From 81ab70ba0f401eedc0dad49dd7db0b196883755e Mon Sep 17 00:00:00 2001 From: Aaron Axvig Date: Fri, 20 Mar 2026 15:44:45 -0500 Subject: [PATCH] Add 10.1 issue data --- .../PAN-OS/addressed/10.1.10-h1_2026-03-16.md | 103 ++ .../PAN-OS/addressed/10.1.10-h2_2026-03-16.md | 75 + .../PAN-OS/addressed/10.1.10_2026-03-16.md | 591 ++++++++ .../addressed/10.1.11-h10_2026-03-16.md | 51 + .../PAN-OS/addressed/10.1.11-h5_2026-03-16.md | 83 ++ .../PAN-OS/addressed/10.1.12-h3_2026-03-16.md | 31 + .../PAN-OS/addressed/10.1.13-h1_2026-03-16.md | 43 + .../PAN-OS/addressed/10.1.13-h5_2026-03-16.md | 31 + .../addressed/10.1.14-h10_2026-03-16.md | 11 + .../addressed/10.1.14-h11_2026-03-16.md | 19 + .../addressed/10.1.14-h13_2026-03-16.md | 27 + .../addressed/10.1.14-h14_2026-03-16.md | 15 + .../addressed/10.1.14-h16_2026-03-16.md | 23 + .../addressed/10.1.14-h19_2026-03-16.md | 19 + .../addressed/10.1.14-h20_2026-03-16.md | 15 + .../PAN-OS/addressed/10.1.14-h2_2026-03-16.md | 39 + .../PAN-OS/addressed/10.1.14-h6_2026-03-16.md | 51 + .../PAN-OS/addressed/10.1.14-h8_2026-03-16.md | 39 + .../PAN-OS/addressed/10.1.14_2026-03-16.md | 327 +++++ .../PAN-OS/addressed/10.1.2_2026-03-16.md | 159 +++ .../PAN-OS/addressed/10.1.3-h1_2026-03-16.md | 11 + .../PAN-OS/addressed/10.1.4-h6_2026-03-16.md | 27 + .../PAN-OS/addressed/10.1.5-h3_2026-03-16.md | 15 + .../PAN-OS/addressed/10.1.5-h4_2026-03-16.md | 27 + .../PAN-OS/addressed/10.1.5_2026-03-16.md | 721 ++++++++++ .../PAN-OS/addressed/10.1.6-h3_2026-03-16.md | 79 ++ .../PAN-OS/addressed/10.1.6-h6_2026-03-16.md | 115 ++ .../PAN-OS/addressed/10.1.6-h7_2026-03-16.md | 15 + .../PAN-OS/addressed/10.1.6-h9_2026-03-16.md | 11 + .../PAN-OS/addressed/10.1.7-h1_2026-03-16.md | 27 + .../PAN-OS/addressed/10.1.7_2026-03-16.md | 639 +++++++++ .../PAN-OS/addressed/10.1.8-h2_2026-03-16.md | 171 +++ .../PAN-OS/addressed/10.1.8-h7_2026-03-16.md | 27 + .../PAN-OS/addressed/10.1.8-h8_2026-03-16.md | 11 + .../PAN-OS/addressed/10.1.8_2026-03-16.md | 143 ++ .../PAN-OS/addressed/10.1.9-h6_2026-03-16.md | 15 + .../issues/PAN-OS/known/10.1.0_2026-03-16.md | 1234 +++++++++++++++++ .../issues/PAN-OS/known/10.1.11_2026-03-16.md | 907 ++++++++++++ .../issues/PAN-OS/known/10.1.13_2026-03-16.md | 873 ++++++++++++ .../issues/PAN-OS/known/10.1.14_2026-03-16.md | 867 ++++++++++++ .../issues/PAN-OS/known/10.1.2_2026-03-16.md | 1035 ++++++++++++++ .../issues/PAN-OS/known/10.1.5_2026-03-16.md | 1000 +++++++++++++ .../issues/PAN-OS/known/10.1.6_2026-03-16.md | 974 +++++++++++++ .../issues/PAN-OS/known/10.1.7_2026-03-16.md | 930 +++++++++++++ .../issues/PAN-OS/known/10.1.8_2026-03-16.md | 932 +++++++++++++ web/data/products.json | 51 +- 46 files changed, 12607 insertions(+), 2 deletions(-) create mode 100644 web/data/issues/PAN-OS/addressed/10.1.10-h1_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.10-h2_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.10_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.11-h10_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.11-h5_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.12-h3_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.13-h1_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.13-h5_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.14-h10_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.14-h11_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.14-h13_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.14-h14_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.14-h16_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.14-h19_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.14-h20_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.14-h2_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.14-h6_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.14-h8_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.14_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.2_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.3-h1_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.4-h6_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.5-h3_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.5-h4_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.5_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.6-h3_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.6-h6_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.6-h7_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.6-h9_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.7-h1_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.7_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.8-h2_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.8-h7_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.8-h8_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.8_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/addressed/10.1.9-h6_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/known/10.1.0_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/known/10.1.11_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/known/10.1.13_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/known/10.1.14_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/known/10.1.2_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/known/10.1.5_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/known/10.1.6_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/known/10.1.7_2026-03-16.md create mode 100644 web/data/issues/PAN-OS/known/10.1.8_2026-03-16.md diff --git a/web/data/issues/PAN-OS/addressed/10.1.10-h1_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.10-h1_2026-03-16.md new file mode 100644 index 0000000..25919d7 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.10-h1_2026-03-16.md @@ -0,0 +1,103 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.10-h1 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-223317 + +Fixed an issue where SSL traffic failed with the error message: Error: General TLS protocol error. + +## PAN-219659 + +Fixed an issue where root partition frequently filled up and the following error message was displayed: Disk usage for / exceeds limit, xx percent in use, cleaning filesystem. + +## PAN-218947 + +Fixed an issue where logs were not displayed in Elasticsearch under ingestion load. + +## PAN-218335 + +Fixed an issue with hardware destination MAC filtering on the Log Processing Card (LPC) that caused the logging card interface to be susceptible to unicast flooding. + +## PAN-218001 + +```caveat +PA-400 Series firewalls only +``` + +Fixed an issue where shutdown commands rebooted the system instead of correctly triggering a shutdown. + +## PAN-217681 + +Fixed an issue caused by out of order TCP segments where the FIN flag and TCP data was truncated in a packet, which resulted in retransmission failure. + +## PAN-217477 + +Fixed an issue where the drop counter was incremented incorrectly. Drop counter calculations did not account for failures to send out logs from logrcvr/logd to syslog-ng. + +## PAN-217169 + +Fixed an issue where the logrcvr stopped forwarding logs to the syslog server after a restart or crash. + +## PAN-216984 + +Fixed an issue where internal path monitoring failed due to the sysdagent not responding. + +## PAN-215911 + +Fixed an issue that resulted in a race condition, which caused the configd process to stop responding. + +## PAN-215808 + +Fixed an issue where, after upgrading to PAN-OS 10.1, the log forwarding rate towards the syslog server was reduced. With this fix, the overall log-forwarding rate has also been improved. + +## PAN-215315 + +Fixed an issue where the dataplane stopped responding due to ager and inline packet processing occurring concurrently on different cores for the same session. + +## PAN-214990 + +Fixed an issue where firewall copper ports flapped intermittently when device telemetry was enabled. + +## PAN-214815 + +Fixed an issue where SNMP queries were not replied to due to an internal process timeout. + +## PAN-214187 + +Fixed an issue where superreaders were able to execute the request restart system CLI command. + +## PAN-214026 + +Fixed an issue where, when using an ECMP weighted-round-robin algorithm, traffic was not redistributed among the links proportionally as expected from the configuration. + +## PAN-212877 + +Fixed an issue where a race condition caused log flooding, which caused the firewall to go into an unresponsive state. + +## PAN-211887 + +Fixed an issue on Panorama that caused recently committed changes to not be displayed when previewing the changes to push to device groups. + +## PAN-210740 + +Fixed a memory leak issue related to the slotd process. + +## PAN-196116 + +A new CLI command debug log-receiver param-tuning syslog-threads to increase the number of processing threads for syslog forwarding up to 16 was added to address an issue where the syslog forwarding queue depth approached its limit and the drop count increased. + +## PAN-186579 + +Fixed an issue where, after a hardware failure, the system log did not include information about the failure. + +## PAN-181724 + +Fixed an issue where the Panorama or firewall page remained open after the session expired and you were unable to perform additional actions. + +## PAN-172853 + +Fixed an issue where Panorama appliances running a PAN-OS 10.0 release did not push the Security policy options **no-hip** and **quarantine** to firewalls running PAN-OS 9.1. diff --git a/web/data/issues/PAN-OS/addressed/10.1.10-h2_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.10-h2_2026-03-16.md new file mode 100644 index 0000000..d149709 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.10-h2_2026-03-16.md @@ -0,0 +1,75 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.10-h2 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-225169 + +Added a CLI command to view Strata Logging Service queue usage. + +## PAN-223501 + +Fixed an issue where diagnostic information for the dataplane in the dp-monitor.log file was not complete. + +## PAN-222712 + +```caveat +PA-5450 firewalls only +``` + +Fixed a low frequency DPC restart issue. + +## PAN-221984 + +```caveat +VM-Series firewalls in Microsoft Azure environments only +``` + +Fixed an issue where an interface went down after a hotplug event and was only recoverable by restarting the firewall. + +## PAN-219508 + +```caveat +VM-Series, PA-400 Series, PA-1400, PA-3400, and PA-5400 Series firewalls only +``` + +Fixed an issue where Bidirectional Forwarding Detection (BFD) packets experienced a delay in processing, which caused the BFD connection to flap. + +## PAN-215436 + +Fixed an issue with the web interface where the latest logs took longer than expected to display under **Monitor**. + +## PAN-215317 + +Fixed an issue where the dataplane stopped responding unexpectedly with the error message comm exited with signal of 10. + +## PAN-210875 + +Fixed an issue where the pan_task process stopped responding due to software packet buffer 3 trailer corruption, which caused the firewall to restart. + +## PAN-195439 + +```caveat +VM-Series firewalls in Microsoft Azure environments only +``` + +Fixed an issue where the dataplane interface status went down after a hotplug event triggered by Azure infrastructure. + +## PAN-184630 + +Fixed an issue where TLS clients, such as those using OpenSSL 3.0, enforced the TLS renegotiation extension (RFC 5746). + +## PAN-180082 + +Fixed an issue where errors in brdagent logs caused dataplane path monitoring failure. + +## PAN-160633 + +```caveat +PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls only +``` + +Fixed an issue where the dataplane restarted repeatedly due to an internal path monitoring failures until a power cycle. diff --git a/web/data/issues/PAN-OS/addressed/10.1.10_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.10_2026-03-16.md new file mode 100644 index 0000000..6ae4b5d --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.10_2026-03-16.md @@ -0,0 +1,591 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.10 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-217431 + +```caveat +PA-5400 Series firewalls with DPC (Data Processing Cards) only +``` + +Fixed an issue with slot 2 DPCs where URL Filtering did not work as expected after upgrading to PAN-OS 10.1.9. + +## PAN-217284 + +Fixed an intermittent issue where an LACP flap occurred when the LACP transmission rate was set to **Fast**. + +## PAN-216996 + +Fixed an issue where, after upgrading Panorama to PAN-OS 10.1.9, multiple User-ID alerts were generated every 10 minutes. + +## PAN-216710 + +Fixed an issue with firewalls in active/active HA configurations where GlobalProtect disconnected when the original suspected active-primary firewall became active-secondary. + +## PAN-216656 + +Fixed an issue where the firewall was unable to fully process the user list from a child group when the child group contained more than 1,500 users. + +## PAN-216366 + +Fixed an issue where, when custom signatures used a certain syntax, false positives were generated on devices on a PAN-OS 10.0 release. + +## PAN-215503 + +Fixed a memory related issue where the MEMORY_POOL address was mapped incorrectly + +## PAN-215125 + +Fixed an issue where false negatives occurred for some script samples. + +## PAN-215023 + +```caveat +PA-400 Series firewalls only +``` + +Fixed an issue where the firewall did not boot up successfully and an Amber LED light was shown. + +## PAN-214624 + +Fixed an issue where the logrcvr process stopped responding. + +## PAN-213463 + +```caveat +PA-5200 Series firewalls only +``` + +Fixed an issue where unplugging a PAN-SFP-CG transceiver from an interface with its link speed setting set to 1000 caused the firewall to incorrectly read that interface as up. + +## PAN-212848 + +Fixed an issue where attempting to change the disk-usage cleanup threshold to 90 resulted in the error message Server error : op command for client dagger timed out as client is not available. + +## PAN-212530 + +Fixed an issue on log collectors where the root partition reached 100% utilization. + +## PAN-211997 + +Fixed an issue where large OSPF control packets were fragmented, which caused the neighborship to fail. + +## PAN-211602 + +Fixed an issue where, when viewing a WildFire Analysis report via the web interface, the **detailed log view** was not accessible if the browser window was resized. + +## PAN-211441 + +Fixed a memory leak issue related to SSL crypto operations that resulted in failed commits. + +## PAN-211422 + +Fixed an issue where the show session packet-buffer-protection buffer-latency CLI command randomly displayed incorrect values. + +## PAN-211242 + +Fixed an issue where missed heartbeats caused the Data Processing Card (DPC) and its corresponding Network Processing Card (NPC) to restart due to internal packet path monitoring failure. + +## PAN-211150 + +Fixed an issue on Panorama where users with custom admin roles were incorrectly unable to view SSH profiles even when it was permitted in the custom role. + +## PAN-210921 + +```caveat +Panorama appliances in Legacy Mode only +``` + +Fixed an issue where **Blocked Browsing Summary by Website** in the user activity report contained scrambled characters. + +## PAN-210919 + +Fixed an issue where the Data Processing Card remained in a Starting state after a restart. + +## PAN-210738 + +Fixed an issue where fragmented UDP packets were dropped. + +## PAN-210661 + +Fixed an issue where firewalls disconnected from Strata Logging Service due to a missing key file after renewing the device certificate. + +## PAN-210654 + +Fixed an issue with firewalls on active/passive HA configurations GlobalProtect where users were disconnected after HA failover. + +## PAN-210563 + +Fixed an issue on Panorama where Security policy rules with a **Tag** target did not appear in the pre-rule list of a Dynamic Address Group that was part of the tag. + +## PAN-210397 + +Fixed an issue on Panorama where VM-Series firewalls in HA configurations hosted on Amazon Web Services (AWS) were not displayed under **Deploy Master Key**. + +## PAN-210236 + +Fixed an issue where the **Templates** list was not displayed under the **Location** drop-down for commit or configuration locks. + +## PAN-210216 + +A debug command was added to address an issue with firewalls in high availability configurations. + +## PAN-210158 + +```caveat +CN-Series firewalls only +``` + +Fixed an issue where the dataplane stopped responding after a container restart. + +## PAN-210000 + +Fixed an issue where, when traffic and threat logs exceeded the threshold of 90% total allowed size, alarms were not generated for other log types. + +## PAN-209872 + +Fixed an issue where dataplane ports responded to ICMP requests fewer than 64 bytes with nonzero padding bytes in the ICMP response. + +## PAN-209696 + +Fixed an issue where link-local address communication for IPv6, BFD, and OSPFv3 neighbors was dropped when IP address spoofing check was enabled in a Zone Protection profile. + +## PAN-209683 + +Fixed an issue where Panorama was unable to retrieve IP address-to-username mapping from a firewall on a PAN-OS 8.1 release. + +## PAN-209617 + +Fixed an issue with firewalls in active/passive HA configurations where the passive firewall created an incorrect SCTP association due to the HA sync messages from the active firewall having an incorrect value. + +## PAN-209501 + +Fixed an issue where the GlobalProtect logdb quota was not displayed in the show system logdb quota output. + +## PAN-209491 + +Fixed an issue on the web interface where the **Session Expire Time** displayed a past date if the device time was in December. + +## PAN-209375 + +Fixed an issue on the firewall where log filtering did not work as expected. + +## PAN-209108 + +Fixed an issue where a Panorama in Management Only mode was unable to display logs from log collectors due to missing schema files. + +## PAN-208930 + +```caveat +PA-7000 Series firewalls only +``` + +Fixed an issue where autotagging in log forwarding did not work. + +## PAN-208902 + +Fixed an issue where, when a client sent a TCP/FIN packet, the firewall displayed the end reason as aged-out instead of tcp-fin. + +## PAN-208877 + +Fixed an issue where the all_task process stopped responding when freeing the HTTP/2 stream, which caused the dataplane to go down. + +## PAN-208792 + +Fixed an issue where authentication failed when the service route for RADIUS traffic was configured as **use default** for IPv4 addresses and included the dataplane interface as the destination route. + +## PAN-208526 + +Fixed an issue where API calls did not display tunnel info. + +## PAN-208485 + +Fixed an issue where NAT policies were not visible on the CLI if they contained more than 32 characters. + +## PAN-208438 + +Fixed an issue on Panorama where Security policy rules incorrectly displayed as disabled. + +## PAN-208325 + +```caveat +PA-5400 Series, PA-3400 Series, PA-400 Series only, and PA-5450 firewalls only +``` + +Fixed an issue where the firewall was unable to automatically renew the device certificate. + +## PAN-208316 + +Fixed an issue where user-group names were unable to be configured as the source user via the test security-policy-match command. + +## PAN-208240 + +Fixed an issue where, when attempting to replace an existing certificate, importing a new certificate with the same name as the existing certificate failed due to mismatched public and private keys. + +## PAN-208210 + +Fixed an issue where changes to the syslog server configuration were not applied without first restarting the management server. + +## PAN-208201 + +Fixed an issue on the firewall where the modified date and time was incorrectly updated after a commit operation, PAN-OS upgrade, or reboot. + +## PAN-208189 + +Fixed an issue when traffic failed to match and reach all destinations if a Security policy rule includes FQDN objects that resolve to two or more IP addresses. + +## PAN-208187 + +Fixed an issue where REST API requests did not work for GlobalProtect gateway tunnels. + +## PAN-208039 + +```caveat +PA-7000 Series firewalls with SMC-B only +``` + +Fixed an issue where the details of configuration changes were not included in configuration logs on the syslog server. + +## PAN-207741 + +Fixed an issue where Large Scale VPN (LSVPN) Portal authentication failed with the error invalid http response. return error(Authentication failed; Retry authentication when the satellite connected to more than one portal. + +## PAN-207663 + +Fixed a Clientless VPN issue where JSON stringifies caused issues with the application rewrite. + +## PAN-207661 + +Fixed an issue with firewalls in active/active HA configurations where the virtual floating IP address configuration under a Panorama template was overridden and displayed From Template Override: undefined as a source. + +## PAN-207577 + +Fixed an issue where **Panorama > Setup > Interfaces** was not accessible for users with custom admin roles even when the interface option was selected for the custom admin roles. + +## PAN-207562 + +Fixed an issue where the shard count displayed by the show log-collector-es-cluster health CLI command was higher than the recommended limit. The recommended limit can be calculated with the formula 20*heap-memory*no-of-data-nodes. + +## PAN-207400 + +Fixed an issue on Octeon based platforms where fragmented VLAN tagged packets dropped on an aggregate interface. + +## PAN-206640 + +Fixed an issue where the ikemgr process stopped responding, which caused IPSec tunnels to go down. + +## PAN-206396 + +Fixed an issue where HIP report flip and HIP check failed when a user was part of multiple user groups with different domains. + +## PAN-206333 + +Fixed an issue where the **Include/Exclude IP** filter under **Data Distribution** did not work correctly. + +## PAN-206268 + +Fixed an issue where an authentication key field, even though not supported, was enabled under the **Device** tab on Panorama. + +## PAN-206221 + +Fixed an issue where scheduled configuration pushes with **Include Device and Network Templates** selected did not work. + +## PAN-206128 + +```caveat +PA-7000 Series firewalls with NPCs (Network Processing Cards) only +``` + +Improved debugging capability for an issue where the firewall restarted due to heartbeat failures and then failed with the following error message: Power not OK. + +## PAN-205995 + +Fixed an issue where logs from unaffected log collector groups were not displayed when a log collector was down. + +## PAN-205955 + +Fixed an issue where RAID rebuilds occurred even with healthy disks and a clean shutdown. + +## PAN-205829 + +Fixed an issue where logs did not display **Host-ID** details for GlobalProtect users despite having a quarantine Security policy rule. This occurred due to a missed local cache lookup. + +## PAN-205804 + +Fixed an issue on Panorama where a WildFire scheduled update for managed devices triggered multiple UploadInstall jobs per minute. + +## PAN-205513 + +Fixed an issue where the stats dump file generated by Panorama for a device firewall differed from the stats dump file generated by the managed device. + +## PAN-205451 + +Fixed an issue where the pan_com process stopped responding due to aggressive commits. + +## PAN-205369 + +Fixed an issue where connections to Strata Logging Service were initialized from the firewall even when Strata Logging Service forwarding was disabled. + +## PAN-205337 + +Fixed an issue in the **Run Now** section of custom reports where **Threat/Content Name** displayed in hypertext, and hovering over the text with the mouse displayed the message undefined. + +## PAN-205086 + +Fixed an issue where DNS Security categories were able to be deleted from spyware profiles. + +## PAN-204987 + +Fixed an issue where the firewall changed sequence numbers for reused sessions. + +## PAN-204718 + +```caveat +PA-5200 Series firewalls only +``` + +Fixed an issue where, after upgrading to PAN-OS 10.1.6-h3, a TACACS user login displayed the following error message during the first login attempt: Could not chdir to home directory /opt/pancfg/home/user: Permission denied. + +## PAN-204683 + +Fixed an issue where logs were unable to be generated due to old logs not getting purged and /opt/panlogs reaching over 100% usage. + +## PAN-204420 + +```caveat +WF-500 appliances only +``` + +Fixed an issue where, after an upgrade to a PAN-OS 10.1 release, SNMP traps were not sent to the SNMP server. This occurred due to SNMP trap server settings not being enabled. + +## PAN-204233 + +Fixed an issue where, when the firewall received a 513 error from the WildFire cloud, the firewall attempted to repeatedly send the same file. + +## PAN-203663 + +Fixed an issue where administrators were unable to change the password of a local database for users configured as a local admin user via an authentication profile. + +## PAN-203655 + +Fixed an issue where enabling **event-specific traps** (**Device** > **Setup** > **Operations** > **Miscellaneous** > **SNMP Setup**), the new deviating device system logs included incorrect information. + +## PAN-203339 + +Fixed an issue where services failed due to the RAID rebuild not being completed on