agent
|
||||
version: 25.6.2
|
||||
---
|
||||
|
||||
## PANG-9620
|
||||
|
||||
Fixed an issue where the Prisma Access Agent would automatically
|
||||
disconnect and remain disconnected without attempting to
|
||||
reconnect, leaving users without network protection. The problem
|
||||
occurred when the agent lost its connection to the endpoint
|
||||
management server and failed to re-establish the connection
|
||||
automatically as expected.
|
||||
|
||||
This occurred due to a DNS resolution timing conflict in certain
|
||||
network environments where the primary DNS server was
|
||||
unresponsive while the secondary DNS server was functioning
|
||||
properly. The fix adjusts the DNS resolution process to ensure
|
||||
proper failover occurs when the primary DNS server is
|
||||
unavailable, allowing the agent to maintain connectivity and
|
||||
automatically reconnect when network issues are resolved.
|
||||
|
||||
## PANG-9630
|
||||
|
||||
Fixed an issue where the Prisma Access Agent would become stuck
|
||||
in a "Connecting" state after a network switch when attempting
|
||||
to connect to an internal gateway. This problem occurred when
|
||||
users experienced a network change that caused them to be logged
|
||||
out from the tunnel, and while the Prisma Access Agent endpoint
|
||||
manager web-socket would successfully reconnect, the Prisma
|
||||
Access Agent app would remain stuck displaying "Connecting"
|
||||
indefinitely.
|
||||
|
||||
## PANG-9276
|
||||
|
||||
Fixed an issue where the Spyder application would display
|
||||
"Permission denied" errors and fail to work properly when Prisma
|
||||
Access Agent was installed on the same computer. Users found
|
||||
that Spyder would only function normally after completely
|
||||
removing the Prisma Access Agent from their system, creating a
|
||||
conflict between the two programs. The fix ensures that the
|
||||
Prisma Access Agent no longer interferes with Spyder, allowing
|
||||
both programs to run simultaneously without conflicts while
|
||||
maintaining the agent's security protection for other
|
||||
applications on the system.
|
||||
|
||||
## PANG-9220
|
||||
|
||||
Fixed an issue where users encountered "Server Enrollment
|
||||
failure" errors after installing Prisma Access Agent version
|
||||
25.4.0.29, preventing them from successfully connecting to their
|
||||
organization's network. The problem occurred during the initial
|
||||
setup process when the agent attempted to register with the
|
||||
endpoint management server but failed with messages indicating
|
||||
an invalid enrollment secret. This occurred due to a
|
||||
compatibility issue between the agent's security enrollment
|
||||
method and certain Windows system security components. When the
|
||||
agent tried to use the primary secure enrollment process, some
|
||||
Windows systems would reject the connection due to unsupported
|
||||
security protocols, causing the entire enrollment to fail.
|
||||
|
||||
## PANG-9092
|
||||
|
||||
Fixed an issue where the Prisma Access Agent would freeze and
|
||||
become stuck in a non-responding state. The problem occurred
|
||||
when the application attempted to update multiple settings at
|
||||
the same time from different parts of the program, causing
|
||||
conflicts that would lock up the entire application. This
|
||||
resulted in users being unable to interact with Prisma Access
|
||||
Agent, as the interface would stop responding and the agent
|
||||
would appear to hang indefinitely. The fix ensures that all
|
||||
setting updates are now processed in a controlled, sequential
|
||||
manner to prevent these conflicts and maintain application
|
||||
responsiveness.
|
||||
|
||||
## PANG-9067
|
||||
|
||||
Fixed an issue where the Prisma Access Agent on macOS 15.6.1 failed to connect to external gateways when selecting Best Location and incorrectly switched to internal connectivity. This issue manifested in two specific scenarios:
|
||||
|
||||
1. After upgrading the operating system from macOS 15.6 to 15.6.1, Prisma Access Agent would incorrectly connect to an on-premises gateway instead of maintaining its connection to the external Prisma Access gateway that it was using prior to the OS upgrade.
|
||||
2. When users selected Best Location from the Prisma Access Agent app, the agent would search through all available Prisma Access gateways but then inappropriately switch to Internal mode, even when connected to a home WiFi network where Internal Host Detection should not be triggered.
