Add Prisma Access Agent known and addressed issues

2026-03-16 21:35:47 -05:00
parent f1e49c5830
commit 70dcd896be
25 changed files with 1054 additions and 0 deletions
@@ -0,0 +1,78 @@
+---
+type: Known
+product: Prisma Access Agent
+version: 25.4
+---
+
+## PANG-8945
+
+```resolved
+Resolved in Prisma Access Agent 25.7
+```
+
+When you upgrade to the latest Prisma Access Agent Manager (EPM), the
+default for Block Non-TCP and Non-UDP based traffic when
+connected to tunnel is disabled. An issue exists
+where the pacli traffic show command output
+incorrectly shows Allow non-tunnel outbound ICMP when
+connected to tunnel as true.
+
+When the Block Non-TCP and Non-UDP based traffic when
+connected to tunnel option is disabled, the
+Allow ICMP for troubleshooting value
+should be passed as true. Currently, the Allow ICMP for
+troubleshooting value is incorrectly being passed as
+false (disabled), which should block ICMP traffic that goes out of
+the tunnel. However, ICMP traffic is actually being allowed through
+the physical adapter, creating a discrepancy between the
+configuration and actual traffic behavior.
+
+This results in inconsistent ICMP traffic handling where the
+configuration indicates ICMP should be blocked, but the traffic is
+actually permitted.
+
+## PANG-8864
+
+```resolved
+Resolved in Prisma Access Agent 25.6
+```
+
+An issue exists where the Prisma Access Agent might incorrectly
+remain bound to port 0 when switching between Prisma Access Agent
+Manager (EPM) configurations with different proxy settings, causing
+endpoint traffic to Explicit Proxy (EP) to fail.
+
+When the Prisma Access Agent initially connects to an EPM without
+agent proxy configured, it binds to port 0 after a system restart on
+the endpoint. If the system subsequently switches to a different EPM
+that has a proxy port configured, the agent might fail to update its
+port binding and incorrectly remain bound to port 0. This results in
+endpoint traffic destined for the Explicit Proxy failing to function
+properly.
+
+Workaround: To resolve this issue, restart the endpoint, and
+then run the pacli proxy disable command,
+followed by the pacli proxy enable command.
+This forces the agent to properly initialize with the correct proxy
+port configuration from the new EPM.
+
+## PANG-8863
+
+An issue exists where the embedded browser intermittently displays as
+blank or empty after installing Prisma Access Agent version 25.4 on
+Windows 11 systems. The embedded browser window appears but shows no
+content, preventing users from completing authentication or
+accessing websites through the agent's built-in browser
+component.
+
+Workaround: Restart the endpoint.
+
+## PANG-8646
+
+An issue exists where the reasoning for blocked non-TCP, non-UDP, and
+ICMP traffic is not logged in the PACli logs or network manager
+logs. When Prisma Access Agent forwarding profiles block this type
+of traffic, administrators cannot view the verdict reasoning or
+decision details through either the PACli command-line interface or
+network manager logs, making it difficult to audit and troubleshoot
+blocked traffic for these protocol types.