time. + +## PAN-203137 + +```caveat +PA-5450 firewalls only +``` + +Fixed an issue where HSCI ports did not come up when QSFP DAC cables were used. + +## PAN-202981 + +Fixed an issue on Panorama where global find did not return results for existing universally unique identifiers (UUID). + +## PAN-201855 + +Fixed an issue where, after cloning a template, a certificate with the block private key option enabled was corrupted. + +## PAN-201839 + +Fixed an issue where GlobalProtect HIP matches failed for Mac users due to invalid characters being present in the subject alternative attributes in the certificate on the HIP report. + +## PAN-201721 + +Fixed an issue with firewalls in HA configurations where HA setup generated the error mismatch due to device update during a content update even though the version was the same. + +## PAN-201601 + +Fixed an issue where the all_task process stopped responding after adding customer hyperscan signatures. + +## PAN-201561 + +Fixed an issue where LSVPN satellite authentication cookies were not synced across high availability LSVPN portals. + +## PAN-201466 + +Fixed an issue where the system log generated on GlobalProtect satellite did not provide the reason for failures to connect to the GlobalProtect portal or gateway. + +## PAN-201085 + +```caveat +PA-5450 firewalls only +``` + +Fixed an issue where inserting the NPC and DPC on slot2 created excessive logs in the bcm.log file. + +## PAN-200676 + +Fixed an issue with firewalls in active/passive HA configurations where the user counts in the management plane were not synchronized between the active and the passive firewall. + +## PAN-200356 + +Fixed an issue where the **Elapsed seconds** field incorrectly displayed as 0 for DHCP packets coming from the firewall. + +## PAN-199687 + +Fixed an issue where content updates failed when using prelicensed keys during the bootstrap process. + +## PAN-199557 + +Fixed an issue on Panorama where virtual memory usage exceeded the set limit, which caused the configd process to restart. + +## PAN-198693 + +Fixed an issue where decrypted SSH sessions were interrupted with a decryption error. + +## PAN-198453 + +Fixed an issue where you were unable to resize the **Description** pop-up window (**Policies > Security > Prerules**). + +## PAN-198333 + +Fixed an issue where the SaaS PDF report incorrectly displayed the sanctioned application tag count as 1. + +## PAN-198043 + +Fixed a rare issue where a BuildXmlCache job failed on the firewall. + +## PAN-197388 + +Fixed an issue where, when the firewall forwarded Threat logs via email, the email client truncated the sender and recipient email addresses when they were put between angle brackets (<, >). + +## PAN-197115 + +Fixed an issue where, when the total number of in-used HIP Profiles was greater than 32, traffic from the GlobalProtect Agent did not hit the expected Security policy rule configured with the HIP Profile even though a HIP Match log was generated. + +## PAN-196597 + +Fixed an issue where the dnsproxyd process stopped responding due to corruption. + +## PAN-196417 + +```caveat +PA-7000 Series firewalls only +``` + +Fixed an issue where firewalls experienced slow SNMP responses, which caused the SNMP server to time out before polling completion. + +## PAN-196345 + +Fixed an issue where scheduled dynamic content updates failed to be retrieved by managed firewalls from Panorama when connectivity was slow. + +## PAN-196003 + +Fixed an issue where the **Adjust Columns** options for Panorama Traffic logs did not correctly autoadjust the columns. + +## PAN-195251 + +Fixed an issue where IPSec tunnel re-keying generated the critical log message tunnel-status-up. + +## PAN-194805 + +Fixed an issue where scheduled configuration backups to the SCP server failed with the error message No ECDSA host key is known. + +## PAN-193710 + +Fixed an issue where running the show interface CLI command caused the pan_comm process to stop responding during a configuration change. + +## PAN-193521 + +Fixed an issue where **Panorama > Device > Deployment > Software** did not display software after running **check now** for managed devices. + +## PAN-192739 + +Fixed an issue where the error message Machine Learning found virus was displayed in threat CSV logs as **Threat ID/Name** when WildFire Inline ML detected malware. + +## PAN-192681 + +Fixed an issue where HIP database storage on the firewall reached full capacity due to the firewall not purging older HIP reports. + +## PAN-192417 + +Fixed an issue where botnet reports were not generated on the firewall. + +## PAN-190903 + +Fixed an issue where MAC addresses in threat capture were swapped between the source MAC and destination MAC addresses. + +## PAN-189442 + +Fixed an issue where the all_pktproc process stopped responding, which caused the firewall to reboot. + +## PAN-189395 + +```caveat +PA-400 Series firewalls only +``` + +Fixed an issue where running a PAN-OS 10.2 release caused dataplane processes to restart unexpectedly. + +## PAN-189441 + +Fixed an issue where the pan_comm process repeatedly restarted, which caused commits to fail. + +## PAN-189423 + +Fixed an issue where exporting correlation logs generated an empty file. + +## PAN-189196 + +Fixed an issue on the firewall where the DHCP server did not send DHCP NAK packets correctly when **Served Addresses** were configured. + +## PAN-188403 + +Fixed an issue on the web interface where the interzone-default rule hit count was not displayed. + +## PAN-187253 + +```caveat +PA-400 Series firewalls only +``` + +Fixed an issue where the *all_task* process stopped repsonding. + +## PAN-186956 + +Fixed an issue where SD-WAN DIA VIF did not become active if default gateways for the member interface did not respond to pings. + +## PAN-186412 + +Fixed an issue where invalid packet-ptr was seen in work entries. + +## PAN-186182 + +Fixed an issue where software buffer 3 was depleted when URL proxy was enabled and SSL sessions were decrypted to inject the block page. This issue occurred when an HTTP/2 block page was displayed for a large POST request. + +## PAN-185770 + +Fixed an issue where the firewall displayed the error message Malformed Request when an email address included an ampersand ( & ) when configuring an Email server profile. + +## PAN-182689 + +Fixed an issue where a signature from a previous WildFire package triggered malware detection even though the signature was no longer present in the current WildFire package. + +## PAN-180655 + +Fixed an issue where FTP connections failed when SSL Inbound Inspection was enabled and a Security Profile was attached to the FTP connection allow policy rule. + +## PAN-172977 + +Fixed an issue where session offloading did not occur on a tap interface under a high packet load. + +## PAN-172806 + +Fixed an issue that the logrcvr process crashes during the firewall reboots. + +## PAN-170414 + +Fixed an issue related to an OOM condition in the dataplane, which was caused by multiple panio commands using extra memory. + +## PAN-168102 + +Fixed an issue where the API format to check heap usage of a node showed a JSON error. diff --git a/web/data/issues/PAN-OS/addressed/10.1.11-h10_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.11-h10_2026-03-16.md new file mode 100644 index 0000000..8c7128c --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.11-h10_2026-03-16.md @@ -0,0 +1,51 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.11-h10 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-272809 + +A fix was made to address [CVE-2024-9474](https://security.paloaltonetworks.com/CVE-2024-9474). + +## PAN-260796 + +Fixed an issue where servers were not accessible through an active SSL GlobalProtect VPN tunnel until a new connection was established or the session was cleared on the firewall. + +## PAN-254704 + +```caveat +LSVPN Portal firewalls in active/passive HA configurations only +``` + +Fixed an issue where the satellite cookie key did not sync between LSVPN portal high availability (HA) firewalls, which resulted in re-authentication of satellites with the portal during an HA failover. + +## PAN-248748 + +Fixed an issue that caused the dataplane to stop responding when running a packet diagnostic with Jumbo frames enabled. + +## PAN-242561 + +Fixed an issue where GlobalProtect tunnels disconnected shortly after being established when SSL was used as the transfer protocol. + +## PAN-239952 + +```caveat +Firewalls in active/passive HA configurations only +``` + +Fixed an issue where HA sync messages from the active firewall took longer than expected to reach the passive firewall. + +## PAN-225969 + +Fixed an issue where some traffic was not correctly identified for data filtering. + +## PAN-217147 + +Fixed an issue where commits took longer than expected when a large number of Security policy rules were configured. + +## PAN-210260 + +Fixed an issue on firewalls in HA configurations where the peer satellite firewall was able to connect to the GlobalProtect portal without username and password authentication. diff --git a/web/data/issues/PAN-OS/addressed/10.1.11-h5_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.11-h5_2026-03-16.md new file mode 100644 index 0000000..247a927 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.11-h5_2026-03-16.md @@ -0,0 +1,83 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.11-h5 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-242784 + +Fixed an issue where DNS resolution failed on platforms that obtained DNS server IP addresses from DHCP. + +## PAN-237935 + +Extended the offline PAN-DB, Panorama, and WildFire certificates which were previously set to expire on September 2, 2024. + +## PAN-237876 + +Extended the firewall Panorama root CA certificate which was previously set to expire on April 7th, 2024. + +## PAN-235741 + +Fixed an issue where DNS resolution failed for firewall and Panorama plugins. + +## PAN-235585 + +Fixed an issue where, when custom signatures and predefined signatures shared the same literal pattern part, the custom signature caused an incorrect calculation for the length of the predefined signature, which resulted in App-ID not detected correctly. + +## PAN-234929 + +Fixed an issue where tabs in the **ACC** such as **Network Activity** **Threat Activity** and **Blocked Activity** did not display data when you applied a **Time** filter of **Last 15 Minutes**, **Last Hour**, **Last 6 Hours**, or **Last 12 Hours**, and the data that was displayed with the **Last 24 Hours** filter was not accurate. Reports that were run against summary logs also did not display accurate results. + +## PAN-234238 + +Fixed an issue where a Security policy that referenced more than 30 HIP profiles caused buffer overflow, which caused other Security policies with HIP profiles to misidentified users and traffic was denied. + +## PAN-232132 + +Fixed an issue where DNS response packets were malformed when an Anti-Spyware Security Profile was enabled. + +## PAN-231552 + +Fixed an issue where traffic returning from a third-party Security chain was dropped. + +## PAN-228877 + +```caveat +PA-5200 Series, PA-5400 Series, and PA-7000 Series only +``` + +Fixed an issue with out-of-memory (OOM) conditions which caused slot restarts due to pan_cmd consuming more than 300MB. + +## PAN-227539 + +Fixed an issue where excess WIF process memory use caused processes to restart due to OOM conditions. + +## PAN-226792 + +Fixed an issue where the logrcvr process stored older content versions in the shared memory even when newer content updates were installed. + +## PAN-224954 + +Fixed an issue where, after upgrading and rebooting a Panorama appliance in Panorama or Log Collector mode, managed firewalls continuously disconnected. + +## PAN-222002 + +Fixed an issue where content updates failed with the error message Unable to get key pancontent-8.0.pass from cryptod. Error -9. + +## PAN-221881 + +Fixed an issue where log ingestion to Panorama failed, which resulted in missing logs under the **Monitor** tab. + +## PAN-220790 + +Fixed an issue where the reportd process stopped responding, which caused Panorama to restart. + +## PAN-215576 + +Fixed an issue where the userID-Agent and TS-Agent certificates were set to expire on November 18, 2024. With this fix, the expiration date has been extended to January 2032. + +## PAN-208400 + +Fixed an issue where pushing dynamic objects to the firewall did not send all Panorama objects that matched the dynamic object filter when **Share Unused Address and Service Objects with Device** was selected on Panorama. diff --git a/web/data/issues/PAN-OS/addressed/10.1.12-h3_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.12-h3_2026-03-16.md new file mode 100644 index 0000000..82e7333 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.12-h3_2026-03-16.md @@ -0,0 +1,31 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.12-h3 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-272809 + +A fix was made to address [CVE-2024-9474](https://security.paloaltonetworks.com/CVE-2024-9474). + +## PAN-242561 + +Fixed an issue where GlobalProtect tunnels disconnected shortly after being established when SSL was used as the transfer protocol. + +## PAN-241018 + +```caveat +VM-Series firewalls in Microsoft Azure environments only +``` + +Fixed a Dataplane Development Kit (DPDK) issue where interfaces remained in a link-down stage after an Azure hot plug event. + +## PAN-238949 + +Fixed a memory corruption issue where multiple processes stopped responding. + +## PAN-205482 + +Fixed an issue related to the configd process where Panorama displayed the error **Server not responding** when editing policies. diff --git a/web/data/issues/PAN-OS/addressed/10.1.13-h1_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.13-h1_2026-03-16.md new file mode 100644 index 0000000..612cd1d --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.13-h1_2026-03-16.md @@ -0,0 +1,43 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.13-h1 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-248651 + +Fixed a GlobalProtect issue that prevented the firewall from sending authentication cookies. + +## PAN-248105 + +Fixed an issue where the GlobalProtect SSL VPN tunnel immediately disconnected due to a keep-alive timeout. + +## PAN-246960 + +Fixed an issue where firewalls failed to fetch content updates from the Wildfire Private Cloud due to an **Unsupported protocol** error. + +## PAN-246215 + +Fixed an issue where the sleep time for a suspended pan_task process caused configuration and policy updates to be blocked. + +## PAN-243463 + +Fixed an issue where high Enhanced Application Log traffic used excess system resources and caused processes to not work. + +## PAN-239354 + +Fixed an issue where DNS resolution was delayed when an Antispyware policy rule was applied to both client to firewall and firewall to internal DNS server legs of a connection. + +## PAN-225963 + +Fixed an issue where the IP address-to-user mapping was not correct. + +## PAN-220907 + +```caveat +VM-Series firewalls only +``` + +Fixed an issue where large packets were dropped from the dataplane to the management plane, which caused OSPF neighborship to fail. diff --git a/web/data/issues/PAN-OS/addressed/10.1.13-h5_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.13-h5_2026-03-16.md new file mode 100644 index 0000000..26a11f2 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.13-h5_2026-03-16.md @@ -0,0 +1,31 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.13-h5 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-272809 + +A fix was made to address [CVE-2024-9474](https://security.paloaltonetworks.com/CVE-2024-9474). + +## PAN-262340 + +Fixed an issue where FQDN resolution failed for address objects, and all FQDN traffic was denied by the interzone-default policy rule. + +## PAN-262287 + +Fixed an issue where dereferencing a NULL pointer that occurred caused pan_task processes to stop responding. + +## PAN-260842 + +A CLI command was introduced to address an issue where TCP packets were out of order. + +## PAN-230755 + +Fixed an issue where the devsrvr process intermittently restarted when processing traffic with a Cloud App ID. + +## PAN-216368 + +Fixed an issue where the configuration commit process on chassis based platforms did not recognize load failures on the dataplane. diff --git a/web/data/issues/PAN-OS/addressed/10.1.14-h10_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.14-h10_2026-03-16.md new file mode 100644 index 0000000..7c14e89 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.14-h10_2026-03-16.md @@ -0,0 +1,11 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.14-h10 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-279604 + +Fixed an issue where scheduled SaaS application usage reports were generated incorrectly, and the login page was displayed instead of the report content. diff --git a/web/data/issues/PAN-OS/addressed/10.1.14-h11_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.14-h11_2026-03-16.md new file mode 100644 index 0000000..7d80f60 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.14-h11_2026-03-16.md @@ -0,0 +1,19 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.14-h11 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-262383 + +Fixed an issue where the firewall was unable to decompress the HTTP2 header, which caused the session to be classified as unknown-tcp instead of web-browsing. + +## PAN-232530 + +Fixed an issue where the useridd process ran out of memory and restarted when the number of user or user groups exceeded the threshold. + +## PAN-227368 + +Fixed an issue where the GlobalProtect app was unable to connect to a portal or gateway and GlobalProtect Clientless VPN users were unable to access applications if authentication took more than 20 seconds. diff --git a/web/data/issues/PAN-OS/addressed/10.1.14-h13_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.14-h13_2026-03-16.md new file mode 100644 index 0000000..b9e0ef3 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.14-h13_2026-03-16.md @@ -0,0 +1,27 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.14-h13 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-269155 + +Fixed an issue where an OOM condition occurred, which caused processes to stop responding. + +## PAN-265434 + +Fixed an issue where the flow process restarted with the error message SIGABRT __GI_raise __GI_abort __libc_message malloc_printer. + +## PAN-257960 + +Fixed an issue where ICD's virtual memory continuously increased due to an increase in unknown IP addresses, which resulted in high management plane CPU utilization. + +## PAN-256867 + +Fixed an issue where the logrcvr process stopped responding while processing session logs for forwarding to the LFC. + +## PAN-245428 + +Fixed an issue where FIB entries aged out and were incorrectly removed after an HA failover event. diff --git a/web/data/issues/PAN-OS/addressed/10.1.14-h14_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.14-h14_2026-03-16.md new file mode 100644 index 0000000..8fc9f80 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.14-h14_2026-03-16.md @@ -0,0 +1,15 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.14-h14 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-265549 + +A fix was made to address [CVE-2025-0137](https://security.paloaltonetworks.com/CVE-2025-0137). + +## PAN-250162 + +A fix was made to address [CVE-2025-0136](https://security.paloaltonetworks.com/CVE-2025-0136). diff --git a/web/data/issues/PAN-OS/addressed/10.1.14-h16_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.14-h16_2026-03-16.md new file mode 100644 index 0000000..7defd0c --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.14-h16_2026-03-16.md @@ -0,0 +1,23 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.14-h16 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-284744 + +A fix was made to address [CVE-2025-4229](https://security.paloaltonetworks.com/CVE-2025-4229). + +## PAN-255323 + +```caveat +PA-7050 firewalls only +``` + +Fixed an issue where the Network Processing Card (NPC), Data Processing Card (DPC), and Log forwarding Card (LFC) remained in a starting state after an unexpected power cycle. + +## PAN-238594 + +Fixed an issue where the firewall rebooted when a QSFP28 cable was removed from the port while the port was passing traffic. diff --git a/web/data/issues/PAN-OS/addressed/10.1.14-h19_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.14-h19_2026-03-16.md new file mode 100644 index 0000000..eaca6a5 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.14-h19_2026-03-16.md @@ -0,0 +1,19 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.14-h19 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-269091 + +Fixed an issue where the varrcvr process stopped responding. + +## PAN-258570 + +Fixed an issue where the firewall might reboot unexpectedly due to the varrcvr process progressively using more memory when WildFire file forwarding is handling PE files. + +## PAN-238594 + +Fixed an issue where the firewall rebooted when a QSFP28 cable was removed from the port while the port was passing traffic. diff --git a/web/data/issues/PAN-OS/addressed/10.1.14-h20_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.14-h20_2026-03-16.md new file mode 100644 index 0000000..98561a3 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.14-h20_2026-03-16.md @@ -0,0 +1,15 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.14-h20 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-273694 + +```caveat +VM-Series firewalls with multiple NICs only +``` + +Fixed an issue were the queue count in the task dump displayed an incorrect number of queues for SR-IOV interfaces due to the queue mapping logic incorrectly using a non-multi-NIC function. diff --git a/web/data/issues/PAN-OS/addressed/10.1.14-h2_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.14-h2_2026-03-16.md new file mode 100644 index 0000000..e36ca87 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.14-h2_2026-03-16.md @@ -0,0 +1,39 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.14-h2 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-258702 + +```caveat +WF-500 appliances only +``` + +Fixed an issue where the varrcvr process stopped responding when files were being forwarded to the WildFire cloud. + +## PAN-257197 + +Fixed an issue where ifType and ifSpeed were not populated in asynchronous mode of SNMP operations. + +## PAN-251847 + +Fixed an issue on log collectors where the incoming log rate was lower than expected. + +## PAN-255163 + +```caveat +CN-Series firewalls only +``` + +Fixed an issue where the system database key that stored the configuration status of the dataplane pod was not updated frequently. + +## PAN-248130 + +Fixed an issue where the **AND** operation under a Dynamic Address Group comparison did not work after upgrading the AWS plugin to 3.0.1. + +## PAN-247257 + +Fixed an issue where the useridd process stopped responding, which caused the firewall to reboot. diff --git a/web/data/issues/PAN-OS/addressed/10.1.14-h6_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.14-h6_2026-03-16.md new file mode 100644 index 0000000..bdbbc14 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.14-h6_2026-03-16.md @@ -0,0 +1,51 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.14-h6 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-272809 + +A fix was made to address [CVE-2024-9474](https://security.paloaltonetworks.com/CVE-2024-9474). + +## PAN-264883 + +```caveat +PA-7080 appliances with Log Forwarding Cards (LPCs) only +``` + +Fixed an issue where syslog forwarding over TCP stopped after upgrading. + +## PAN-264249 + +Fixed an issue on the firewall where SNMP queries timed out when using SNMP. + +## PAN-263287 + +The PAN-COMMON-MIB.my file was updated to support new object identifiers (OID) to poll interface use via SNMP with table identifiers. + +## PAN-262340 + +Fixed an issue where FQDN resolution failed for address objects, and all FQDN traffic was denied by the interzone-default policy rule. + +## PAN-259910 + +Fixed an issue where the firewall reported the same value over consecutive SNMP polls when asynchronous mode was enabled. + +## PAN-257601 + +```caveat +PA-5450 firewalls only +``` + +Fixed an issue where Networking Cards (NC) experienced an internal link fault which caused path monitoring failure on the Dataplane Processing Card (DPC). + +## PAN-241044 + +Fixed an issue where traffic was denied by the interzone-default policy rule when a Security policy rule with an FQDN destination was configured. + +## PAN-164885 + +Fixed an issue on Panorama where **Commit and Push** or **Push to Devices** operations failed when an external dynamic list was configured to check for updates every 5 minutes due to the commit and external dynamic fetch processes overlapping. diff --git a/web/data/issues/PAN-OS/addressed/10.1.14-h8_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.14-h8_2026-03-16.md new file mode 100644 index 0000000..da9354e --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.14-h8_2026-03-16.md @@ -0,0 +1,39 