|
||||
|
||||
This occurred due to the improper cleanup of the on-premises tunnel routes during the Best Location selection process, which caused the system to incorrectly determine that it was on an internal network and activate the Internal Host Detection functionality. This resulted in users being unable to establish proper external gateway connections through Prisma Access Agent on the updated macOS version, forcing the agent into internal mode when external connectivity was required and available.
|
||||
@@ -0,0 +1,33 @@
|
||||
---
|
||||
type: Addressed
|
||||
product: Prisma Access Agent
|
||||
version: 25.6
|
||||
---
|
||||
|
||||
## PANG-8845
|
||||
|
||||
Fixed an issue where the Prisma Access Agent would incorrectly
|
||||
remain bound to port 0 when switching between Prisma Access
|
||||
Agent endpoint manager configurations with different proxy
|
||||
settings, causing endpoint traffic to Explicit Proxy (EP) to
|
||||
fail. This problem occurred when the agent initially connected
|
||||
to an endpoint manager without agent proxy configured, then
|
||||
switched to a different endpoint manager that had a proxy port
|
||||
configured, but failed to update its port binding from port 0 to
|
||||
the new proxy port. The agent now correctly updates its port
|
||||
binding when switching between endpoint manager configurations
|
||||
with different proxy settings, eliminating traffic routing
|
||||
disruptions.
|
||||
|
||||
## PANG-8200
|
||||
|
||||
Fixed an issue where the Prisma Access Agent on Windows devices
|
||||
would incorrectly display the previously connected server FQDN in
|
||||
the Server Name field after executing the pacli epm
|
||||
signout command without the --keep
|
||||
parameter, instead of properly resetting to show Select
|
||||
Server Name as expected. This inconsistency between
|
||||
Windows and Mac platforms has been resolved, ensuring that both
|
||||
operating systems now consistently reset the login view and display
|
||||
the default Select Server Name prompt when
|
||||
signing out without preserving server information.
|
||||
@@ -0,0 +1,14 @@
|
||||
---
|
||||
type: Addressed
|
||||
product: Prisma Access Agent
|
||||
version: 25.7.1
|
||||
---
|
||||
|
||||
## PANG-9876
|
||||
|
||||
Fixed an issue where the PASrv service would crash and generate
|
||||
crash files on a newly installed Prisma Access Agent running in
|
||||
Always On mode on Linux systems. The crash occurred after user
|
||||
sign-in during the tunnel connection process while the agent was
|
||||
operating in Always On mode. This issue affected Linux environments,
|
||||
particularly Ubuntu 22 x86 systems.
|
||||
@@ -0,0 +1,42 @@
|
||||
---
|
||||
type: Addressed
|
||||
product: Prisma Access Agent
|
||||
version: 25.7
|
||||
---
|
||||
|
||||
## PANG-9242
|
||||
|
||||
Fixed an issue where the Prisma Access Agent on macOS and Windows
|
||||
would fail to properly clean up tunnel interface routing table
|
||||
entries when executing the pacli epm
|
||||
signout command after a gateway shutdown had
|
||||
left the agent in a Disconnected state. This problem occurred
|
||||
when agents that were previously connected to a tenant became
|
||||
disconnected due to gateway shutdowns, and users subsequently
|
||||
attempted to sign out using the pacli
|
||||
command.
|
||||
|
||||
## PANG-8945
|
||||
|
||||
Fixed an issue where the Prisma Access Agent Manager would
|
||||
incorrectly handle ICMP traffic configuration after upgrading to
|
||||
the latest version. When the Block Non-TCP and
|
||||
Non-UDP based traffic when connected to tunnel
|
||||
option was disabled by default following an upgrade, the
|
||||
pacli traffic show command would
|
||||
inaccurately display Allow non-tunnel outbound ICMP
|
||||
when connected to tunnel as true, while the
|
||||
underlying Allow ICMP for troubleshooting
|
||||
value was incorrectly being passed as false instead of the
|
||||
expected true value.
|
||||
|
||||
The agent now properly synchronizes the ICMP traffic
|
||||
configuration values to ensure consistent behavior between the
|
||||
configuration display and actual traffic routing.