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.14-h8 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-273215 + +Fixed an issue where a syntax error in the index generation script caused a high management plane CPU load after upgrading. + +## PAN-268823 + +Fixed an issue where **Monitor > Log Display** did not display all logs when you applied + +## PAN-268339 + +Fixed an issue where syslog-ng failed to start due to the syslog-ng.config file being corrupted when upgrading from PAN-OS 10.2.9-h1 to PAN-OS 10.2.11. + +## PAN-264871 + +Fixed an issue on Panorama where the configd process stopped responding when viewing IP addresses on dynamic address groups with a large number of IP addresses. + +## PAN-262330 + +Fixed an issue where traffic logs were not forwarded to the syslog server. + +## PAN-260604 + +Fixed an issue where the firewall displayed inaccurate throughput utilization stats in NetFlow analyzer tools. + +## PAN-260512 + +Fixed an issue where accessing the IP address of the device address group objects from the user interface caused the configd process to stop responding. + +## PAN-259351 + +A fix was made to address [CVE-2024-3393](https://security.paloaltonetworks.com/CVE-2024-3393). diff --git a/web/data/issues/PAN-OS/addressed/10.1.14_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.14_2026-03-16.md new file mode 100644 index 0000000..2e5defa --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.14_2026-03-16.md @@ -0,0 +1,327 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.14 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-253317 + +```caveat +VM-Series firewalls on Microsoft Azure environments only +``` + +Fixed an issue where you were unable to log in to the firewall after a private data reset. + +## PAN-251013 + +Fixed an issue on the web interface where the **Virtual Router** and **Virtual System** configurations for the template incorrectly showed as **none**. + +## PAN-246420 + +```caveat +PA-5400 Series firewalls only +``` + +Fixed an issue where the firewall rebooted unexpectedly during an upgrade. + +## PAN-246155 + +Fixed an issue where the firewall dropped small fragmented ICMP messages with the discard-icmp-ping-zero-id counter when a Zone Protection profile was enabled. + +## PAN-245157 + +```caveat +VM-Series firewalls in Microsoft Azure environments only +``` + +Fixed an issue where the firewall restarted after an HA failover when DPDK was enabled. + +## PAN-245125 + +```caveat +VM-Series firewalls in Microsoft Azure environments only +``` + +Fixed an issue where file descriptors were not closed due to invalid configurations. + +## PAN-245041 + +Fixed an issue where the WF-500 appliance returned an error verdict for every sample in FIPS mode. + +## PAN-242027 + +Fixed an issue where the all-task process repeatedly restarted during memory allocation failures. + +## PAN-241888 + +Fixed an issue where DHCP lease renewal failed due to a change in the firewall timestamp (**Device > Setup > Management**). + +## PAN-241230 + +Fixed an issue where the SNMP get request status value for Panorama connections was incorrect. + +## PAN-241018 + +```caveat +VM-Series firewalls in Microsoft Azure environments only +``` + +Fixed a Data Plane Development Kit (DPDK) issue where interfaces remained in a link-down stage after an Azure hot plug event. + +## PAN-240993 + +Fixed an issue where you were unable to revert a sort in task manager in the admin column. + +## PAN-240786 + +Fixed an issue on firewalls in HA configurations where VXLAN sessions were allocated, but not installed or freed, which resulted in a constant high session table usage that was not synced between the firewalls. This resulted in a session count mismatch. + +## PAN-240618 + +Fixed an issue where configuration commits were successful even when dynamic peer IKE gateways configured on the same interface and IP address that did not have the same IKE Crypto profile. + +## PAN-240327 + +Fixed an issue where traffic on all branches was impacted when the SD-WAN MPLS link on one branch went down. + +## PAN-240308 + +Fixed an issue where ElasticSearch did not work as expected when RAID-mounts were not fully ready after a reboot. + +## PAN-239255 + +Fixed an issue where the firewall did not update the ARP cache timeout value after modifying the arp-cache-timeout setting. + +## PAN-238705 + +```caveat +PA-400 Series firewalls only +``` + +Fixed an issue where HA link-monitor did not work. + +## PAN-238643 + +Fixed an issue where a memory leak caused multiple processes to stop responding when VM Information Sources was configured. + +## PAN-238621 + +Fixed an issue where the HA3 link status remained down when updating the HA3 interface configuration when the AE interface was up. + +## PAN-238592 + +```caveat +PA-3410 firewalls only +``` + +Fixed an issue where the firewall did not boot up after upgrading due to a TPM lockout condition that persisted for over 24 hours. + +## PAN-238508 + +Fixed an issue where the routed process created excessive logs in the log file. + +## PAN-238355 + +Fixed an issue where, when a device group was not successfully renamed, unexpected configuration changes to the device group structure occurred. + +## PAN-238249 + +Fixed an issue where static route path monitor packets from a multislot chassis were intercepted by the firewall performing Static NAT (SNAT). + +## PAN-238183 + +Fixed an issue where Panorama displayed deviating device system logs for nonconnected interfaces. + +## PAN-237657 + +Fixed an issue with 100% CPU utilization in the varrcvr process that occurred during an incremental WildFire update. + +## PAN-237608 + +Fixed an issue where a NetFlow export truncated the source username. + +## PAN-236233 + +Fixed an issue where SNMP reports displayed incorrect values for SSL Proxy sessions and SSL Proxy utilization. + +## PAN-235840 + +Fixed an issue where, after a configuration push from Panorama to managed firewalls, the status displayed as **None** and the push took longer than expected. + +## PAN-235557 + +Fixed an issue where uploads from tunnels, including GlobalProtect, were slower than expected when the inner and outer sessions were on different dataplanes. + +## PAN-235531 + +Fixed an issue where GlobalProtect logs displayed incorrect vsys numbers on Panorama. + +## PAN-235475 + +Fixed an issue where firewall sinkhole functionality was disrupted when a domain entry in an external dynamic list started with a period (.) character. + +## PAN-235168 + +Fixed an issue where disk space became full even after clearing old logs and content images. + +## PAN-234596 + +Fixed an issue on firewalls in active/passive HA configurations where the passive firewall incorrectly became active after a reboot. + +## PAN-234169 + +Fixed an issue where downloading files failed or was slower than expected due to malware scanning even when the session was matched to a Security policy rule with no Anti-Virus profile attached. + +## PAN-233965 + +Fixed an issue where the tund process stopped responding, which caused push operation to managed firewalls or making changes to local firewalls to fail. + +## PAN-233692 + +Fixed an issue on Panorama where the configd process stopped, which caused performance issues. + +## PAN-233689 + +```caveat +PA-7000 Series firewalls only +``` + +Fixed an issue where the Log Forwarding Card (LFC) disk quota usage was reported as 0 MB for all log types. + +## PAN-233603 + +```caveat +CN-Series firewalls only +``` + +Fixed an issue where slot information was not correct after a slotd process restart on the management pod. + +## PAN-231395 + +Fixed an intermittent issue where the OCSP query failed. + +## PAN-231270 + +Fixed an issue where Panorama became unresponsive due to the useridd process not responding. + +## PAN-231237 + +```caveat +Firewalls only in FIPS mode only +``` + +Fixed an issue where the firewall repeatedly displayed the error message Cipher decrypt-final failure. + +## PAN-229874 + +Fixed an issue where the firewall was unable to form OSPFv3 adjacency when using an ESP authentication profile. + +## PAN-229873 + +```caveat +PA-7050 firewalls only +``` + +Fixed an issue related to brdagent process errors. + +## PAN-229832 + +Fixed an intermittent issue where MLAV and URL cloud connectivity were lost. + +## PAN-228277 + +Fixed an issue where commits took longer than expected. + +## PAN-224772 + +Fixed a high memory usage issue with the mongodb process that caused an OOM condition. + +## PAN-224365 + +Fixed an issue where excessive network path monitoring messages were generated in the system logs. + +## PAN-222500 + +Fixed an issue where an old configuration unexpectedly merged during a push from Panorama. + +## PAN-220907 + +```caveat +VM-Series firewalls only +``` + +Fixed an issue where large packets were dropped from the dataplane to the management plane, which caused OSPF neighborship to fail. + +## PAN-220767 + +Fixed an issue where, at the beginning of a session, out of order packets with a TCP payload were truncated with a nonzero trailer. + +## PAN-220490 + +Fixed an issue where the commit warning **Missing pre-defined DNS security category** was incorrectly displayed. + +## PAN-219113 + +Fixed an issue where, when a port on the NPC was configured for log forwarding, the ingress traffic on the card was sent for processing to the LPC, and the LPC card was reloaded when the ingress volume of traffic was high. + +## PAN-218136 + +Fixed an issue where the service route setting Palo Alto Networks Services was not applied to **Threat Vault** communication. + +## PAN-217307 + +Fixed an issue where the log-start and log-end policy rule filters did not return reliable results when set to no or yes. + +## PAN-217147 + +Fixed an issue where commits took longer than expected when a large number of Security policy rules were configured. + +## PAN-216941 + +```caveat +M-700 Appliances in Log Collector mode only +``` + +Fixed an issue where Panorama stopped processing and saving logs. + +## PAN-215561 + +Fixed an issue where GlobalProtect authentication failed when new users were added to an existing local database group user list. + +## PAN-214463 + +Fixed an issue where IKE re-key negotiation failed with a third-party vendor and the firewall acting as the initiator received a response with the VENDOR_ID payload and the error message unexpected critical payload (type 43). + +## PAN-213918 + +Fixed an issue where mlav-test-pe-file.exe was not detected by WildFire Inline ML. + +## PAN-212606 + +Fixed an issue where the static gateway IKE-SA was established based on the peer ID even though the peer IP address matched a different object. + +## PAN-211575 + +Fixed an issue where a local commit on Panorama remained at 99% for longer than expected before completing. + +## PAN-210260 + +Fixed an issue on firewalls in HA configurations where the peer satellite firewall was able to connect to the GlobalProtect portal without username and password authentication. + +## PAN-196395 + +```caveat +PA-5450 firewalls only +``` + +Fixed an issue where the firewall accepted 12 Aggregate Ethernet interfaces, but you were unable to configure interfaces 9-12 via the web interface. + +## PAN-194782 + +Fixed an issue on Panorama where, if you added a new local or nonlocal administrator account or an admin user to a template, authentication profiles were incorrectly referenced. + +## PAN-182011 + +Fixed an issue where the httpd process stopped responding and generated a core after a commit. diff --git a/web/data/issues/PAN-OS/addressed/10.1.2_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.2_2026-03-16.md new file mode 100644 index 0000000..3d1822c --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.2_2026-03-16.md @@ -0,0 +1,159 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.2 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-175685 + +```caveat +PA-7000 Series and PA-5450 firewalls only +``` + +Fixed an issue where PAN-OS displayed the incorrect chassis serial number when an MPC (Management Processor Card) or SMC (Switch Management Card) was moved from one chassis to another. + +## PAN-174448 + +Fixed an issue where Zero-Touch Provisioning (ZTP) configuration wasn't removed after disabling it, which resulted in predefined configurations to be loaded after a reboot. + +## PAN-174326 + +A fix was made to address an OS command injection vulnerability in the PAN-OS web interface that enabled an authenticated administrator to execute arbitrary OS commands to escalate privileges ([CVE-2021-3050](https://security.paloaltonetworks.com/CVE-2021-3050)). + +## PAN-174254 + +```caveat +VM-Series firewalls deployed in Amazon Web Services (AWS) only +``` + +Fixed an issue where Gateway Load Balancer (GWLB) inspection incorrectly displayed as false after a reboot. + +## PAN-174244 + +Fixed an issue where a sudden increase in URL data approached the maximum cache capacity of the firewall. + +## PAN-174049 + +Fixed an issue where a process (authd) used old Thermite certificate post renewals, which caused authentication failures when using the Cloud Authentication service. + +## PAN-173903 + +Fixed an issue where clicking a hyperlink on a web page caused the web browser to download a file instead. + +## PAN-172518 + +Fixed an issue where a race condition occurred and caused a process (useridd) to restart. + +## PAN-172515 + +Fixed an issue where, when downgrading from PAN-OS 10.1 to an earlier version, with Cloud Authentication Service configured in an Authentication profile, the firewall did not remove the Cloud Authentication Service from the Authentication profile and displayed the authentication method as **None**, and subsequent commits failed. + +## PAN-172490 + +Fixed an issue on firewalls in HA configuration where HA-2 links continuously flapped on HSCI interfaces after upgrading to PAN-OS 8.1.19. + +## PAN-172454 + +Fixed an issue where, when the firewall communicated with the Cloud Identity Engine before the device certificate was installed on the firewall or Panorama, subsequent queries to the Cloud Identity Engine failed. + +## PAN-172295 + +Fixed an issue where a HIP database cache loop caused high CPU utilization on a process (useridd) and caused IP address-to-user mapping redistribution failure. + +## PAN-172276 + +```caveat +PA-400 Series firewalls only +``` + +Fixed an intermittent issue where changing the port speed from auto-negotiate to 1G caused the dataplane port to flap, which resulted in lost traffic. + +## PAN-172125 + +Fixed an intermittent issue where processing HIP messages in the (useridd) process caused a memory leak. + +## PAN-171878 + +Fixed an issue with SD-WAN path selection logic that caused an all_pktproc dataplane to stop responding. + +## PAN-171744 + +Fixed an issue where no data was displayed for the Forward Error Correction (FEC) plot for SD-WAN application performance (**Panorama** > **SD-WAN** > **Monitoring**). + +## PAN-171442 + +Fixed an issue on Amazon Web Services (AWS) Gateway Load Balancer (GWLB) deployments with overlay routing and cross-zone load balancing enabled where packets were forwarded to the incorrect GWLB interface. + +## PAN-171203 + +Fixed an issue in an HA configuration where, when one firewall was active and its peer was in a suspended state, the suspended firewall continued to send traffic, which triggered the detection of duplicate MAC addresses. + +## PAN-170681 + +Fixed an issue where the data redistribution agent and the data redistribution client failed to connect due to the agent not sending a SSL Server hello response. + +## PAN-170103 + +Fixed an issue where a process (ikemgr) stopped responding while making configuration changes. This issue occurred if Site-to-Site IPSec was using certification-based authentication. + +## PAN-169566 + +Fixed an issue where configuration files were not exported using the scheduled Secure Copy (SCP). + +## PAN-168903 + +Fixed an issue where deleting licenses on the firewall incorrectly set the GlobalProtect gateway license node to false. The firewall displayed the following error message during a GlobalProtect application connection: Could not connect to the gateway. The device or feature requires a GlobalProtect subscription license, even though the gateway firewall had a valid gateway license. + +## PAN-168718 + +Fixed an issue where, when a client or server received partial application data, the record was partially processed by legacy code. This caused decryption to fail when a decryption profile protocol was set to a maximum of TLSv1.3. + +## PAN-167115 + +Fixed an issue where, after upgrading to 10.0.3, admin sessions on Panorama were not logged out after the idle timeout expired. + +## PAN-167099 + +Fixed a configuration management issue that resulted in a process (ikemgr) failing to recognize changes in subsequent commits. + +## PAN-109759 + +Fixed an issue where the firewall did not generate a notification for the GlobalProtect client when the firewall denied unencrypted TLS sessions due to an authentication policy match. + +## PAN-165225 + +Fixed an issue where hwpredict was enabled by default. + +## PAN-161745 + +Fixed an issue where the time-to-live (TTL) value received from the DNS server reset to 0 on DNS secure TCP transactions when anti-spyware profiles were used, which caused DNS dynamic updates to fail. + +## PAN-158958 + +Fixed an issue where the debug sslmgr view crl command failed when an ampersand (&) character was included in the URL for the certificate revocation list (CRL). + +## PAN-157518 + +Fixed an issue where using tags to target a device group in a Security policy rule did not work, and the rule was displayed in all device groups (**Preview Rules**). + +## PAN-157027 + +Fixed an issue where, when stateless GTP-U traffic hit a multi-dataplane firewall, an inter-dataplane fragmentation loop occurred, which caused high dataplane resource usage. + +## PAN-154905 + +```caveat +Panorama appliances on PAN-OS 10.0 releases only +``` + +Fixed an issue with Security policy rule configuration where, in the **Source** and **Destination** tabs, the **Query Traffic** setting was not available for Address Groups. + +## PAN-138727 + +A fix was made to address a time-of-check to time-of-use (TOCTOU) race condition in the PAN-OS web interface that enabled an authenticated administrator with permission to upload plugins to execute arbitrary code with root user privileges ([CVE-2021-3054](https://security.paloaltonetworks.com/CVE-2021-3054)). + +## PAN-136961 + +Fixed an issue where during QoS config generation the Aggregate Ethernet (AE) subnets were incorrectly calculated cumulatively across all AEs instead of calculating just the total subnets of an AE. diff --git a/web/data/issues/PAN-OS/addressed/10.1.3-h1_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.3-h1_2026-03-16.md new file mode 100644 index 0000000..7cdc38f --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.3-h1_2026-03-16.md @@ -0,0 +1,11 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.3-h1 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-182010 + +Fixed an issue on Panorama where a managed firewall running a PAN-OS 10.1 version did not reconnect to Panorama. This issue occurred when a managed firewall was added to Panorama management using the device registration authentication key and also had the device certificate installed at the time of the reconnect. diff --git a/web/data/issues/PAN-OS/addressed/10.1.4-h6_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.4-h6_2026-03-16.md new file mode 100644 index 0000000..8d2e073 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.4-h6_2026-03-16.md @@ -0,0 +1,27 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.4-h6 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-237935 + +Extended the offline PAN-DB, Panorama, and WildFire certificates which were previously set to expire on September 2, 2024. + +## PAN-237876 + +Extended the firewall Panorama root CA certificate which was previously set to expire on April 7th, 2024. + +## PAN-231771 + +Fixed an issue where the firewall issued /box/getserv/ requests with PAN-OS 7.1.0 and did not take device certificates. + +## PAN-227568 + +When a device certificate is installed, renewed, or removed, the firewall will reconnect to the WildFire cloud to use the newest certificate. + +## PAN-215576 + +Fixed an issue where the userID-Agent and TS-Agent certificates were set to expire on November 18, 2024. With this fix, the expiration date has been extended to January 2032. diff --git a/web/data/issues/PAN-OS/addressed/10.1.5-h3_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.5-h3_2026-03-16.md new file mode 100644 index 0000000..16b471d --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.5-h3_2026-03-16.md @@ -0,0 +1,15 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.5-h3 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-202450 + +Fixed an issue where the device-client-cert was set to expire on December 31, 2023. With this fix, the expiration date has been extended. + +## PAN-198372 + +Fixed an issue where the root-cert was set to expire on December 31, 2023. With this fix, the expiration date has been extended. diff --git a/web/data/issues/PAN-OS/addressed/10.1.5-h4_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.5-h4_2026-03-16.md new file mode 100644 index 0000000..3f367f1 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.5-h4_2026-03-16.md @@ -0,0 +1,27 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.5-h4 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-237935 + +Extended the offline PAN-DB, Panorama, and WildFire certificates which were previously set to expire on September 2, 2024. + +## PAN-237876 + +Extended the firewall Panorama root CA certificate which was previously set to expire on April 7th, 2024. + +## PAN-231771 + +Fixed an issue where the firewall issued /box/getserv/ requests with PAN-OS 7.1.0 and did not take device certificates. + +## PAN-227568 + +When a device certificate is installed, renewed, or removed, the firewall will reconnect to the WildFire cloud to use the newest certificate. + +## PAN-215576 + +Fixed an issue where the userID-Agent and TS-Agent certificates were set to expire on November 18, 2024. With this fix, the expiration date has been extended to January 2032. diff --git a/web/data/issues/PAN-OS/addressed/10.1.5_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.5_2026-03-16.md new file mode 100644 index 0000000..e5f25fd --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.5_2026-03-16.md @@ -0,0 +1,721 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.5 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-189769 + +Fixed an issue on Amazon Web Services (AWS) Gateway Load Balancer (GWLB) deployments with overlay routing enabled where, when a single firewall was the backend of multiple GWLBs, packets were re-encapsulated with an incorrect source IP address. + +## PAN-189665 + +```caveat +FIPS-CC enabled firewalls only +``` + +Fixed an issue where the firewall was unable to connect to log collectors after an upgrade due to missing cipher suites. + +## PAN-189468 + +Fixed an issue where the firewall onboard packet processor used by the PAN-OS content-inspection (CTD) engine can generate high dataplane resource usage when overwhelmed by a session with an unusually high number of packets. This can result in resource-unavailable messages due to the content inspection queue filling up. Factors related to the likelihood of an occurrence include enablement of content-inspection based features that are configured in such a way that might process thousands of packets in rapid succession (such as SMB file transfers). This can cause poor performance for the affected session and other sessions using the same packet processor. PA-3000 series and VM-Series firewalls are not impacted. + +## PAN-189230 + +```caveat +VM-Series firewalls only +``` + +Fixed an issue that caused the pan_task process to stop responding with floating point exception (FPE) when there was a module of 0 on the queue number. + +## PAN-188883 + +Fixed an issue where, when pre-generated license key files were manually uploaded via the web interface, they weren't properly recognized by PAN-OS and didn't display a serial number or initiate a reboot. + +## PAN-187894 + +```caveat +VM-Series firewalls only +``` + +Fixed an issue with vm_license_response.log that consumed a large portion of the root partition. + +## PAN-187769 + +```caveat +VM-Series firewalls in Microsoft Azure environments only +``` + +Fixed a Data Plane Development Kit (DPDK) issue where interfaces remained in a link-down state after an Azure hot plug event. This issue occurred due to a hot plug of Accelerated Networking interfaces on the Azure backend caused by host updates, which led to Virtual Function unregister/Register messages on the VM side. + +## PAN-187438 + +```caveat +PA-5400 Series firewalls only +``` + +Fixed an issue where HSCI interfaces didn’t come up when using BiDi transceivers. + +## PAN-186785 + +Fixed an issue where, after logging in, Panorama displayed a 500 error page after five minutes of logging for dynamic group template admin types with access to approximately 115 managed devices or 120 dynamic groups. + +## PAN-186725 + +Fixed an issue where index creation failed when Elasticsearch attempted to create a new index with a duplicate index name. + +## PAN-186646 + +```caveat +PA-5400 Series firewalls only +``` + +Fixed an issue where traffic flow through IKE NATT IPSec S2S tunnels broke on tunnel rekey with multiple data processing cards (DPC). + +## PAN-186516 + +Fixed an issue where log queries that included WildFire submission logs returned more slowly than expected. + +## PAN-186402 + +```caveat +PA-440 Series firewalls only +``` + +Fixed an issue where the firewall's maximum tunnel limit was incorrect. + +## PAN-185750 + +Updated an issue to eliminate failed pan_comm software issues that caused the dataplane to restart unexpectedly + +## PAN-185726 + +Fixed an issue where the dataplane exited during IPSec encapsulation and decapsulation offload operations. + +## PAN-185695 + +```caveat +PA-5400 Series firewalls only +``` + +Fixed an issue where up to 75% traffic loss occurred on GlobalProtect tunnels with multiple DPCs. + +## PAN-185359 + +Fixed an issue where you were unable to reference shared address objects as a BGP peer address (**Virtual Router > BGP > Peer Group > Peer Address**). + +## PAN-185164 + +Fixed an issue where processing corrupted IoT messages caused the wificlient process to restart. + +## PAN-185163 + +Fixed an issue where the distributord process hit the FD limit, which caused User-ID redistribution to not function properly. + +## PAN-184761 + +Fixed an issue where Security policies were deleted on managed devices upon a successful push from Panorama to multiple device groups. This occurred when the Security policies had **device_tags** selected in the target section. + +## PAN-184445 + +Fixed an issue where, after upgrading the Panorama, tagged address objects used in dynamic address groups were removed after a full commit and push. This issue occurred when the setting **Share Unused Address and Service Objects with Devices** was left unchecked. + +## PAN-184432 + +Fixed an issue where the logrcvr process stopped responding due to a heartbeat failure that was caused by sysd nodes being stuck on logdb_writers for system, configuration, and alarm logs. + +## PAN-184224 + +Fixed an issue on Panorama where you were unable to select a template variable in **Templates > Device > Log Forwarding Card > Log Forwarding Card Interface > Network > IP address location**. + +## PAN-184076 + +Fixed an issue on the firewall web interface where logs were delayed when querying for logs. + +## PAN-184047 + +Fixed an issue where Terminal Service agent (TS agent) connections with a certificate profile and the certificate chain on the TS agent failed. This occurred because common name validation and key usage checks were being performed in the root or intermediate certificate. + +## PAN-183774 + +Fixed an memory leak issue in the mgmtsrvr process, which resulted in an out-of-memory (OOM) condition and high availability (HA) failover. + +## PAN-183428 + +Fixed an issue where, when exporting or pushing a device configuration bundle from Panorama, a validation error occurred with GlobalProtect gateway inactivity logout time. + +## PAN-183239 + +Fixed an issue where the firewall randomly disconnected from the WildFire URL cloud. + +## PAN-183112 + +Fixed an issue where the threat log type ml-virus wasn't forwarded to Panorama or to external servers. + +## PAN-182954 + +```caveat +PA-7000 Series firewalls with Log Processing Cards (LPC) only +``` + +Fixed an issue where excessive threat ID lookups caused logs to be lost. + +## PAN-182903 + +Fixed an issue where SD-WAN failover on a hub or branch in full mesh took longer than expected. + +## PAN-182732 + +Fixed an issue where the GlobalProtect gateway inactivity timer wasn't refreshed even though traffic was passing through the tunnel. + +## PAN-182634 + +```caveat +PA-400 Series firewalls only +``` + +Fixed an issue where the firewall detected a Power Supply Unit (PSU) failure for the opposite side when disconnecting a PSU from the device. This issue occurred when redundant PSUs were connected. + +## PAN-181839 + +Fixed an issue where Panorama Global Search reported **No Matches found** while still returning results for matching entries on large configurations. + +## PAN-181802 + +Fixed an issue where a memory utilization condition resulted in the web interface responding more slowly than expected and management server restarting. + +## PAN-181706 + +Fixed an issue where the logrcvr process stopped responding after upgrading to PAN-OS 10.1. + +## PAN-181579 + +Fixed an issue with the GlobalProtect gateway where the time-to-live (TTL) limit expired faster than real-time limit. As a result, a reconnection was required before the expected lifetime expiration. + +## PAN-181558 + +Fixed an issue where the stats dump file was not generated properly. + +## PAN-181360 + +Fixed an issue where staggering scheduled dynamic updates from Panorama to firewalls only worked for the first scheduled group and failed for the remaining groups of the same type. + +## PAN-181116 + +Fixed memory corruption issues in PAN-OS 10.1.3 and 10.1.4 that caused the pan_comm process to stop responding and the dataplane to restart. These issues also caused GlobalProtect tunnels to fall back to SSL instead of IPSec due to the inadvertent encapsulation of the ICMP keepalive response from the firewall. + +## PAN-181039 + +Fixed an issue with DNS cache depletion that caused continuous DNS retries. + +## PAN-180916 + +Fixed an issue where DNS security caused the TTL value of the pointer record (PTR) to be overwritten with a value of 30 seconds. + +## PAN-180760 + +Fixed an issue where users were unable to SSH to the firewall and encountered the following error message: Could not chdir to home directory /opt/pancfg/home/user: Permission denied. + +## PAN-180095 + +Fixed an issue where Panorama serial-number-based redistribution agents did not redistribute HIP reports. + +## PAN-179982 + +Fixed an issue where an OOM condition occurred due to quarantine list redistribution. + +## PAN-179976 + +Fixed an issue where the WildFire Inline Machine Learning (ML) did not detect mlav-test-pe-file.exe when traffic was decrypted. + +## PAN-179899 + +Fixed an issue where updating the master key did not update the SD-WAN preshared key (PSK). + +## PAN-179886 + +Fixed an issue where new tunnels were unable to be established for Elasticsearch due to faulty logic that prevented old tunnels to be removed when a node went down. + +## PAN-179413 + +Fixed an issue where GRE tunnels flapped during commit jobs. + +## PAN-179321 + +A validation error was added to inform an administrator when a policy field contained the value **any**. + +## PAN-179274 + +Fixed an issue on high availability configurations where, after upgrading to PAN-OS 9.1.10, PAN-OS 10.0.6, or PAN-OS 10.1.0, the HA1 and HA1-Backup link stayed down. This issue occurred when the peer firewall IP address was in a different subnet. + +## PAN-179260 + +Fixed an issue where admins and other Superusers were unable to remove a commit lock that was taken by another admin user with the format . As a result, deleting the commit lock failed. + +## PAN-179164 + +Fixed an issue where a web-proxy port number was added to the destination URL when captive portal authentication was run. + +## PAN-179059 + +Fixed an issue where you were unable to delete dynamic address groups one at a time using XML API. + +## PAN-178947 + +Fixed an issue where the useridd process stopped responding when a NULL reference attempted to be dereferenced. This issue occurred to IP address users being added. + +## PAN-178860 + +Fixed an issue where quarantined devices appeared in the CLI but not the web interface. + +## PAN-178672 + +Fixed an issue where a process (useridd) stopped responding due to buffer overflow. + +## PAN-178615 + +Fixed an issue where restarting the management server created an invalid reference in the device server, which caused subsequent commits to fail. + +## PAN-177981 + +```caveat +PA-5450 firewalls only +``` + +Fixed an issue where **High Speed Log Forwarding** was enabled when attempting to view local logs. + +## PAN-177956 + +Fixed an issue where the CLI output of show location ip returned unknown. + +## PAN-177907 + +Fixed an issue where, after rebooting the firewall, FQDN address objects referred in rules in a virtual system (vsys) did not resolve when the vsys used a custom DNS proxy. + +## PAN-177878 + +Fixed an issue where a role-based admin with **Operational Requests** enabled under the XML API section was unable to set the License Deactivation API key. + +## PAN-177874 + +Fixed an issue where a process (devsrvr) stopped responding due to an unexpected returned value. + +## PAN-177626 + +Fixed an issue where aggressive situations caused on-chip descriptor exhaustion. + +## PAN-177551 + +A fix was made to address a vulnerability that enabled an authenticated network-based administrator to upload a specifically created configuration that disrupted system processes and was able to execute arbitrary code with root privileges when the configuration was committed ([CVE-2022-0024](https://security.paloaltonetworks.com/CVE-2022-0024)). + +## PAN-177363 + +Fixed an issue where, when system logs and configuration logs on a dedicated log detector system were forwarded to a Panorama management server in Management Only mode, the logs were not ingested and were dropped. This caused the dedicated log detector system to not be viewable on a Panorama appliance in Management Only mode. + +## PAN-177351 + +Fixed an issue where configurations failed when downgrading from PAN-OS 10.1.1 and later versions to PAN-OS 10.0.0 using the autosaveconfig.xml file. + +## PAN-177187 + +Fixed an issue where reports using the decryption summary database and Panorama as data sources returned no results. + +## PAN-177170 + +Fixed an issue on Panorama where a log collector group commit deleted the proxy settings configured on dedicated log collectors. + +## PAN-177072 + +Fixed an intermittent issue where Panorama did not show new logs from firewalls. + +## PAN-177060 + +Fixed an issue where, when the address object in the parent device group was renamed, and the address object was overridden in the child device group and called in a Security policy, the object in the Security policy was renamed as well. + +## PAN-177054 + +Fixed an issue where, when you disabled a NAT rule, the **Destination Translation** value **none** displayed in blue and was still able to be modified to a different value. + +## PAN-176997 + +Fixed an issue where log collectors generated **Failed to check IoT content upgrade** system logs even when no IoT license was installed. + +## PAN-176889 + +Fixed an issue where the log collector continuously disconnected from Panorama due to high latency and a high number of packets in Send-Q. + +## PAN-176746 + +Fixed an intermittent issue where traffic was lost when performing a failover in an HA active/passive setup. + +## PAN-176376 + +Fixed an issue where importing a firewall configuration to Panorama failed if **Import device's shared objects into Panorama's shared context (device group specific objects will be created if unique)** was unchecked. + +## PAN-176348 + +Fixed an issue where scheduled email alerts were not forwarded to all recipients in the override list. + +## PAN-176280 + +Fixed an intermittent issue on Panorama where querying logs via the web interface or API did not return results. + +## PAN-176262 + +Fixed an issue where the firewall didn't resolve specific domain names with multiple nested Canonical Name (CNAME) records when caching was enabled. + +## PAN-176116 + +Fixed an issue where the header did not match the correct policy when IPv6 addresses were set in XFF header. + +## PAN-176032 + +Fixed an issue where a process (authd) process stopped responding, which caused authentication to fail. + +## PAN-176030 + +Fixed an issue where alerts related to syslog connections were not generated in the system logs. + +## PAN-175717 + +Fixed an issue where firewalls managed by a Panorama management server entered maintenance mode if: + +- Panorama was running PAN-OS 10.2 and managed firewalls were downgraded from PAN-OS 10.2 to PAN-OS 10.1.4 or earlier PAN-OS release +- Panorama was upgraded from PAN-OS 10.1 to PAN-OS 10.2 and managed firewalls were running PAN-OS 10.1.4 or earlier PAN-OS 10.1 release. + +## PAN-175716 + +Fixed an issue where sorting address groups by name, address, or location did not work on a device group that was part of a nested device group. + +## PAN-175628 + +```caveat +PA-5200 Series firewalls only +``` + +Fixed an issue where the firewall was unable to monitor AUX1 and AUX2 interfaces through SNMP. + +## PAN-175570 + +Fixed an issue where log forwarding profiles did not show up in the dropdown under **Zones**. + +## PAN-175509 + +Fixed an issue where a deadlock on CONFIG_LOCK caused both the web interface and CLI commands to time out until the mgmtsrvr process was restarted. + +## PAN-175403 + +```caveat +VM-Series firewalls only +``` + +Fixed an issue where the firewall did not display any logs except for system logs. + +## PAN-175399 + +Fixed an issue where enabling Use proxy to fetch logs from Strata Logging Service caused Panorama to not show logs when queried. + +## PAN-175307 + +Fixed an issue where Panorama commits were slower than expected and the configd process stopped responding due to a memory leak. + +## PAN-175259 + +Fixed an issue where a Security policy configured with App-ID and set to **web-browsing** and **application-default service** allowed clear-text web-browsing on tcp/443. + +## PAN-175161 + +Fixed an issue where changing SSL connection validation settings for system logs caused the mgmtsrvr process to stop responding. + +## PAN-175141 + +Fixed an intermittent issue where IP address-to-username mappings were not created on a redistribution client if a logout and login message shared the same timestamp. + +## PAN-174998 + +```caveat +M-200 and M-500 appliances only +``` + +Fixed a capacity issue that was caused by high operational activity and large configurations. This fix increases the virtual memory limit on the configd process to 32GB. + +## PAN-174894 + +Fixed an issue where, when the TTL value for symmetric MAC entries weren't updated to other dataplanes and HA peers, timeouts occurred for traffic using policy-based forwarding (PBF) with symmetric returns. + +## PAN-174864 + +Fixed an issue on the Panorama interface where **Deploying Master Key** to low-end devices resulted in a **Failed to communicate** message, even when the new master key was updated on the end device. This issue occurred because a master key deployment had insufficient time to process due to a connection timeout. + +## PAN-174709 + +Fixed an OOM condition that occurred due to multiple parallel jobs being created by the scheduled log export feature. + +## PAN-174680 + +Fixed an issue where, when adding new configurations, Panorama didn't display a list of suggested template variables when typing in a relevant field. + +## PAN-174607 + +Fixed an intermittent issue where, when Security profiles were attached to a policy, files that were downloaded across TLS sessions decrypted by the firewall were malformed. + +## PAN-174604 + +Fixed an issue where the email subject of scheduled reports was enclosed in single quotation marks. + +## PAN-174564 + +```caveat +VM-Series firewalls on a Kernel-based Virtual Machine (KVM) running on Proxmox Hypervisor only +``` + +Fixed an issue where SSH traffic was identified as unknown-TCP. + +## PAN-174347 + +Fixed an issue where sequence numbers were calculated incorrectly for traffic that was subject to Session Initiation Protocol (SIP) application-level gateway (ALG) when SIP TCP Clear Text Proxy was disabled. + +## PAN-174011 + +Fixed an issue where Panorama failed to update shared policies during partial commits when a new device group was created but not yet committed. + +## PAN-173893 + +Fixed a memory leak issue related to the (useridd) process that occurred when group mapping was enabled. + +## PAN-173753 + +Fixed an issue where a bar or point on a **Network Monitor** graph had to be clicked more than once to properly redirect to the corresponding ACC report. + +## PAN-173689 + +Fixed an issue where the dataplane restarted due to running out of memory in the policy cache. + +## PAN-173545 + +Fixed an issue where exporting a device summary to CSV failed and displayed the following error message: Error while exporting. + +## PAN-173509 + +Fixed an issue where Superuser administrators with read-only privileges (**Device > Administrators and Panorama > Administrators**) were unable to view the hardware ACL blocking setting and duration in the CLI using the following commands: + +- show system setting hardware-acl-blocking-enable +- show system setting hardware-acl-blocking-duration + +## PAN-173267 + +Fixed an issue where log queries on Panorama appliances returned with no output and the error message Schema file does not exist displayed in the reported process log. + +## PAN-173179 + +Fixed an issue where the rem_addr field in Terminal Access Controller Access-Control System (TACACS+) authentication displayed the management or service route IP address of the firewall instead of the source IP address of the user. + +## PAN-172837 + +Fixed an intermittent issue where the firewall didn't generate block URL logs for URLs even though the websites were blocked in the client device. + +## PAN-172748 + +```caveat +VM-Series firewalls only +``` + +Fixed an issue where a process (all_task) stopped responding. + +## PAN-172404 + +Fixed an issue where the semi-colon (;) was not recognized as token separator while doing regex for URL category matching even though it is mentioned in the documentation. + +## PAN-172396 + +Fixed a memory leak issue related to the useridd process. + +## PAN-172316 + +Fixed an issue where the internal interface flow control that caused the monitoring process to incorrectly determine the interface to be malfunctioning. + +## PAN-172295 + +Fixed an issue where a HIP database cache loop caused high CPU utilization on a process (useridd) and caused IP address-to-user mapping redistribution failure. + +## PAN-172243 + +Fixed an issue where NetFlow traffic triggered a packet buffer leak. + +## PAN-172056 + +```caveat +VM-Series firewalls only +``` + +The logging rate limit was improved to prevent log loss. + +## PAN-171869 + +Fixed an issue where HIP profile objects in security policies and authentication policies were still visible in the CLI even after replacing them with source HIP and destination HIP objects. + +## PAN-171367 + +Fixed an issue in active/active HA configurations where sessions disconnected during an upgrade from a PAN-OS 9.0 release to a PAN-OS 9.1 release. + +## PAN-171345 + +Fixed an issue where firewalls experienced high packet descriptor usage due to internal communication associated with WildFire. + +## PAN-171181 + +Fixed an issue where the IPSec tunnel configuration didn't load when a double quotation mark was added to the comment section of the IPSec tunnel **General** tab. + +## PAN-170952 + +Fixed script issues that caused diagnostic data to not be collected after path monitor failure. + +## PAN-170595 + +Fixed an issue with Content and Threat Detection where traffic patterns created a bus error, which caused the all_pktproc process to stop responding and the dataplane to restart. + +## PAN-170297 + +Fixed an issue where **ACC > Threat** activity did not include the threat name after upgrading to a PAN-OS 10.0 release. + +## PAN-169917 + +Fixed an issue on Panorama where AUX interface IP addresses did not populate when configuring service routes. + +## PAN-169796 + +Fixed an issue where the high availability path group destination IP address was removed after pushing a PAN-OS 10 release template from Panorama to a firewall running a PAN-OS 9 release. + +## PAN-169433 + +Fixed an issue on Panorama where clicking **Run Now** for a custom report with 32 or more filters in the Query Builder returned the following message: No matching records. + +## PAN-168921 + +Fixed an issue on firewalls in HA active/active configurations where traffic with complete packets showed up as incomplete and was disconnected due to a non-session owner closing the session prematurely. + +## PAN-168890 + +A CLI command was added to address an issue where a configured proxy server for a service route was automatically applied to the email server service route. + +## PAN-168662 + +Fixed an issue on Panorama where multiple copies of logs were displayed for a single session. + +## PAN-168635 + +Fixed an issue on the firewall where, when attempting to change the master key, the existing master key was not validated first. As a result, all firewall keys were corrupted. + +## PAN-168286 + +Fixed a memory leak issue in the mgmtsrvr process that was caused by failed commit all operations. + +## PAN-168189 + +Fixed an issue where, even when there was active multicast traffic, the firewall sent Protocol Independent Multicast (PIM) prune messages. + +## PAN-167858 + +Fixed an issue where a DNS Security inspection identified a TCP DNS request that had two requests in one segment as a malformed packet and dropped the packet. + +## PAN-167259 + +Fixed an issue where, after manually uploading WildFire images, the dropdown did not display any available files to choose from. + +## PAN-166368 + +Fixed an issue on Panorama where long FQDN queries did not resolve due to the character limit being 64 characters. + +## PAN-165147 + +Fixed an issue where, when there was a high volume of traffic for sessions with **Application Block Pages** enabled, other regular packets were dropped. + +## PAN-164871 + +```caveat +VM-Series firewalls only +``` + +Fixed an intermittent issue where deactivating the firewall via XML API using manual mode failed. This occurred because the size of the license token file was incorrect. + +## PAN-164631 + +Fixed an issue where the **stats dump** report was empty. + +## PAN-163831 + +Fixed an issue where IPv6 addresses were displayed instead of IPv4 in custom reports. + +## PAN-163245 + +Fixed an issue where a commit-all or push to the firewall from Panorama failed with the following error message: client routed requesting last config in the middle of a commit/validate. Aborting current commit/validate. + +## PAN-162047 + +```caveat +Firewalls in HA active/passive configurations only +``` + +Fixed a routing table mis-sync issue where routes were missing on the passive firewall when GRE tunnels with keepalives were configured. + +## PAN-161297 + +Fixed an interoperability issue with other vendors when IKEv2 used SHA2-based certificate authentication. + +## PAN-161111 + +Fixed an issue where TLS 1.3 Forward Proxy Decryption failed with a malloc failure error. This issue was caused by the server certificate being very large. + +## PAN-161031 + +Fixed an issue where authentication via LDAP server failed in FIPS-CC mode when the LDAP server profile was configured with the root certificate chain and **Verify server certificate for SSL sessions** options enabled. + +## PAN-159835 + +Fixed an issue where, after an upgrade, the following error message was displayed: Not enough space to load content to SHM. + +## PAN-158639 + +Fixed an issue on Panorama where logs that were forwarded to a collector group did not appear, and the log collector displayed the following error message: es.init-status not ready in logjobq. + +## PAN-158541 + +Fixed an OOM condition on the dataplane on FIPS-mode firewall decryption that used DHE ciphers. + +## PAN-158369 + +Fixed an issue where applications did not work via the Clientless VPN when they were configured on a vlan interface + +## PAN-156289 + +Fixed an issue where the default severities for Content Update errors were inaccurate. + +## PAN-151692 + +Fixed a permission issue where a Panorama administrator was unable to download or install dynamic updates (**Panorama > Device Deployment**). + +## PAN-151302 + +```caveat +PA-7000 Series firewalls with LFCs only +``` + +Fixed an issue where the logging rate for the LFC was not displayed in **Panorama > Managed Devices > Health**. + +## PAN-146734 + +Fixed an issue where, when a Panorama-pushed configuration was referenced in a local configuration, commits failed after updating the master key on the firewall, which resulted in the following error message: Invalid candidate configuration. Master key change aborted.... + +## PAN-145833 + +```caveat +PA-3200 Series firewalls only +``` + +Fixed an issue where the firewall stopped recording dataplane diagnostic data in dp-monitor.log after a few hours of uptime. + +## PAN-141454 + +Fixed an issue where the output of the CLI command show running resource-monitor ingress-backlogs displayed an incorrect total utilization value. diff --git a/web/data/issues/PAN-OS/addressed/10.1.6-h3_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.6-h3_2026-03-16.md