|
||||
|
||||
## PANG-8929
|
||||
|
||||
Fixed an issue where the Prisma Access Agent on Windows would
|
||||
incorrectly report "error: 513 - PASrv is unreachable, please
|
||||
confirm it's running" when executing the pacli epm
|
||||
status command during reinstallation scenarios.
|
||||
@@ -0,0 +1,29 @@
|
||||
---
|
||||
type: Addressed
|
||||
product: Prisma Access Agent
|
||||
version: 26.1.1
|
||||
---
|
||||
|
||||
## PANG-11201
|
||||
|
||||
Fixed an issue on Prisma Access Agents for Linux where the Prisma
|
||||
Access Agent connection profile became stuck in an "activating"
|
||||
state when NetworkManager was configured not to manage the
|
||||
tunnel interface, resulting in a tunnel connect and disconnect
|
||||
loop that prevented successful establishment of the tunnel.
|
||||
|
||||
## PANG-11153
|
||||
|
||||
Fixed an issue where the Prisma Access Agent on Linux experienced
|
||||
recurring PASrv process crashes approximately every 20 seconds
|
||||
due to abnormal termination during agent upgrade operations,
|
||||
causing the agent to become unresponsive and preventing log
|
||||
collection.
|
||||
|
||||
## PANG-10723
|
||||
|
||||
Fixed an issue where the Prisma Access Agent installer script on
|
||||
Linux incorrectly modified permissions of the entire
|
||||
/opt installation directory. The
|
||||
installer script now only modifies
|
||||
/opt/paloaltonetworks.
|
||||
@@ -0,0 +1,54 @@
|
||||
---
|
||||
type: Addressed
|
||||
product: Prisma Access Agent
|
||||
version: 26.1.2
|
||||
---
|
||||
|
||||
## PANG-11395
|
||||
|
||||
Fixed an issue where the Prisma Access Agent on Windows 11
|
||||
laptops did not reauthenticate with the internal gateway when
|
||||
transitioning between network interfaces (for example, from
|
||||
Wi-Fi to LAN) and temporarily having more than one active
|
||||
network interface. This prevented the IP-user mapping from being
|
||||
updated on the NGFW firewall, causing traffic from the user's IP
|
||||
to be unrecognized.
|
||||
|
||||
## PANG-11328
|
||||
|
||||
Fixed an issue where DNS resolution failed for Microsoft 365
|
||||
services (MS Teams and Outlook) running Prisma Access Agents on
|
||||
dual-stack Windows devices.
|
||||
|
||||
## PANG-11311
|
||||
|
||||
Fixed an issue where the Prisma Access Agent displayed an
|
||||
erroneous "Your connectivity might be affected. Please try again
|
||||
or contact your administrator" error notification when a user
|
||||
manually disconnected from an on-demand connection.
|
||||
|
||||
## PANG-11293
|
||||
|
||||
Fixed an issue where Prisma Access Agent version 26.1 was unable
|
||||
to retrieve the status of disk encryption for Host Information
|
||||
Profile (HIP) reports, causing HIP checks to fail and denying
|
||||
access to private applications.
|
||||
|
||||
## PANG-11284
|
||||
|
||||
Fixed an issue where, after upgrading to Prisma Access Agent
|
||||
version 26.1.1.10 on Windows, users attempting to log in with
|
||||
Microsoft Entra SSO experienced login failures and HIP check
|
||||
compliance errors (Error 53000) because the embedded browser
|
||||
incorrectly prompted for a plugin installation."
|
||||
|
||||
## PANG-11274
|
||||
|
||||
Fixed an issue on macOS devices where gateway connections would
|
||||
fail or experience significant delays after waking from sleep.
|
||||
This occurred because the Prisma Access Agent service (daemon)
|
||||
attempted to access client certificates in the login keychain
|
||||
through the user interface (UI) while the UI was still asleep.
|
||||
These requests would queue up and process sequentially once the
|
||||
UI woke, causing older requests to time out and preventing
|
||||
timely gateway connections.
|
||||
Reference in New Issue
Block a user