new file mode 100644 index 0000000..10cc720 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.6-h3_2026-03-16.md @@ -0,0 +1,79 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.6-h3 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-194408 + +Fixed an issue where, when policy rules had the apps that implicitly depended on web browsing configured with the service application default, traffic did not match the rule correctly. + +## PAN-194325 + +```caveat +PA-5450 firewalls only +``` + +Fixed an issue where the logging interface configuration was not correctly written to the syslog-ng configuration file. + +## PAN-192880 + +Fixed an issue where, when the firewall was configured for jumbo frames, an internal interface was not set with the correct MTU, which caused byte frames larger than 1500 to be dropped when a DF bit was set. + +## PAN-192403 + +```caveat +PA-5450 firewalls only +``` + +Fixed an issue on the web interface where, when configuring the management interface and logging interface in the same subnetwork, a commit warning was not displayed even though the configuration caused routing and connectivity issues. + +## PAN-191558 + +Fixed an issue where, after an upgrade to PAN-OS 10.1.5, Global Find did not display all results related to a searched item. + +## PAN-191257 + +Fixed an issue on the firewall where the useridd process stopped responding after a commit from Panorama. This occurred due to a timing issue where a HIP query from the dataplane was initiated before the process had finished initialization. + +## PAN-190811 + +```caveat +PA-5450 firewalls only +``` + +Fixed an issue where logs were forwarded through the management interface instead of the configured log interface to be used for forwarding. + +## PAN-190292 + +Fixed an issue where you could not configure a log interface as a service route (**Device** > **Setup** > **Services** > **Service Route**) + +## PAN-189762 + +Fixed an issue where a predict session didn't match with the traffic when both source NAT and destination NAT were enabled. + +## PAN-188833 + +Fixed an issue where shared address objects used as a source or destination in policies were cloned but not freed back after configuration commits. + +## PAN-187126 + +Fixed an issue where enabling DPDK mode on the dataplane interfaces of a Microsoft Azure instance caused the brdagent process to stop responding. + +## PAN-186075 + +```caveat +VM-Series firewalls only +``` + +Fixed an issue where the firewall rebooted after receiving large packets while in DPDK mode on Azure virtual machines running CX4 (MLx5) drivers. + +## PAN-186024 + +Fixed an issue where URL category match did not work for External Dynamic List URLS due to a leak related to the devsrvr process. + +## PAN-183166 + +Fixed an issue where system, configuration, and alarm logs were queued up on the logrcvr process and were not forwarded out or written to disk until an autocommit was passed. diff --git a/web/data/issues/PAN-OS/addressed/10.1.6-h6_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.6-h6_2026-03-16.md new file mode 100644 index 0000000..0bf7743 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.6-h6_2026-03-16.md @@ -0,0 +1,115 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.6-h6 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-196993 + +Fixed an issue where an incorrect regex key was generated to invalidate the completions cache, which caused the configd process to stop responding. + +## PAN-195181 + +Added enhancements to improve the load on the pan_comm process during SNMP polling. + +## PAN-194826 + +```caveat +WF-500 and WF-500-B appliances only +``` + +Fixed an issue where log system forwarding did not work over a TLS connection. + +## PAN-194776 + +Fixed an issue on Amazon Web Services (AWS) Gateway Load Balancer (GWLB) deployments with overlay routing enabled where intra-zone packets were re-encapsulated with the incorrect source/destination MAC address. + +## PAN-194721 + +Fixed an issue where path monitor failure occurred, which caused slots to go down. + +## PAN-194694 + +Fixed an issue where multiple SNMP requests being made to the firewall caused in the pan_comm process to stop responding. + +## PAN-194645 + +```caveat +PA-5400 Series firewalls only +``` + +Fixed an issue where the Data Processing Card status was incorrectly shown as **config=None** + +## PAN-194601 + +Fixed an issue that caused the all_task process to stop responding. + +## PAN-194406 + +Fixed an issue where the MTU from SD-WAN interfaces was recalculated after a configuration push from Panorama or a local commit, which caused traffic disruption. + +## PAN-194097 + +Fixed an issue on firewalls in high availability (HA) active/passive configurations where _ha_d_session_msgbuf overflowed on the passive firewall during an upgrade, which caused the firewall to enter a non-functional state. + +## PAN-193732 + +```caveat +PA-5400 Series firewalls only +``` + +Fixed an issue where the firewall incorrectly handled internal transactions. + +## PAN-193184 + +Fixed an issue where **IP-user-mapping** disappeared when login/logout events occurred at the same timestamp. + +## PAN-193132 + +```caveat +PA-220 firewalls only +``` + +Fixed an issue where a commit and push from Panorama caused high dataplane CPU utilization. + +## PAN-192999 + +A fix was made to address [CVE-2022-0028](https://security.paloaltonetworks.com/CVE-2022-0028). + +## PAN-192758 + +```caveat +PA-7000 Series firewalls only +``` + +Fixed an issue where files failed to upload to the Wildfire public cloud. + +## PAN-192673 + +```caveat +PA-7050-SMC-B firewalls only +``` + +Fixed an issue where the LFC (log forwarding card) syslog-ng service failed to start after an upgrade. + +## PAN-192551 + +```caveat +PA-5400 Series firewalls only +``` + +Fixed an issue where the firewall incorrectly processed path monitoring packets, which caused a slot restart. + +## PAN-192052 + +Fixed an issue where, when next hop MAC address entries weren't found on the offload processor for active traffic, update messages flooded the firewall, which caused resource contention and traffic disruption. + +## PAN-182951 + +Fixed an issue where commits remained at 98% for an hour and then failed. + +## PAN-173469 + +Fixed an intermittent issue where websites were blocked and categorized as not resolved. diff --git a/web/data/issues/PAN-OS/addressed/10.1.6-h7_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.6-h7_2026-03-16.md new file mode 100644 index 0000000..6a6dff5 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.6-h7_2026-03-16.md @@ -0,0 +1,15 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.6-h7 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-202450 + +Fixed an issue where the device-client-cert was set to expire on December 31, 2023. With this fix, the expiration date has been extended. + +## PAN-198372 + +Fixed an issue where the root-cert was set to expire on December 31, 2023. With this fix, the expiration date has been extended. diff --git a/web/data/issues/PAN-OS/addressed/10.1.6-h9_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.6-h9_2026-03-16.md new file mode 100644 index 0000000..ee7026e --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.6-h9_2026-03-16.md @@ -0,0 +1,11 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.6-h9 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-272809 + +A fix was made to address [CVE-2024-9474](https://security.paloaltonetworks.com/CVE-2024-9474). diff --git a/web/data/issues/PAN-OS/addressed/10.1.7-h1_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.7-h1_2026-03-16.md new file mode 100644 index 0000000..2742c18 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.7-h1_2026-03-16.md @@ -0,0 +1,27 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.7-h1 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-237935 + +Extended the offline PAN-DB, Panorama, and WildFire certificates which were previously set to expire on September 2, 2024. + +## PAN-237876 + +Extended the firewall Panorama root CA certificate which was previously set to expire on April 7th, 2024. + +## PAN-231771 + +Fixed an issue where the firewall issued /box/getserv/ requests with PAN-OS 7.1.0 and did not take device certificates. + +## PAN-227568 + +When a device certificate is installed, renewed, or removed, the firewall will reconnect to the WildFire cloud to use the newest certificate. + +## PAN-215576 + +Fixed an issue where the userID-Agent and TS-Agent certificates were set to expire on November 18, 2024. With this fix, the expiration date has been extended to January 2032. diff --git a/web/data/issues/PAN-OS/addressed/10.1.7_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.7_2026-03-16.md new file mode 100644 index 0000000..2029df0 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.7_2026-03-16.md @@ -0,0 +1,639 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.7 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-200771 + +Fixed an issue where syslog-ng was unable to start due to a design change in the syslog configuration file. + +## PAN-199654 + +Fixed an issue where ACC reports did not work for custom RBAC users when more than 12 access domains were associated with the username. + +## PAN-199311 + +Fixed an issue where the Log Forwarding Card (LFC) failed to forward logs to the syslog server. + +## PAN-198509 + +Fixed an issue where commits failed due to insufficient CFG memory. + +## PAN-198332 + +```caveat +PA-5400 Series only +``` + +Fixed an issue where swapping Network Processing Cards (NPCs) caused high root partition use. + +## PAN-198244 + +Fixed an issue where using the load config partial CLI command to x-paths removed address object entries from address groups. + +## PAN-197484 + +```caveat +PA-5400 Series firewalls +``` + +Fixed an issue where the firewall forwarded packets to the incorrect aggregate ethernet interface when Policy Based Forwarding (PBF) was used. + +## PAN-197244 + +Fixed an issue on firewalls with Forward Proxy enabled where the all_pktproc process stopped responding due to missed heartbeats. + +## PAN-196993 + +Fixed an issue where an incorrect regex key was generated to invalidate the completions cache, which caused the configd process to stop responding. + +## PAN-196953 + +```caveat +PA-5450 firewalls only +``` + +Fixed an issue where jumbo frames were dropped. + +## PAN-196445 + +Fixed an issue where restarting the NPC or the Data Processing Card (DPC) did not bring up all the network interfaces. + +## PAN-196227 + +Fixed an issue where the logd process stopped responding, which caused Panorama to reboot into maintenance mode. + +## PAN-196005 + +```caveat +PA-3200 Series, PA-5200 Series, and PA-5400 Series firewalls only +``` + +Fixed an issue where GlobalProtect IPSec tunnels disconnected at half the inactivity logout timer value. + +## PAN-195707 + +Fixed an issue on Panorama appliances configured as log collectors where Panorama repeatedly rebooted into maintenance mode. + +## PAN-195628 + +Fixed an issue that caused the pan_task process to miss heartbeats and stop responding. + +## PAN-195625 + +Fixed an issue where authd frequently created SSL sessions, which resulted in an out-of-memory (OOM) condition. + +## PAN-195360 + +Fixed an issue with firewalls in Microsoft Azure environments where BGP flapping occurred due to the firewall incorrectly treating capability from BGP peering as unsupported. + +## PAN-195223 + +Fixed an issue where the all_pktproc process restarted when receiving a GTPv2 Modify Bearer Request packet if the Serving GPRS Support Node (SGSN) used the same key as the Serving Gateway (SGW). + +## PAN-195181 + +Added enhancements to improve the load on the pan_comm process during SNMP polling. + +## PAN-194958 + +Fixed an issue where using the show routing protocol bgp loc-rib-detail CLI command caused the CLI to stop responding. + +## PAN-194826 + +```caveat +WF-500 and WF-500-B appliances only +``` + +Fixed an issue where log system forwarding did not work over a TLS connection. + +## PAN-194776 + +Fixed an issue on Amazon Web Services (AWS) Gateway Load Balancer (GWLB) deployments with overlay routing enabled where intra-zone packets were re-encapsulated with the incorrect source/destination MAC address. + +## PAN-194601 + +Fixed an issue that caused the all_task process to stop responding. + +## PAN-194481 + +Fixed an issue in ESXi where the bootstrapped VM-Series firewalls with the Software Licensing Plugin had :xxx appended to their hostnames. + +## PAN-194472 + +A CLI command was added to address an issue where packets were discarded due to the QoS queue limit being reached. This command enables you to modify the QoS queue size to accommodate more users. + +## PAN-194408 + +Fixed an issue where, when policy rules had the apps that implicitly depended on web browsing configured with the service application default, traffic did not match the rule correctly. + +## PAN-194406 + +Fixed an issue where the MTU from SD-WAN interfaces was recalculated after a configuration push from Panorama or a local commit, which caused traffic disruption. + +## PAN-193981 + +```caveat +VM-Series firewalls in Microsoft Azure environments only +``` + +Fixed an issue where the firewall stopped monitoring high availability (HA) failure and floating IP addresses did not get moved to the newly active firewall. + +## PAN-193765 + +Fixed an issue where commits failed the following error displayed in the configd log: Unable to populate ids into candidate config: Error: Error populating id for ‘sg2+DMZ to FirstAM Scanner-1‘. + +## PAN-193763 + +Fixed an issue on the firewall where the dataplane CPU spiked, which caused traffic to be affected during commits or content updates. + +## PAN-193707 + +Fixed an issue where SAML authentication failed during commits with the following error message: revocation status could not be verified (reason: ). + +## PAN-193483 + +```caveat +VM-Series firewalls only +``` + +Fixed an issue where, during Layer-7 packet inspection where traffic was being inspected for threat signature and data patterns, multiple processes stopped responding. + +## PAN-193392 + +Fixed an issue where RTP packets dropped due to conflicting duplicate flows. + +## PAN-193175 + +Fixed an issue where PBP Drops (8507) threat logs were incorrectly logged as SCTP Init Flood (8506). + +## PAN-193132 + +```caveat +PA-220 firewalls only +``` + +Fixed an issue where a commit and push from Panorama caused high dataplane CPU utilization. + +## PAN-192944 + +Fixed an issue where the logrcvr process caused an OOM condition. + +## PAN-192758 + +```caveat +PA-7000 Series firewalls only +``` + +Fixed an issue where files failed to upload to the WildFire public cloud. + +## PAN-192726 + +Fixed an issue where the firewall dropped TCP traffic inside IPSec tunnels. + +## PAN-192725 + +Fixed an issue where the firewall failed to forward logs to Panorama when configured with IPv6 addressing only. + +## PAN-192666 + +```caveat +VM-Series firewalls only +``` + +Fixed an issue where uploading certificates via API failed within the first 30 minutes of a bootstrap. + +## PAN-192551 + +```caveat +PA-5400 Series firewalls only +``` + +Fixed an issue where the firewall incorrectly processed path monitoring packets, which caused a slot restart. + +## PAN-192404 + +Fixed an issue where ARP broadcasts occurring in the same time interval and network segment as HA path monitoring pings triggered an ARP cache request, which prevented the firewall from sending ICMP echo requests to the monitored destination IP address and caused an HA path monitoring failover. + +## PAN-192330 + +```caveat +Bootstrapped VM-Series firewalls in Microsoft Azure environments only +``` + +Fixed an issue where the firewall did not automatically receive the Strata Logging Service license. + +## PAN-192089 + +Fixed an issue on the web interface where the IPSec tunnel did not gray out after disabling it. + +## PAN-191867 + +Fixed an issue where CPU stalls resulted in a slot restart. + +## PAN-191847 + +Fixed an issue where the Panorama appliance was unable to generate scheduled custom reports due to the large number of files stored in the opt/pancfg/mgmt/custom-reports directory. + +## PAN-191726 + +Fixed an issue where an SCP export of the device state from the firewall added single quotes ( ' ) to the filename. + +## PAN-191558 + +Fixed an issue where, after an upgrade to PAN-OS 10.1.5, Global Find did not display all results related to a searched item. + +## PAN-191381 + +Fixed an issue where multicast packets were dropped due to a large timeout value in the multicast FIB. + +## PAN-191288 + +Fixed an issue where the firewall restarted due to a dnsproxy process crash. + +## PAN-191269 + +Fixed an issue where the NAT pool leaked for passive mode FTP predict sessions. + +## PAN-191218 + +```caveat +PA-5400 Series firewalls only +``` + +Fixed an issue where the session log storage quota could not be changed via the web interface. + +## PAN-191163 + +Fixed an issue where the logrcvr process stopped responding when processing threat logs with HTTP2 and data capture flagged. + +## PAN-191022 + +Fixed an issue where a full routing table caused many dataplane messages, which resulted in packet buffer congestion and packet drops. + +## PAN-190811 + +```caveat +PA-5450 firewalls only +``` + +Fixed an issue where logs were forwarded through the management interface instead of the configured log interface to be used for forwarding. + +## PAN-190727 + +```caveat +PA-5450 firewall only +``` + +Fixed an issue where documentation for configuring the log interface was unavailable on the web interface and in the PAN-OS Administrator’s Guide. + +## PAN-190493 + +Fixed an issue where decrypted VLAN traffic on Virtual Wire (V-Wire) changed to VLAN ID 0. + +## PAN-190492 + +Fixed an issue where the Panorama log collector group level SSH settings were not migrated to the new format when upgrading from a PAN-OS 9.1 release to a PAN-OS 10.0 release. + +## PAN-190448 + +Fixed an issue in ACC reports where IPv6 addresses were displayed instead of IPv4 addresses. + +## PAN-190292 + +Fixed an issue where you could not configure a log interface as a service route **Device > Setup > Services > Service Route** + +## PAN-190225 + +Fixed an issue on Panorama appliances in active/passive HA configurations where the passive appliance was unable to connect to the active appliance after resetting the secure connection state. + +## PAN-189867 + +Fixed an issue where, when logging in to the GlobalProtect gateway, the authentication cookie was not reused. + +## PAN-189861 + +Fixed an issue on firewalls in HA configurations where intermittent system alerts on the active firewall caused the pan_comm process to restart continuously. + +## PAN-189762 + +Fixed an issue where a predict session didn't match with the traffic when both source NAT and destination NAT were enabled. + +## PAN-189414 + +Fixed an issue where TCP packets were dropped during the first zone transfer when DNS security was enabled. + +## PAN-189304 + +Fixed an issue where the Panorama appliance didn't display logs or generate reports for a device group containing MIPs platform that forwarded logs to Strata Logging Service. + +## PAN-189225 + +Fixed an issue where BGP routes were lost or uninstalled after disabling jumbo frames on the firewall. + +## PAN-189206 + +Fixed an issue where Device Group and Template administrator roles didn't support a context switch between the Panorama and firewall web interfaces. + +## PAN-189114 + +Fixed an issue where the dataplane went down, which caused an HA failover. + +## PAN-188942 + +Fixed an issue where, when modifying a DNS proxy configuration, the server port number was transparently changed to port 1080 if an administrator changed only the server IP address. + +## PAN-188867 + +Fixed an issue where the firewall dropped packets when the session payload was too large. + +## PAN-188338 + +Fixed an issue where canceling a commit caused the commit process to remain at 70% and the firewall had to be rebooted. + +## PAN-188096 + +```caveat +VM-Series firewalls only +``` + +Fixed an issue where, on firewalls licensed with Software NGFW Credit (VM-FLEX-4 and higher), HA clustering was unable to be established. + +## PAN-187890 + +Fixed an issue where the Strata Logging Service connection incorrectly displayed as disconnected when a service route was in use. + +## PAN-187805 + +Fixed an issue where a process (all_pktproc) stopped responding and the dataplane restarted during certificate construction or destruction. + +## PAN-187755 + +Fixed an issue where the maximum session timeout was not applied to the administrator as expected. + +## PAN-187151 + +Fixed an issue where tunnel-monitoring interface was incorrectly shown as up instead of down. + +## PAN-186995 + +Fixed an issue where the command to show IP address tags for Dynamic Address Groups displayed the error start-point should be equal to or between 1 and 100000 even when the maximum registered IP address limit was greater than 100,000. With this fix, the show command will display IP address tags up to the correct maximum limit. + +## PAN-186957 + +Fixed an issue where, in **SAML Metadata Export**, a drop-down did not appear in the input field when **IP or Hostname** was selected for **Type**. + +## PAN-186891 + +Fixed an issue where NetFlow packets contained incorrect octet counts. + +## PAN-186807 + +Fixed an issue where RAID rebuild occurred after a reboot due to the RAID array not being populated during the firewall bootup. + +## PAN-186658 + +Fixed an issue where Panorama console sessions were not cleared on the firewall after the idle-timeout value expired. + +## PAN-186584 + +Fixed an issue where SNMPv3 CPU use didn't match the firewall output for show running resource-monitor on single dataplane firewalls. + +## PAN-186418 + +Fixed an issue where Panorama displayed a discrepancy in RAM configured on the VMware host. + +## PAN-186075 + +```caveat +VM-Series firewalls only +``` + +Fixed an issue where the firewall rebooted after receiving large packets while in DPDK mode on Azure virtual machines running CX4 (MLx5) drivers. + +## PAN-185789 + +Fixed an issue where the show ntp CLI command resulted in a Rejected status for NTP servers that used auto-key authentication. + +## PAN-185787 + +Fixed an issue where logging in to the Panorama web interface did not work and the following error message displayed: Timed out while getting config lock. Please try again. + +## PAN-185286 + +```caveat +PA-5400 Series firewalls only +``` + +Fixed an issue on Panorama where device health resources did not populate. + +## PAN-184902 + +Fixed an issue where the logd process stopped responding on Panorama and wasn't able to receive logs from the firewall due to the event manager returning a null pointer. + +## PAN-184845 + +Fixed an issue where Address Resolution Protocol (ARP) packets dropped due to ARP throttle. + +## PAN-184771 + +Fixed an issue where the threat category in a schedule report incorrectly displayed as unknown. + +## PAN-184702 + +```caveat +M-700 appliances in Log Collector mode only +``` + +Fixed an issue on the Panorama management server where the Panorama appliance failed to connect to Panorama when added as a managed log collector. + +## PAN-184342 + +Fixed an issue where the firewall dropped the second TCP packet as non-syn TCP if it was SYN/ACK/PSH due to the incorrect expectation that the second packet would be SYN/ACK. + +## PAN-184068 + +```caveat +PA-5200 series firewalls only +``` + +Fixed an issue where the firewall generated pause frames, which caused network latency. + +## PAN-183949 + +Fixed an issue on the firewall where a script to send XML API queries to update the block list caused the sslmgr process to restart. + +## PAN-183888 + +Fixed an issue on Panorama appliances with PA-5400 Series managed firewalls where **Monitor > Traffic** did not display logs. + +## PAN-183826 + +Fixed an issue where, after clicking **WildFire Analysis Report**, the web interface failed to display the report with the following error message: refused to connect. + +## PAN-183664 + +```caveat +VM-Series firewalls only +``` + +Fixed an issue where set core operations failed during Software NGFW FLEX licensing. + +## PAN-183603 + +```caveat +M-200 and M-600 appliances in Log Collector mode only +``` + +Fixed a disk issue that occurred after an upgrade to PAN-OS 10.2 which prevented the ElasticSearch process from starting, which resulted in the dedicated log collector being unable to write new logs to logging disks. + +## PAN-183270 + +Fixed an issue where a bootstrapped firewall connected only to the first log collector in a log collector group. + +## PAN-183184 + +Fixed an issue where enabling SSL decryption with a Hardware Security Model (HSM) caused a dataplane restart. + +## PAN-183166 + +Fixed an issue where system, configuration, and alarm logs were queued up on the logrcvr process and were not forwarded out or written to disk until an autocommit was passed. + +## PAN-182951 + +Fixed an issue where commits remained at 98% for an hour and then failed. + +## PAN-182539 + +Fixed an issue with Panorama appliances in HA configurations where dedicated log collectors did not send local system or configuration logs to both Panorama appliances. + +## PAN-182212 + +Fixed an issue where SNMP reported the panVsysActiveTcpCps and panVsysActiveUdpCps value to be 0. + +## PAN-182173 + +```caveat +Panorama appliances in HA configurations only +``` + +Fixed an issue where, when using Prisma Access multitenancy, the passive appliance didn't correctly update the tenant information after the tenant was deleted on the active appliance. + +## PAN-182087 + +Fixed an issue where commit failures occurred due to validity checks performed against self-signing certificates not evaluating **Authentication Key Identifier** and **Subject Key Identifier** fields. + +## PAN-180863 + +Fixed an issue where the authentication key was mandatory on the firewall to remove Panorama server details. + +## PAN-179750 + +A CLI command was added to set the virtual memory limit in dedicated log collectors. + +## PAN-179543 + +Fixed an issue where the flow_mgmt process stopped responding when attempting to clear the session table, which caused the dataplane to restart. + +## PAN-179295 + +Fixed an issue where report generation did not work as expected due to missed parameters being passed during inter-daemon communication. + +## PAN-178243 + +Fixed an issue where **Shared Gateway** was not visible in the **Virtual System** drop down when configuring a Layer3 aggregate subinterface. + +## PAN-178194 + +Fixed an issue with the web interface where, when only the Advanced URL Filtering license was activated, the message License required for URL filtering to function was incorrectly displayed and the **URL Filtering Profile > Inline ML** section was disabled. + +## PAN-177861 + +Fixed an issue with User ID redistribution where a system log with severity of **High** was generated each time a commit was performed. This issue occurred due to all UIA agent connections being reset after each commit. + +## PAN-177482 + +Fixed an issue where **ACC > App Scope > Threat Monitor** showed **NO DATA TO DISPLAY**. + +## PAN-176703 + +Fixed an issue that occurred after upgrading to a PAN-OS 9.0 or later release where commits to the firewall configuration failed with the following error message: statistics-service is invalid. + +## PAN-175236 + +Fixed an issue in the template stack where you were unable to add routes under **GlobalProtect > Gateway > Satellite > Network Settings**. + +## PAN-174809 + +Fixed an issue where a process (all_pktproc) restarted. + +## PAN-174489 + +Fixed a source user mismatch issue that occurred when the same name was set as the actual domain for the overriding domain. + +## PAN-173373 + +```caveat +VM-Series firewalls in NSX-T deployments only +``` + +Fixed an issue where deployments dropped packets with the counter pan_netx_send_pkt error. + +## PAN-172834 + +Fixed a memory leak issue related to the useridd process that occurred when processing IP-address-to-username mappings. + +## PAN-172501 + +Fixed an issue where you were unable to revert HA mode settings to the default values from the web interface. + +## PAN-171714 + +Fixed an issue where, when NetBIOS format (domain\user) was used for the IP address-to-username mapping and the firewall received the group mapping information from the Cloud Identity Engine, the firewall did not match the user to the correct group. + +## PAN-171690 + +Fixed an issue where logs were not displayed in **GlobalProtect Deployment Activity** with the message No data to display even though they were displayed in the **Monitor** tab. + +## PAN-171497 + +Fixed an issue where, after a local user group was updated by adding or removing users, the local user group was removed from groupdb. + +## PAN-171159 + +Fixed a memory leak on the configd process on Panorama caused during multi-clone operations for rules. + +## PAN-169153 + +Fixed an issue where LDAP connections over TLS failed with untrusted certificates error even though **Verify Server Certificate for SSL sessions** option was not selected. + +## PAN-168005 + +Fixed an issue where GlobalProtect was unable to connect to the gateway and displayed the error message Could not connect to the gateway. The device or features requires a GlobalProtect subscription license even though the gateway firewall had a valid gateway license. + +## PAN-163906 + +Fixed an issue where commits failed due to a non-configuration error. + +## PAN-163828 + +Fixed an issue where path MTU discovery did not work when the MTU was not configured manually on the tunnel interface. + +## PAN-163261 + +Fixed an intermittent issue where the firewall dropped GTPv2 Modify Bearer Request packets with the following error message: Abnormal GTPv2-C message with missing mandatory IE. + +## PAN-160238 + +Fixed an issue where intermittent VXLAN packet drops occurred if the TCI was not configured for inspecting VXLAN traffic. This issue occurred when traffic was migrated from a firewall running a PAN-OS version earlier than PAN-OS 9.0 to a firewall running PAN-OS 9.0 or later. + +## PAN-157215 + +Fixed an issue that occurred when two FQDNs were resolved to the same IP address and were configured as the same src/dst of the same rule. If one FQDN was later resolved to a different IP address, the IP address resolved for the second FQDN was also changed, which caused traffic with the original IP address to hit the incorrect rule. + +## PAN-151469 + +Fixed an issue where packets were dropped unexpectedly due to errors parsing the IP version field. diff --git a/web/data/issues/PAN-OS/addressed/10.1.8-h2_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.8-h2_2026-03-16.md new file mode 100644 index 0000000..2e63eeb --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.8-h2_2026-03-16.md @@ -0,0 +1,171 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.8-h2 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-208724 + +Fixed an issue where port pause frame settings did not work as expected and incorrect pause frames occurred. + +## PAN-208718 + +Additional debug information was added to capture internal details during traffic congestion. + +## PAN-206658 + +Fixed a timeout issue in the Intel ixgbe driver that resulted in internal path monitoring failure. + +## PAN-206251 + +```caveat +PA-7000 Series firewalls with Log Forwarding Cards (LFCs) only +``` + +Fixed an issue where the logrcvr process did not send the system-start SNMP trap during startup. + +## PAN-205735 + +Fixed an issue where the mgmtsrvr process stopped responding, which caused the Panorama web interface to become inaccessible and return a **504 Gateway Not Reachable** page. + +## PAN-205030 + +Fixed an issue where, when a session hit policy based forwarding with symmetric return enabled was not offloaded, the firewall received excessive return-mac update messages, which resulted in resource contention and traffic disruption. + +## PAN-204335 + +Fixed an issue where Panorama became unresponsive, and when refreshed, the error **504 Gateway not Reachable** was displayed. + +## PAN-203851 + +Fixed an issue with firewalls in high availability (HA) configurations where host information profile (HIP) sync did not work between the active primary firewall and the active secondary firewall. + +## PAN-203653 + +Fixed an issue where dynamic updates were completed even when configuration commits failed, which caused the all_task process to stop responding. + +## PAN-203453 + +Fixed an issue on Panorama where the log query failed due to a high number of User-ID redistribution messages. + +## PAN-203402 + +Fixed an intermittent issue where forward session installs were delayed, which resulted in latencies. + +## PAN-203244 + +Fixed a path monitoring issue that caused traffic degradation. + +## PAN-202783 + +```caveat +PA-7000 Series firewalls with 100G NPC (Network Processing Cards) only +``` + +Fixed an issue where sudden, large bursts of traffic destined for an interface that was down caused packet buffers to fill, which stalled path monitor heartbeat packets. + +## PAN-202544 + +An enhancement was made to collect CPLD register data after a path monitor failure. + +## PAN-202543 + +An enhancement was made to improve path monitor data collection by verifying the status of the control network. + +## PAN-202535 + +Fixed an issue where the Device Telemetry configuration for a region was unable to be set or edited via the web interface. + +## PAN-202361 + +Fixed an issue where packets queued to the pan_task process were still transmitted when the process was not responding. + +## PAN-202101 + +Fixed an issue where firewalls stopped responding after an upgrade due to configuration corruption. + +## PAN-202012 + +A debug command was introduced to control Gzip encoding for the GlobalProtect Clientless VPN application. + +## PAN-201900 + +Fixed an internal path monitoring failure issue that caused the dataplane to go down. + +## PAN-201858 + +Fixed an issue where the SD-WAN interface Maximum Transmission Unit (MTU) led to incorrect fragmentation of IPSec traffic. + +## PAN-201627 + +Fixed an issue in next-generation firewall deployments where, when SD-WAN was configured, the dataplane restarted if all SD-WAN member links were down due to an out-of-memory (OOM) condition or during a reboot when all SD-WAN tunnels were down. + +## PAN-198718 + +```caveat +PA-5280 firewalls only +``` + +Fixed an issue where memory allocation failures caused increased decryption failures. + +## PAN-197582 + +Fixed an issue where, after upgrading to PAN-OS 10.1.6, the firewall reset SSL connections that used policy-based forwarding. + +## PAN-196261 + +Fixed an issue where inter-lc disconnected once every minute in the system logs. + +## PAN-194704 + +Fixed an issue with SIP ALG where improper NAT was applied when Destination NAT ran out of IP addresses. + +## PAN-194068 + +```caveat +PA-5200 Series firewalls only +``` + +Fixed an issue where the firewall unexpectedly rebooted with the log message Heartbeat failed previously. + +## PAN-193928 + +Fixed an intermittent issue where GlobalProtect logs were not visible under device groups (**Mobile_User_Device_Group**). + +## PAN-192456 + +Fixed an issue where GlobalProtect SSL VPN processing during a high traffic load caused the dataplane to stop responding. + +## PAN-191408 + +Fixed an issue where the firewall did not correctly receive dynamic address group information from Panorama after a reboot or initial connection. + +## PAN-184766 + +```caveat +PA-5450 firewalls only +``` + +Fixed an issue where the control packets for BGP, OSPF, and Bidirectional Forwarding Detection (BFD) were not assigned a QoS value of 5. + +## PAN-183757 + +```caveat +PA-5200 Series and PA-7000 Series firewalls only +``` + +Fixed an issue where uneven distribution of sessions caused packet latency. + +## PAN-172452 + +Fixed an issue where the log file did not include all logs. + +## PAN-171143 + +Fixed an issue where tech support files didn't collected DP3 logs. + +## PAN-167288 + +Fixed an issue with the pan_task process that caused the queue to build up. diff --git a/web/data/issues/PAN-OS/addressed/10.1.8-h7_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.8-h7_2026-03-16.md new file mode 100644 index 0000000..9499b4b --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.8-h7_2026-03-16.md @@ -0,0 +1,27 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.8-h7 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-237935 + +Extended the offline PAN-DB, Panorama, and WildFire certificates which were previously set to expire on September 2, 2024. + +## PAN-237876 + +Extended the firewall Panorama root CA certificate which was previously set to expire on April 7th, 2024. + +## PAN-231771 + +Fixed an issue where the firewall issued /box/getserv/ requests with PAN-OS 7.1.0 and did not take device certificates. + +## PAN-227568 + +When a device certificate is installed, renewed, or removed, the firewall will reconnect to the WildFire cloud to use the newest certificate. + +## PAN-215576 + +Fixed an issue where the userID-Agent and TS-Agent certificates were set to expire on November 18, 2024. With this fix, the expiration date has been extended to January 2032. diff --git a/web/data/issues/PAN-OS/addressed/10.1.8-h8_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.8-h8_2026-03-16.md new file mode 100644 index 0000000..1b236f8 --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.8-h8_2026-03-16.md @@ -0,0 +1,11 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.8-h8 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-272809 + +A fix was made to address [CVE-2024-9474](https://security.paloaltonetworks.com/CVE-2024-9474). diff --git a/web/data/issues/PAN-OS/addressed/10.1.8_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.8_2026-03-16.md new file mode 100644 index 0000000..f22e70d --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.8_2026-03-16.md @@ -0,0 +1,143 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.8 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-204830 + +Fixed an issue where logging in via the web interface or CLI did not work until an auto-commit was complete. + +## PAN-203598 + +Fixed an issue where, when tunnel content inspection was enabled for VXLAN, ARP over VXLAN packets were dropped. + +## PAN-201872 + +Fixed an issue where SMB performance caused overall network latency after an upgrade. + +## PAN-201818 + +Fixed an issue where INIT SCTP packets were dropped after being processed by the CTD, and silent drops occurred even with SCTP no-drop function enabled. + +## PAN-201627 + +Fixed an issue in next-generation firewall deployments where, when SD-WAN was configured, the dataplane restarted if all SD-WAN member links were down due to an out-of-memory (OOM) condition or during a reboot when all SD-WAN tunnels were down. + +## PAN-201357 + +The CLI command debug dataplane set pow no-desched yes was added to address an issue where the all_pktproc process stopped responding and caused traffic issues. + +## PAN-199726 + +Fixed an issue with firewalls in HA configurations where both firewalls responded with gARP messages after a switchover. + +## PAN-199570 + +Fixed an issue where uploading certificates using a custom admin role did not work as expected after a context switch. + +## PAN-199099 + +Fixed an issue where, when decryption was enabled, Safari and Google Chrome browsers on Apple Mac computers rejected the server certificate created by the firewall because the Authority Key Identifier was copied from the original server certificate and did not match the Subject Key Identifier on the forward trust certificate. + +## PAN-198871 + +Fixed an issue when both URL and Advanced URL licenses were installed, the expiry date was not correctly checked. + +## PAN-198733 + +```caveat +PA-5450 firewalls only +``` + +Fixed an issue where tcpdump was hardcoded to eth0 instead of bond0. + +## PAN-198266 + +Fixed an issue where, when predicts for UDP packets were created, a configuration change occurred that triggered a new policy lookup, which caused the dataplane stopped responding when converting the predict. This resulted in a dataplane restart. + +## PAN-198078 + +Fixed an issue where VXLAN keepalive packets were dropped randomly. + +## PAN-197576 + +Fixed an issue where commits pushed from Panorama caused a memory leak related to the mgmtsrvr process. + +## PAN-197386 + +Fixed an issue where traffic that was subject to network packet broker inspection entered a looping state due to incorrect session offload. + +## PAN-196704 + +Fixed an issue where **Preview Changes on Panorama Push to Devices** incorrectly displayed changes to encrypted entries. + +## PAN-196583 + +Fixed an issue where the Cisco TrustSEc plugin triggered a flood of redundant register/unregister messages due to a failed IP address tag database search. + +## PAN-196558 + +Fixed an issue where IP address tag policy updates were delayed. + +## PAN-196131 + +Fixed an issue where the comm process stopped responding when a show command was executed in two sessions. + +## PAN-195107 + +```caveat +PA-7000s Series firewalls with LFCs only +``` + +Fixed an issue where the IP address of the LFC displayed as **unknown**. + +## PAN-194795 + +Fixed an issue where a dataplane 1 VCCIO voltage fluctuation triggered the chassis master alarm. + +## PAN-194615 + +Fixed an issue where the packet broker session timeout value did not match the master sessions timeout value after the firewall received a TCP FIN or RST packet. The fix ensures that Broker session times out within 1 second after the master session timed out. + +## PAN-194441 + +Fixed an issue where the dataplane CPU usage was higher than expected due to packet looping in the broker session when the network packet broker was enabled. + +## PAN-189720 + +Fixed an issue where commits failed when downgrading a Panorama appliance running a PAN-OS 10.1 release to a PAN-OS 10.0 release. + +## PAN-189429 + +Fixed a memory leak that occurred when enabling XFF (x-forwarded-for) logging in a Security policy. + +## PAN-189270 + +Fixed an issue that caused a memory leak on the reportd process. + +## PAN-188118 + +Fixed an issue with firewalls in FIPS mode that prevented device telemetry from connecting. + +## PAN-181759 + +```caveat +Firewalls in active/active HA configurations only +``` + +Fixed an issue where firewall configuration files were not synced. + +## PAN-180039 + +Fixed an issue in 10.0.9, where executing the CLI command show transceiver-detail all resulted in the following error message: An error occurred. See dagger.log for information.. + +## PAN-178613 + +```caveat +PA-400 Series firewalls only +``` + +Fixed an issue where multiple restarts related to the all_task process occurred. diff --git a/web/data/issues/PAN-OS/addressed/10.1.9-h6_2026-03-16.md b/web/data/issues/PAN-OS/addressed/10.1.9-h6_2026-03-16.md new file mode 100644 index 0000000..2f39cbd --- /dev/null +++ b/web/data/issues/PAN-OS/addressed/10.1.9-h6_2026-03-16.md @@ -0,0 +1,15 @@ +--- +type: Addressed +product: PAN-OS +version: 10.1.9-h6 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## PAN-222712 + +```caveat +PA-5450 firewalls only +``` + +Fixed a low frequency DPC restart issue. diff --git a/web/data/issues/PAN-OS/known/10.1.0_2026-03-16.md b/web/data/issues/PAN-OS/known/10.1.0_2026-03-16.md new file mode 100644 index 0000000..d8af466 --- /dev/null +++ b/web/data/issues/PAN-OS/known/10.1.0_2026-03-16.md @@ -0,0 +1,1234 @@ +--- +type: Known +product: PAN-OS +version: 10.1.0 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## APL-15000 + +When you move a firewall from one Strata Logging Service instance to another, it can take up to an hour for the firewall to begin sending logs to the new instance. + +## APL-8269 + +For data retrieved from Strata Logging Service, the Threat Name column in **Panorama** > **ACC** > **threat-activity** appears blank. + +## PLUG-380 + +When you rename a device group, template, or template stack in Panorama that is part of a VMware NSX service definition, the new name is not reflected in NSX Manager. Therefore, any ESXi hosts that you add to a vSphere cluster are not added to the correct device group, template, or template stack and your Security policy is not pushed to VM-Series firewalls that you deploy after you rename those objects. There is no impact to existing VM-Series firewalls. + +## WF500-5559 + +An intermittent error while analyzing signed PE samples on the WildFire appliance might cause analysis failures. + +## WF500-5471 + +After using the firewall CLI to add a WildFire appliance with an IPv6 address, the initial connection may fail. + +**Workaround:** Retry connecting after you restart the web server with the following command: `debug software restart process web-server`. + +## PAN-281370 + +The Advanced WildFire Inline ML models **OOXML** and **Mach-O** erroneously display as being available from the CLI; however, they are only available on PAN-OS 11.1.3 and later releases. + +## PAN-264281 + +When upgrading a ZTP firewall from PAN-OS 10.1 to PAN-OS 11.1 or later versions, if you use the **To SW Version** column to specify the target PAN-OS version, the upgrade process downloads and installs the intermediary base version containing an expired root certificate. This causes the ZTP firewall to lose connection with Panorama + +**Workaround:** Follow the standard upgrade process from Panorama, which you use for non-ZTP firewalls, to upgrade to the target PAN-OS version that contains the valid root certificate. + +## PAN-260851 + +From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (**Objects** > **Applications**) tag. + +## PAN-229702 + +After upgrading a Panorama HA pair to PAN-OS 11.1, the ElasticSearch connectivity might fail to establish. The issue occurs because the client certificate on one of the Panorama devices does not have the necessary Extended Key Usage (EKU) set for server authentication, which is required for secure TLS communication. + +**Workaround:**Contact Customer Support to renew the root client certificate. + +## PAN-228273 + +On the Panorama management server in FIPS-CC mode, the ElasticSearch cluster fails to come up and the `show log-collector-es-cluster health` command displays the `status` is `red`. This results in log ingestion issues for Panorama in Panorama only or Log Collector mode. + +## PAN-227344 + +On the Panorama management server, PDF Summary Reports (**Monitor** > **PDF Reports** > **Manage PDF Summary**) display no data and are blank when predefined reports are included in the summary report. + +## PAN-223488 + +On the M-600 appliance, closed ElasticSearch shards are not deleted from the M-600 appliance. This causes the ElasticSearch shard purging to not work as expected, resulting in high disk usage. + +## PAN-223365 + +The Panorama management server is unable to query any logs if the ElasticSearch health status for any Log Collector (**Panorama** > **Managed Collector** is degraded. + +**Workaround:** [Log in to the Log Collector CLI](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli) and restart ElasticSearch. + +`admin``debug elasticsearch es-restart all` + +## PAN-217307 + +```caveat +This issue is now resolved. See PAN-OS 10.1.14 Addressed Issues. +``` + +The following Security policy rule (**Policies** > **Security**) filters return no results: + +`log-start eq no` + +`log-end eq no` + +`log-end eq yes` + +## PAN-217307 + +The ElasticSearch process on the M-600 appliance in Log Collector mode may enter a continuous reboot cycle. This results in the M-600 appliance becoming unresponsive, consuming logging disk space, and preventing new log ingestion. + +## PAN-216214 + +For Panorama-managed firewalls in an Active/Active High Availability (HA) configuration where you configure the firewall HA settings (**Device** > **High Availability**) in a template or template stack (**Panorama** > **Templates**), performing a local commit on one of the HA firewalls triggers an HA config sync on the peer firewall. This causes the HA peer configuration to go `Out of Sync`. + +## PAN-213746 + +On the Panorama management server, the **Hostkey** displayed as `undefined undefined` if you override an SSH Service Profile (**Device** > **Certificate Management** > **SSH Service Profile**) Hostkey configured in a Template from the Template Stack. + +## PAN-212889 + +```caveat +This issue is now resolved. See PAN-OS 10.1.11 Addressed Issues. +``` + +On the Panorama management server, different threat names are used when querying the same threat in the Threat Monitor (**Monitor** > **App Scope** > **Threat Monitor**) and **ACC**. This results in the ACC displaying `no data to display` when you are redirected to the ACC after clicking a threat name in the Threat Monitor. + +## PAN-208325 + +```caveat +This issue is now resolved. See PAN-OS 10.1.10 Addressed Issues. +``` + +The following NextGen firewalls are unable to automatically renew the device certificate (**Device** > **Setup** > **Management** or **Panorama** > **Setup** > **Management**). + +- PA-410 Firewall +- PA-440, PA-450, and PA-460 Firewalls +- PA-5450 Firewall + +**Workaround:** Log in to the [firewall CLI](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-cli-quick-start/get-started-with-the-cli/access-the-cli) and fetch the device certificate. + +`admin>``request certificate fetch` + +## PAN-206909 + +The Dedicated Log Collector is unable to reconnect to the Panorama management server if the `configd` process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection `Status` (**Panorama** > **Managed Collector**) displaying `connected` and the managed colletor `Health` status displaying as healthy. + +This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted. + +**Workaround:** Restart the `mgmtsrvr` process on the Dedicated Log Collector. + +1. [Log in to the Dedicated Log Collector CLI](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli). +2. Confirm the Dedicated Log Collector is disconnected from Panorama. + `admin>``show panorama-status` + Verify the `Connected` status is `no`. +3. Restart the `mgmtsrvr` process. + `admin>``debug software restart process management-server` + +## PAN-206268 + +```caveat +This issue is now resolved. See PAN-OS 10.1.10 Addressed Issues. +``` + +On the Panorama management server, the Auth Key field was erroneously displayed when you configure the Panorama Settings (**Device** > **Setup** > **Management**) as part of a template or template stack configuration. + +## PAN-206243 + +The PA-220 firewall reaches the maximum disk usage capacity multiple a day that requires a disk cleanup. A critical system log (**Monitor** > **Logs** > **System**) is generated each time the firewall reaches maximum disk usage capacity. + +## PAN-205187 + +ElasticSearch may not start properly when a newly installed Panorama virtual appliance powers on for the first time, resulting in the Panorama virtual appliance being unable to query logs forwarded from the managed firewall to a Log Collector. + +**Workaround:** [Log in to the Panorama CLI](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli) and start the PAN-OS software. + +`admin>``request restart software` + +## PAN-201855 + +On the Panorama management server, cloning any template (**Panorama** > **Templates**) corrupts certificates (**Device** > **Certificate Management** > **Certificates**) with the **Block Private Key Export** setting enabled across all templates. This results in managed firewalls experiencing issues wherever the corrupted certificate is referenced. + +For example, you have template A, B, and C where templates A and B have certificates with the **Block Private Key Export** setting enabled. Cloning template C corrupts the certificates with **Block Private Key Export** setting enabled in templates A and B. + +**Workaround:** After cloning a template, delete and re-import the corrupted certificates. + +## PAN-199557 + +On M-600 appliances in an Active/Passive high availability (HA) configuration, the `configd` process restarts due to a memory leak on the `Active` Panorama HA peer. This causes the Panorama web interface and CLI to become unresponsive. + +**Workaround:** Manually reboot the `Active` Panorama HA peer. + +## PAN-197341 + +On the Panorama management server, if you create multiple device group **Objects** with the same name in the Shared device group and any additional device groups (**Panorama** > **Device Groups**) under the same device group hierarchy that are used in one or more **Policies**, renaming the object with a shared name in any device group causes the object name to change in the policies where it is used. This issue applies only to device group objects that can be referenced in a Security policy rule. + +For example: + +1. You create a parent device group `DG-A` and a child device group `DG-B`. +2. You create address objects called `AddressObjA` in the `Shared`, `DG-A` and `DG-B` device groups and add `AddressObjA` to a Security policy rule under `DG-A` and `DG-B`. +3. Later, you change the `AddressObjA` name in the `Shared` device group to `AddressObjB`. + +Changing the name of the address object in the `Shared` device group causes the references in the Policy rule to use the renamed `Shared` object instead of the device group object. + +## PAN-196758 + +On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you **Preview Changes** (**Commit** > **Push to Devices** > **Edit Selections** or **Commit** > **Commit and Push** > **Edit Selections**). + +## PAN-194519 + +```caveat +PA-5450 firewall only +``` + +Trying to configure a custom payload format under **Device** > **Server Profiles** > **HTTP** yields a Javascript error. + +## PAN-194515 + +```caveat +PA-5450 firewall only +``` + +The Panorama web interface does not display any predefined template stack variables in the dropdown menu under **Device** > **Setup** > **Log Interface** > **IP Address**. + +**Workaround:** Configure the log interface IP address on the individual firewall web interface instead of on Panorama. + +## PAN-193336 + +All logs (**Monitor** > **Logs**) generated by a firewall running a PAN-OS 10.0 release are not accessible if you downgrade from PAN-OS 10.1 to PAN-OS 10.0, and then upgrade back to PAN-OS 10.1. + +## PAN-192403 + +```caveat +PA-5450 firewall only +``` + +There is no commit warning in the web interface when configuring the management interface and logging interface in the same subnetwork. Having both interfaces in the same subnetwork can cause routing and connectivity issues. + +## PAN-190727 + +```caveat +PA-5450 firewall only +``` + +Documentation for configuring the log interface is unavailable on the web interface and in the PAN-OS Administrator’s Guide. + +## PAN-187685 + +On the Panorama management server, the Template Status displays no synchronization status (**Panorama** > **Managed Devices** > **Summary**) after a bootstrapped firewall is successfully added to Panorama. + +**Workaround:** After the bootstrapped firewall is successfully added to Panorama, [log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) and select **Commit** > **Push to Devices**. + +## PAN-186913 + +On the Panorama management server, **Validate Device Group** (**Commit** > **Commit and Push** erroneously issues a CommitAll operation instead of a ValidateAll operation when multiple device groups are included in the push and results in no configuration validation. + +## PAN-186262 + +The Panorama management server in Panorama or Log Collector mode may become unresponsive as Elasticsearch accumulates internal connections related to logging processes. The chances Panorama becomes unresponsive increases the longer Panorama remains powered on. + +**Workaround:** Reboot Panorama if it becomes unresponsive. + +## PAN-185966 + +The `debug skip-cert-renewal-check-syslog yes` command is not available on Log Collector CLI to stop the Dedicated Log Collector from trying to renew the device certificate and displaying the following error: + +`No valid device certificate found` + +## PAN-180661 + +```caveat +This issue is now resolved. See PAN-OS 10.1.6 Addressed Issues. +``` + +On the Panorama management server, pushing an unsupported Minimum Password Complexity (**Device** > **Setup** > **Management**) to a managed firewall erroneously displays `commit time out` as the reason the commit failed. + +## PAN-188052 + +Devices in FIPS-CC mode are unable to connect to servers utilizing ECDSA-based host keys that impacts exporting logs (**Device** > **Scheduled Log Export**), exporting configurations (**Device** > **Scheduled Config Export**), or the `scp export` command in the CLI. + +**Workaround:** Use RSA-based host keys on the destination server. + +## PAN-185286 + +```caveat +PA-5400 Series firewalls only +``` + +On the Panorama management server, the device health resources (**Panorama** > **Managed Devices** > **Health**) do not populate. + +## PAN-178194 + +```caveat +This issue is now resolved. See PAN-OS 10.1.7 Addressed Issues. +``` + +A UI issue in PAN-OS renders the contents of the **Inline ML** tab in the **URL Filtering Profile** inaccessible on firewalls licensed for Advanced URL Filtering. Additionally, a message indicating that a **License required for URL filtering to function** is unavailable displays at the bottom of the UI. These errors do not affect the operation of Advanced URL Filtering or URL Filtering Inline ML. + +**Workaround:** Configuration settings for URL Filtering Inline ML must be applied through the CLI. The following configuration commands are available: + +- Define URL exceptions for specific web sites— + `admin#``set profiles url-filtering mlav-category-exception` + +- Configuration settings for each inline ML model— + `admin#``set profiles url-filtering mlav-engine-urlbased-enabled` + +## PAN-177363 + +Dedicated Log Collector system and config logs cannot be ingested and are dropped when they are forwarded to a Panorama management server in Management Only mode, resulting in Dedicated Log Collector system and config logs not being viewable on Panorama in Management Only mode. + +## PAN-175717 + +```caveat +This issue is now resolved. See PAN-OS 10.1.5 Addressed Issues +``` + +Firewalls managed by a Panorama management server enter maintenance mode if: + +- Panorama is running PAN-OS 10.2 and managed firewalls are downgraded from PAN-OS 10.2 to PAN-OS 10.1.4 or earlier PAN-OS release. +- Panorama is upgraded from PAN-OS 10.1 to PAN-OS 10.2 and managed firewalls are running PAN-OS 10.1.4 or earlier PAN-OS 10.1 release. + +**Workaround:** When downgrading managed firewalls, downgrade to PAN-OS 10.1.5 first and then continue on your downgrade path. When upgrading Panorama, upgrade to PAN-OS 10.1.5 first and then continue on your upgrade path. + +## PAN-175685 + +```caveat +PA-7000 Series and PA-5450 firewall only +``` + +When the MPC (Management Processor Card) or SMC (Switch Management Card) is removed from one chassis and placed in another, PAN-OS will incorrectly cache and display the chassis serial number of the former chassis. + +## PAN-175149 + +For the PA-220 firewall, and the PA-800 and PA-7000 Series firewalls, the **ACC** and scheduled reports (**Monitor** > **Manage** > **Manage Custom Reports**) erroneously display the IPv6 address instead of the IPv4 address. + +## PAN-174254 + +```caveat +This issue is now resolved. See PAN-OS 10.1.2 Addressed Issues. +``` + +Gateway Load Balancer (GWLB) inspection is disabled on the VM-Series firewall for AWS after a reboot. + +**Workaround:** Enable GWLB inspection. + +## PAN-174094 + +```caveat +This issue has been resolved. See PAN-OS 10.1.1 Addressed Issues. +``` + +SaaS Policy Recommendation does not work on firewalls because the SaaS Security Inline policy recommendation license check fails. When this occurs, the bottom ribbon on **Device** > **Policy Recommendation** > **SaaS** displays the message **SaaS Security license is required for feature to function** in red text. + +On Panorama, the **SaaS Inline Security** column in **Panorama** > **Device Deployment** > **Licenses** shows that the SaaS Security Inline license is not present on the managed firewall. + +**Workaround**: If Panorama manages the firewall, use Panorama to import SaaS policy recommendations and then push them to the firewall. + +## PAN-174004 + +On the Panorama management server, local or Dedicated Log Collector mode cannot successfully join an ElasticSearch cluster when added to a Collector Group (**Panorama** > **Collector Groups**) if the SSH key length for a Log Collector in the cluster is greater than 2048 characters. + +## PAN-173509 + +```caveat +This issue is now resolved. See PAN-OS 10.1.5 Addressed Issues. +``` + +Superuser administrators with read-only privileges (**Device** > **Administrators** and **Panorama** > **Administrators**) are unable to view the hardware ACL blocking setting and duration in the CLI using the commands: + +`admin>``show system setting hardware-acl-blocking-enable` + +`admin>``show system setting hardware-acl-blocking-duration` + +## PAN-172515 + +```caveat +This issue is now resolved. See PAN-OS 10.1.2 Addressed Issues. +``` + +If you downgrade from PAN-OS 10.1 to an earlier version and you have configured the Cloud Authentication Service in an Authentication profile, the firewall does not remove the Cloud Authentication Service from the Authentication profile, displays the authentication method as None, and any subsequent commits are not successful. + +**Workaround:** Delete the Authentication profile that is configured for the Cloud Authentication Service then commit your changes. + +## PAN-172492 + +```caveat +This issue is now resolved. See PAN-OS 10.1.2 Addressed Issues. +``` + +You can create and commit a log forwarding profile (**Objects** > **Log Forwarding**) with an invalid **Filter**. + +## PAN-172454 + +```caveat +This issue is now resolved. See PAN-OS 10.1.2 Addressed Issues. +``` + +If the firewall communicates with the Cloud Identity Engine before you install the device certificate on the firewall or Panorama, all subsequent queries to the Cloud Identity Engine fail. + +**Workaround**: Use the debug software restart process dscd to restart the connection to the Cloud Identity Engine. + +## PAN-172419 + +```caveat +This issue has been resolved. See PAN-OS 10.1.1 Addressed Issues. +``` + +Hot-swapping or hot-plugging a transceiver in the HSCI-A or HSCI-B port on the PA-5450 firewall may cause the device to reboot unexpectedly. + +## PAN-172386 + +```caveat +This issue has been resolved. See PAN-OS 10.1.1 Addressed Issues. +``` + +A Passive PA-5450 firewall in an Active/Passive HA pair will continue to process traffic even if its port(s) are in a Disabled state when the ports do not link up initially due to local or remote faults. + +## PAN-172276 + +```caveat +This issue is now resolved. See PAN-OS 10.1.2 Addressed Issues. +``` + +Changing the port speed on a PA-400 Series firewall from auto-negotiate to 1G may cause the dataplane port to flap intermittently and result in a loss of traffic. + +## PAN-172274 + +When you activate the advanced URL filtering license, your license entitlements for PAN-DB and advanced URL filtering might not display correctly on the firewall — this is a display anomaly, not a licensing issue, and does not affect access to the services. + +**Workaround:** Issue the following command to retrieve and update the licenses: `license request fetch`. + +## PAN-172113 + +If you request a User Activity Report on Panorama and the vsys key value in the XML is an unsupported value, the resulting job becomes unresponsive at 10% and does not complete until you manually stop the job in the web interface. + +**Workaround:**Change the vsys key to a valid device group, commit your changes, and run the User Activity Report again. + +## PAN-172091 + +If you have configured a virtual system as a User-ID hub and a firewall that receives IP address-to-username mapping from the hub has a security policy that includes a QoS policy rule, the firewall does not match the user to the QoS policy rule if the traffic attempts to access a virtual system that is not the hub. + +## PAN-172208 + +```caveat +This issue is now resolved. See PAN-OS 10.1.3 Addressed Issues. +``` + +The PA-5450 firewall may reload in rare conditions while handling high stress SSL traffic when CPU utilization reaches 100% or packet broker capacity exceeds 40%. + +## PAN-172171 + +In an HA Active/Passive configuration using Auto mode, a Passive PA-5450 firewall under traffic stress can get stuck in maintenance mode after receiving the `slot7-path_monitor Path monitor failure` service failure. + +**Workaround:** Use Active/Passive Shutdown mode instead of Auto mode. + +## PAN-172132 + +```caveat +This issue is now resolved by PAN-189643. See PAN-OS 10.1.6 Addressed Issues. +``` + +QoS fails to run on a tunnel interface (for example, tunnel.1). + +## PAN-172067 + +When you configure a HTTP server profile (**Device** > **Server Profiles** > **HTTP** or **Panorama** > **Server Profiles** > **HTTP**), the **Username** and **Password** fields are always required regardless of whether **Tag Registration** is enabled. + +**Workaround:** When you configure an HTTP server profile, always enter a username and password to successfully create the HTTP server profile. + +You must enter a username and password even if the HTTP server does not require it. The HTTP server ignores the username and password if they are not required for the firewall to connect. + +## PAN-172061 + +A process (allpktproc) can cause intermittent crashes on the Passive PA-5450 firewall in an Active/Passive HA pair. This issue may be seen during an upgrade or reload of the firewall with traffic and when clearing sessions. + +## PAN-164707 + +```caveat +This issue is now resolved. See PAN-OS 10.1.1 Addressed Issues. +``` + +For PA-7000 Series Legacy firewalls, you are unable to view logs (**Monitor**) on the web interface or in the CLI (`show log `) + +**Workaround:** [Log in to the firewall CLI](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-cli-quick-start/get-started-with-the-cli/access-the-cli.html) and restart the vldmgr process. + +`admin>``debug software restart process vldmgr` + +## PAN-171938 + +No results are displayed when you **Show Application Filter** for a Security policy rule (**Policies** > **Security** > **Application** > **Value** > **Show Application Filter**). + +## PAN-171898 + +```caveat +This issue has been resolved. See PAN-OS 10.1.1 Addressed Issues. +``` + +PA-5450 firewalls may not get full 10G throughput when traffic is sent from 100G/40G interfaces to 10G interfaces. + +## PAN-171839 + +The Enable Bonjour Reflector option under **Network** > **Interfaces** > **Layer 3 Interface** > **IPv4** is not supported on the PA-5450 firewall. + +## PAN-171750 + +```caveat +This issue has been resolved. See PAN-OS 10.1.1 Addressed Issues. +``` + +The PA-5450 firewall's HSCI interface does not recognize a hot-swapped 40G or 100G transceiver. + +**Workaround:** Power down the firewall before removing and installing a 40G or 100G transceiver. After the transceiver is installed, power on the firewall. + +## PAN-171744 + +```caveat +This issue is now resolved. See PAN-OS 10.1.2 Addressed Issues. +``` + +No data is displayed for the Forward Error Correction (FEC) plot for SD-WAN application performance (**Panorama** > **SD-WAN** > **Monitoring**). + +## PAN-171723 + +If you use Panorama to push a configuration that uses App-ID Cloud Engine (ACE) App-IDs and then you downgrade the firewall from PAN-OS 10.1 to PAN-OS 10.0, the installation succeeds but after you reboot, the auto-commit fails. + +**Workaround:** Remove all ACE application configurations before downgrading. + +## PAN-171714 + +```caveat +This issue is now resolved. See PAN-OS 10.1.7 Addressed Issues. +``` + +If you use the NetBIOS format (`domain\user`) for the IP address-to-username mapping and the firewall receives the group mapping information from the Cloud Identity Engine, the firewall does not successfully match the user to the correct group. + +## PAN-171706 + +```caveat +This issue is now resolved. See PAN-OS 10.1.11 Addressed Issues. +``` + +If you are using Panorama to manage firewalls with multiple virtual systems and the virtual system that is the User-ID hub uses an alias, the local commit on Panorama is successful but the commit to the firewall fails. + +## PAN-171703 + +On the Panorama management server, the GlobalProtect Activity widget (**ACC** > **GlobalProtect Activity**) and GlobalProtect logs (**Monitor** > **Logs** > **GlobalProtect**) do not display if a **Device Group** is selected. + +**Workaround:** Select the **All** device group to view the GlobalProtect Activity widget and GlobalProtect logs. + +## PAN-171673 + +On the Panorama management server, the **ACC** returns inaccurate results when you filter for **New App-ID** in the **Application** usage widget. + +## PAN-171635 + +If you have an on-premise Active Directory and there is an existing group mapping configuration on the firewall, if you migrate the group mapping to the Cloud Identity Engine, the firewall does not remove the existing group mapping even if the configuration is disabled and the firewall is rebooted, which may conflict with new mappings from the Cloud Identity Engine. + +**Workaround**: Use the debug user-id clear domain-map command to remove the existing group mappings from the firewall. + +## PAN-171224 + +On the Panorama management server, a custom report (**Monitor** > **Managed Custom Reports**) with a high volume of unique data objects is not generated when you click **Run Now**. + +## PAN-171145 + +If you edit or remove the value for the `mail` attribute in your on-premise Active Directory, the changes may not be immediately reflected on the firewall after it syncs with the Cloud Identity Engine. + +## PAN-171127 + +```caveat +This issue is now resolved. See PAN-OS 10.1.4 Addressed Issues +``` + +On the Panorama management server, custom reports (**Monitor** > **Manage Custom Reports**) for the **Device Application Statistics** and **Device Traffic Summary** databases display `null` for the Application fields. + +## PAN-171069 + +Local Log Collectors for Panorama management servers in active/passive high availability (HA) configuration cannot be added to the same Collector Group (**Panorama** > **Collector Groups**). + +**Workaround:** Before you upgrade your Panorama servers to PAN-OS 10.1.0, configure HA (**Panorama** > **High Availability**), add the local Log Collectors of the HA peers to the same Collector Group, and upgrade to PAN 10.1.0. + +## PAN-170923 + +In **Policies** > **Security** > **Policy Optimizer** > **New App Viewer**, when you select a Security policy rule in the bottom portion of the screen, the application data in the application browser (top portion of screen) does not match the Apps Seen on the selected rule. In addition, filtering in the application browser based on Apps Seen does not work. + +## PAN-170473 + +```caveat +This issue has been resolved. See PAN-OS 10.1.1 Addressed Issues. +``` + +SSL traffic is not decrypted on inbound inspection when the private key is using a hardware security module (HSM). + +## PAN-170462 + +```caveat +This issue is now resolved. See PAN-OS 10.1.6 Addressed Issues. +``` + +SaaS applications downloaded from the App-ID Cloud Engine (ACE) do not appear in daily application reports (**Monitor** > **Reports** > **Application Reports**) or in the **Application** column of the **Application Usage** widget in **ACC** > **Network Activity**. + +## PAN-170270 + +Using the CLI to power on a PA-5450 Networking Card (NC) in an Active HA firewall can cause its Passive peer to temporarily go down. + +## PAN-170174 + +```caveat +This issue has been resolved. See PAN-OS 10.1.1 Addressed Issues. +``` + +A CN-NGFW pod might incorrectly restart multiple times after bring up due to eth0 being unavailable when kubelet runs network checks on eth0. The following error is seen in the DP node journalctl logs: "failed to read pod IP from plugin/docker: networkPlugin cni failed on the status hook for pod "pan-ngfw-dep-<>_kube-system": unexpected address output". + +**Workaround**: Redeploy the CN-NGFW pod + +## PAN-169906 + +The CN-Series Firewall as a Kubernetes Service does not support AF_XDP when deployed in CentOS. + +## PAN-169433 + +On the Panorama management server, clicking **Run Now** for a custom report (**Monitor** > **Manage Custom Reports**) with 32 or more filters in the Query Builder returns the result `No matching records` + +## PAN-168920 + +```caveat +This issue has been resolved. See PAN-OS 10.1.1 Addressed Issues. +``` + +On a PA-5450 firewall, QoS does not honor the guaranteed bandwidth for classes set to a Priority of real-time. + +## PAN-168636 + +Connecting to the App-ID Cloud Engine (ACE) cloud using a management port with explicit proxy configured on it is not supported. Instead, use a data plane interface for the service route ([Prepare to Deploy App-ID Cloud Engine](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/app-id/cloud-based-app-id-service/prepare-to-deploy-app-id-cloud-engine.html) describes how to do this.) + +## PAN-168113 + +On the Panorama management server, you are unable to configure a master key (**Device** > **Master Key and Diagnostics**) for a managed firewall if an interface (**Network** > **Interfaces** > **Ethernet**) references a zone pushed from Panorama. + +**Workaround:** Remove the referenced zone from the interface configuration to successfully configure a master key. + +## PAN-167847 + +If you issue the command `opof stats`, then clear the results {opof stats -c}, the Active Sessions value is sometimes invalid. For example, you might see a negative number or an excessively large number. + +**Workaround:** Re-run the `opof stats` command after the offload completes. + +## PAN-167401 + +When a firewall or Panorama appliance configured with a proxy is upgraded to PAN-OS 10.0.3 or a later release, it fails to connect to edge service. + +## PAN-166464 + +```caveat +This issue is now resolved. See PAN-OS 10.1.6-h6 Addressed Issues. +``` + +PAN-OS reports the PA-5450 fan numbers incorrectly by listing them in the opposite order. This does not affect fan operation. For further information, contact Customer Support. + +## PAN-166398 + +```caveat +This issue is now resolved. See PAN-OS 10.1.1 Addressed Issues. +``` + +On PA-5450 Next-Generation firewalls, when you configure path or latency monitoring on the Health Monitor tab in the Packet Broker profile (**Objects** > **Packet Broker**), after a firewall restart, the path health monitor may be disabled due to a configuration synchronization issue, so the firewall may not be aware of path failures. + +**Workaround:** Change the health monitoring configuration and commit the change to prevent this issue from occurring. + +## PAN-165669 + +If you configure a group that the firewall retrieves from the Cloud Identity Engine as the `user in` value in a filter query, Panorama is unable to retrieve the group membership and as a result, is unable to display this data in logs and custom reports. + +## PAN-165225 + +There is an issue where `hwpredict` is enabled by default, and you have to disable it via the CLI. + +## PAN-164922 + +On the Panorama management server, a context switch to a managed firewall running a PAN-OS 8.1.0 to 8.1.19 release fails. + +## PAN-164885 + +```caveat +This issue is now resolved. See PAN-OS 10.1.14-h6 Addressed Issues +``` + +On the Panorama management server, pushes to managed firewalls (**Commit** > **Push to Devices** or **Commit and Push**) may fail when an EDL (**Objects** > **External Dynamic Lists**) is configured to **Check for updates** every 5 minutes due to the commit and EDL fetch processes overlapping. This is more likely to occur when multiple EDLs are configured to check for updates every 5 minutes. + +## PAN-164841 + +A successful deployment of a Panorama virtual appliance on Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Product (GCP) is inaccessible when deploying using the PAN-OS 10.1.0-b6 release. + +## PAN-164647 + +On the Panorama management server, activating a license (**Panorama** > **Device Deployment** > **Licenses**) on managed firewalls in a high availability (HA) configuration causes the Safari web browser to become unresponsive. + +**Workaround:** [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) from a web browser other than Safari to successfully activate a license on managed firewalls in an HA configuration. + +## PAN-164586 + +If you use a value other than `mail` for the user or group email attribute in the Cloud Identity Engine, it displays in `user@domain` format in the CLI output. + +## PAN-163966 + +On the Panorama management server, the **ACC** and on demand reports (**Monitor** > **Manage Custom Reports**) are unable to fetch Directory Sync group membership when the Source User Group filter query is applied, resulting in no data being displayed for the filter when Directory Sync is configured as the Source User for a policy rule. + +## PAN-163676 + +Next-Gen Firewalls are unable to connect to a syslog server when the certificates required to connect to the syslog server are part of a Certificate Profile (**Device** > **Certificate Management** > **Certificate Profile**) if the **Use OCSP** setting is enabled to check the revocation status of certificates. + +**Workaround:** Enable **Use CRL** to check the revocation status of certificates in the Certificate Profile. + +## PAN-162836 + +On the VM-Series firewall, if you select **Device** > **Licenses** > **Deactivate VM** a popup window opens and you can choose **Subscriptions** or **Support** and press **Continue** to remove licenses and register the changes with the license server. When the license removal is complete the **Deactivate VM** window does not update its text to exclude deactivated licenses or close the window. + +**Workaround**: Wait until the license deactivation is complete, and click **Cancel** to close the window. + +## PAN-162164 + +```caveat +This issue is now resolved. See PAN-OS 10.1.6 Addressed Issues. +``` + +When upgrading a multi-dataplane firewall from PAN-OS 10.0 to 10.1, if the configuration includes the DHCP Broadcast Session option enabled, the commit fails. Auto-commit is not affected. + +**Workaround:**Load the configuration from running config (load config from running-config.xml) and perform a commit. + +## PAN-162088 + +```caveat +This issue is now resolved. See PAN-OS 10.1.9 Addressed Issues. +``` + +On the Panorama management server in a high availability (HA) configuration, content updates (**Panorama** > **Dynamic Updates**) manually uploaded to the active HA peer are not synchronized to the passive HA peer when you **Install** a content update and enable **Sync to HA Peer**. + +## PAN-161666 + +The firewall includes any users configured in the Cloud Identity Engine in the count of groups. As a result, some CLI command output does not accurately display the number of groups the firewall has retrieved from the Cloud Identity Engine and counts users as groups in the `No. of Groups` in the command output. If the attempt to retrieve the user or group fails, the information for the user or group still displays in the CLI command output. + +## PAN-161451 + +If you issue the command `opof stats`, there are occasional zero packet and byte counts coming from the DPDK counters. This occurs when a session is in the tcp-reuse state, and has no impact on the existing session. + +## PAN-160238 + +If you migrate traffic from a firewall running a PAN-OS version earlier than 9.0 to a firewall running PAN-OS 9.0 or later, you experience intermittent VXLAN packet drops if TCI policy is not configured for inspecting VXLAN traffic flows. + +**Workaround:**On the new firewall, create an app override for VXLAN outer headers as described in [What is an Application Override?](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVLCA0) and the video tutorial [How to Configure an Application Override Policy on the Palo Alto Networks Firewall](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PPDrCAO). + +PAN-OS version 9.0 can inspect both inner and outer VXLAN flows. If you want to inspect inner flows, you must define a tunnel content inspection (TCI) policy. + +## PAN-157444 + +As a result of a telemetry handling update, the Source Zone field in the DNS analytics logs (viewable in the DNS Analytics tab within AutoFocus) might not display correct results. + +## PAN-157327 + +On downgrade to PAN-OS 9.1, Enterprise Data Loss Prevention (DLP) filtering settings (**Device** > **Setup** > **DLP**) are not removed and cause commit errors for the downgraded firewall if you do not uninstall the Enterprise DLP plugin before downgrade. + +**Workaround:** After you successfully downgrade a managed firewall to PAN-OS 9.1, commit and push from Panorama to remove the Enterprise DLP filtering settings and complete the downgrade. + +1. Downgrade your managed firewall to PAN-OS 9.1 +2. Log in to the firewall web interface and view the **Tasks** to verify all auto commits related to the downgrade have completed successfully. +3. Log in to the Panorama web interface and **Commit** > **Commit and Push** to your managed firewall downgraded to PAN-OS 9.1. + +## PAN-157103 + +Multi-channel functionality may not be properly utilized on an VM-Series firewall deployed in VMware NSX-V after the service is first deployed. + +**Workaround**: Execute the command `debug dataplane pow status` to view the number of channels being utilized by the dataplane. + +Per pan-task Netx statisticsCounter Name 1 2 3 4 5 6 Total---------------------------------------------ready_dvf 2 0 0 0 0 0 2 + +If multi-channel functionality is not working, disable your NSX-V security policy and reapply it. Then reboot the VM-Series firewall. When the firewall is back up, verify that multi-channel functionality is working by executing the command `debug dataplane pow status`. It should now show multiple channels being utilized. + +Per pan-task Netx statisticsCounter Name 1 2 3 4 5 6 Total---------------------------------------------ready_dvf 1 1 0 0 0 0 2 + +## PAN-156598 + +```caveat +Panorama only +``` + +If you configure a standard custom vulnerability signature in a custom Vulnerability Protection profile in a shared device group, the shared profile custom signatures do not populate in the other device groups when you configure a combination custom vulnerability signature. + +**Workaround:** Use the CLI to update the combination signature. + +## PAN-154292 + +On the Panorama management server, downgrading from a PAN-OS 10.0 release to a PAN-OS 9.1 release causes Panorama commit (**Commit** > **Commit to Panorama**) failures if a custom report (**Monitor** > **Manage Custom Reports**) is configured to Group By **Session ID**. + +**Workaround:** After successful downgrade, reconfigure the Group By setting in the custom report. + +## PAN-154053 + +```caveat +This issue has been resolved. See PAN-OS 10.1.1 Addressed Issues. +``` + +If two or more PA-5450 fan assemblies fail, the firewall shuts down without providing a console or CLI error message about the fan failure. + +## PAN-154034 + +On the Panorama management server, the Type column in the System logs (**Monitor** > **Logs** > **System**) for managed firewalls running a PAN-OS 9.1 release erroneously display `iot` as the type. + +## PAN-154032 + +On the Panorama management server, downgrading to PAN-OS 9.1 with the Panorama plugin for Cisco TrustSec version 1.0.2 installed does not automatically transform the plugin to be compatible with PAN-OS 9.1 + +**Workaround:** After successful downgrade to PAN-OS 9.1, **Remove Config** (**Panorama** > **Plugins**) of the Panorama plugin for Cisco TrustSec and then reconfigure the plugin. + +## PAN-153803 + +On the Panorama management server, scheduled email PDF reports (**Monitor** > **PDF Reports**) fail if a GIF image is used in the header or footer. + +## PAN-153557 + +On the Panorama management server CLI, the overall report status for a report query is marked as `Done` despite reports generated from logs in the Strata Logging Service from the PODamericas Collector Group jobs are still in a `Running` state. + +## PAN-153068 + +The Bonjour Reflector option is supported on up to 16 interfaces. If you enable it on more than 16 interfaces, the commit succeeds and the Bonjour Reflector option is enabled only for the first 16 interfaces and ignored for any additional interfaces. + +## PAN-151238 + +There is a known issue where M-100 appliances are able to download and install a PAN-OS 10.0 release image even though the M-100 appliance is no longer supported after PAN-OS 9.1. (Refer to the [hardware end-of-life dates](https://www.paloaltonetworks.com/services/support/end-of-life-announcements/hardware-end-of-life-dates.html).) + +## PAN-151085 + +On a PA-7000 Series firewall chassis having multiple slots, when HA clustering is enabled on an active/active HA pair, the session table count for one of the peers can show a higher count than the actual number of active sessions on that peer. This behavior can be seen when the session is being set up on a non-cache slot (for example, when a session distribution policy is set to round-robin or session-load); it is caused by the additional cache lookup that happens when HA cluster participation is enabled. + +## PAN-150801 + +Automatic quarantine of a device based on forwarding profile or log setting does not work on the PA-7000 Series firewalls. + +## PAN-150515 + +After you install the device certificate on a new Panorama management server, Panorama is not able to connect to the IoT Security edge service. + +**Workaround:** Restart Panorama to connect to the IoT Security edge service. + +## PAN-150345 + +During updates to the Device Dictionary, the IoT Security service does not push new Device-ID attributes (such as new device profiles) to the firewall until a manual commit occurs. + +**Workaround:** Perform a force commit to push the attributes in the content update to the firewall. + +## PAN-150361 + +In an Active-Passive high availability (HA) configuration, an error displays if you create a device object on the passive device. + +**Workaround:** Load the running configuration and perform a force commit to sync the devices. + +## PAN-148971 + +If you enter a search term for Events that are related to IoT in the System logs and apply the filter, the page displays an `Invalid term` error. + +**Workaround:** Specify `iot` as the **Type Attribute** to filter the logs and use the search term as the **Description Attribute**. For example: `( subtype eq iot ) and ( description contains 'gRPC connection' )`. + +## PAN-148924 + +In an active-passive HA configuration, tags for dynamic user groups are not persistent after rebooting the firewall because the active firewall does not sync the tags to the passive firewall during failover. + +## PAN-146995 + +After downgrading a Panorama management server from PAN-OS 10.0 to PAN-OS 9.1, the `VLD` and `logd` processes may crash when Panorama reboots. + +**Workaround:** Panorama automatically restarts the `VLD` and `logd` processes. + +## PAN-146807 + +Changing the device group configured in a monitoring definition from a child DG to a parent DG, or vice versa, might cause firewalls configured in the child DG to lose IP tag mapping information received from the monitoring definition. Only firewalls assigned to the parent DG receive IP tag mapping updates. + +**Workaround**: Perform a manual config sync on the device group that lost the IP tag mapping information. + +## PAN-146485 + +On the Panorama management server, adding, deleting, or modifying the upstream NAT configuration (**Panorama** > **SD-WAN** > **Devices**) does not display the branch template stack as `out of sync`. + +Additionally, adding, deleting, or modifying the BGP configuration (**Panorama** > **SD-WAN** > **Devices**) does not display the hub and branch template stacks as `out of sync`. For example, modifying the BGP configuration on the branch firewall does not cause the hub template stack to display as `out of sync`, nor does modifying the BGP configuration on the hub firewall cause the branch template stack as `out of sync`. + +**Workaround:** After performing a configuration change, **Commit and Push** the configuration changes to all hub and branch firewalls in the VPN cluster containing the firewall with the modified configuration. + +## PAN-145460 + +CN-MGMT pods fail to connect to the Panorama management server when using the Kubernetes plugin. + +**Workaround:** **Commit** the Panorama configuration after the CN-MGMT pod successfully registers with Panorama. + +## PAN-144889 + +On the Panorama management server, adding, deleting, or modifying the original subnet IP, or adding a new subnet after you successfully configure a tunnel IP subnet, for the SD-WAN 1.0.2 plugin does not display the managed firewall templates (**Panorama** > **Managed Devices** > **Summary**) as `Out of Sync`. + +**Workaround**: When modifying the original subnet IP, or adding a new subnet, push the template configuration changes to your managed firewalls and **Force Template Values** (**Commit** > **Push to Devices** > **Edit Selections**). + +## PAN-143132 + +Fetching the device certificate from the Palo Alto Networks Customer Support Portal (CSP) may fail and displays the following error in the CLI: + +`ERROR Failed to process S1C msg: Error` + +**Workaround:** Retrying fetching the device certificate from the Palo Alto Networks CSP. + +## PAN-141630 + +Current performance limitation: single data plane use only. The PA-5200 Series and PA-7000 Series firewalls that support 5G network slice security, 5G equipment ID security, and 5G subscriber ID security use a single data plane only, which currently limits the firewall performance. + +## PAN-140959 + +The Panorama management server allows you to downgrade Zero Touch Provisioning (ZTP) firewalls to PAN-OS 9.1.2 and earlier releases where ZTP functionality is not supported. + +## PAN-140008 + +ElasticSearch is forced to restart when the `masterd` process misses too many heartbeat messages on the Panorama management server resulting in a delay in a log query and ingestion. + +## PAN-136763 + +On the Panorama management server, managed firewalls display as `disconnected` when installing a PAN-OS software update (**Panorama** > **Device Deployment** > **Software**) but display as `connected` when you view your managed firewalls Summary (**Panorama** > **Managed Devices** > **Summary**) and from the CLI. + +**Workaround:** Log out and log back in to the Panorama web interface. + +## PAN-135742 + +There is an issue in HTTP2 session decryption where the App-ID in the decryption log is the App-ID of the parent session (which is web-browsing). + +## PAN-134053 + +ACC does not filter WildFire logs from Dynamic User Groups. + +## PAN-132598 + +The Panorama management server does not check for duplicate addresses in address groups (**Objects** > **Address Groups**) and duplicate services in service groups (**Objects** > **Service Groups**) when created from the CLI. + +## PAN-130550 + +```caveat +PA-3200 Series, PA-5220, PA-5250, PA-5260, and PA-7000 Series firewalls +``` + +For traffic between virtual systems (inter-vsys traffic), the firewall cannot perform source NAT using dynamic IP (DIP) address translation. + +**Workaround:** Use source NAT with Dynamic IP and Port (DIPP) translation on inter-vsys traffic. + +## PAN-127813 + +In the current release, SD-WAN auto-provisioning configures hubs and branches in a hub and spoke model, where branches don’t communicate with each other. Expected branch routes are for generic prefixes, which can be configured in the hub and advertised to all branches. Branches with unique prefixes are not published up to the hub. + +**Workaround:** Add any specific prefixes for branches to the hub advertise-list configuration. + +## PAN-127206 + +If you use the CLI to enable the cleartext option for the Include Username in HTTP Header Insertion Entries feature, the authentication request to the firewall may become unresponsive or time out. + +## PAN-123277 + +Dynamic tags from other sources are accessible using the CLI but do not display on the Panorama web interface. + +## PAN-123040 + +When you try to view network QoS statistics on an SD-WAN branch or hub, the QoS statistics and the hit count for the QoS rules don’t display. A workaround exists for this issue. Please contact Support for information about the workaround. + +## PAN-120440 + +There is an issue on M-500 Panorama management servers where any ethernet interface with an IPv6 address having Private PAN-DB-URL connectivity only supports the following format: `2001:DB9:85A3:0:0:8A2E:370:2`. + +## PAN-120423 + +PAN-OS 10.0.0 does not support the XML API for GlobalProtect logs. + +## PAN-120303 + +There is an issue where the firewall remains connected to the PAN-DB-URL server through the old management IP address on the M-500 Panorama management server, even when you configured the Eth1/1 interface. + +**Workaround:** Update the PAN-DB-URL IP address on the firewall using one of the methods below. + +- Modify the PAN-DB Server IP address on the managed firewall. + 1. On the web interface, delete the **PAN-DB Server** IP address (**Device** > **Setup** > **Content ID** > **URL Filtering** settings). + 2. **Commit** your changes. + 3. Add the new M-500 Eth1/1 IP PAN-DB IP address. + 4. **Commit** your changes. +- Restart the firewall (devsrvr) process. + 1. Log in to the firewall CLI. + 2. Restart the devsrvr process: `debug software restart process device-server` + +## PAN-116017 + +```caveat +Google Cloud Platform (GCP) only +``` + +The firewall does not accept the DNS value from the initial configuration (init-cfg) file when you bootstrap the firewall. + +**Workaround:** Add DNS value as part of the bootstrap.xml in the bootstrap folder and complete the bootstrap process. + +## PAN-115816 + +```caveat +Microsoft Azure only +``` + +There is an intermittent issue where an Ethernet (eth1) interface does not come up when you first boot up the firewall. + +**Workaround:** Reboot the firewall. + +## PAN-114495 + +Alibaba Cloud runs on a KVM hypervisor and supports two Virtio modes: DPDK (default) and MMAP. If you deploy a VM-Series firewall running PAN-OS 9.0 in DPDK packet mode and you then switch to MMAP packet mode, the VM-Series firewall duplicates packets that originate from or terminate on the firewall. As an example, if a load balancer or a server behind the firewall pings the VM-Series firewall after you switch from DPDK packet mode to MMAP packet mode, the firewall duplicates the ping packets. + +Throughput traffic is not duplicated if you deploy the VM-Series firewall using MMAP packet mode. + +## PAN-112694 + +```caveat +Firewalls with multiple virtual systems only +``` + +If you configure dynamic DNS (DDNS) on a new interface (associated with vsys1 or another virtual system) and you then create a **New** Certificate Profile from the drop-down, you must set the location for the Certificate Profile to Shared. If you configure DDNS on an existing interface and then create a new Certificate Profile, we also recommend that you choose the Shared location instead of a specific virtual system. Alternatively, you can select a preexisting certificate profile instead of creating a new one. + +## PAN-112456 + +You can temporarily submit a change request for a URL Category with three suggested categories; however, only two categories are supported. Do not add more than two suggested categories to a change request until we address this issue. If you submit more than two suggested categories, only the first two categories in the change request are evaluated. + +## PAN-112135 + +You cannot unregister tags for a subnet or range in a dynamic address group from the web interface. + +**Workaround:** Use an XML API request to unregister the tags for the subnet or range. + +## PAN-111928 + +Invalid configuration errors are not displayed as expected when you revert a Panorama management server configuration. + +**Workaround:** After you revert the Panorama configuration, **Commit** (**Commit** > **Commit to Panorama**) the reverted configuration to display the invalid configuration errors. + +## PAN-111866 + +The push scope selection on the Panorama web interface displays incorrectly even though the commit scope displays as expected. This issue occurs when one administrator makes configuration changes to separate device groups or templates that affect multiple firewalls and a different administrator attempts to push those changes. + +**Workaround:** Perform one of the following tasks. + +- Initiate a **Commit to Panorama** operation followed by a **Push to Devices** operation for the modified device group and template configurations. +- Manually select the devices that belong to the modified device group and template configurations. + +## PAN-111729 + +If you disable DPDK mode and enable it again, you must immediately reboot the firewall. + +## PAN-111670 + +Tagged VLAN traffic fails when sent through an SR-IOV adapter. + +## PAN-110794 + +DGA-based threats shown in the firewall threat log display the same name for all such instances. + +## PAN-109759 + +```caveat +This issue is now resolved. See PAN-OS 10.1.2 Addressed Issues +``` + +The firewall does not generate a notification for the GlobalProtect client when the firewall denies an unencrypted TLS session due to an authentication policy match. + +## PAN-109526 + +The system log does not correctly display the URL for CRL files; instead, the URLs are displayed with encoded characters. + +## PAN-104780 + +If you configure a HIP object to match only when a connecting endpoint is managed (**Objects** > **GlobalProtect** > **HIP Objects** > **** > **General** > **Managed**), iOS and Android endpoints that are managed by AirWatch are unable to successfully match the HIP object and the HIP report incorrectly indicates that these endpoints are not managed. This issue occurs because GlobalProtect gateways cannot correctly identify the managed status of these endpoints. + +Additionally, iOS endpoints that are managed by AirWatch are unable to match HIP objects based on the endpoint serial number because GlobalProtect gateways cannot identify the serial numbers of these endpoints; these serial numbers do not appear in the HIP report. + +## PAN-103276 + +Adding a disk to a virtual appliance running Panorama 8.1 or a later release on VMware ESXi 6.5 update1 causes the Panorama virtual appliance and host web client to become unresponsive. + +**Workaround:** Upgrade the ESXi host to ESXi 6.5 update2 and add the disk again. + +## PAN-101688 + +```caveat +Panorama plugins +``` + +The IP address-to-tag mapping information registered on a firewall or virtual system is not deleted when you remove the firewall or virtual system from a Device Group. + +**Workaround:** Log in to the CLI on the firewall and enter the following command to unregister the IP address-to-tag mappings: `debug object registered-ip clear all`. + +## PAN-101537 + +After you configure and push address and address group objects in Shared and vsys-specific device groups from the Panorama management server to managed firewalls, executing the `show log direction equal | in ` command on a managed firewall only returns address and address group objects pushed form the Shared device group. + +**Workaround:** Specify the vsys in the query string: + +`admin>` `set system target-vsys ` + +`admin>` `show log direction equal query equal ‘vsys eq ’ | in ` + +## PAN-98520 + +When booting or rebooting a PA-7000 Series Firewall with the SMC-B installed, the BIOS console output displays attempts to connect to the card's controller in the System Memory Speed section. The messages can be ignored. + +## PAN-97757 + +GlobalProtect authentication fails with an `Invalid username/password` error (because the user is not found in **Allow List**) after you enable GlobalProtect authentication cookies and add a RADIUS group to the **Allow List** of the authentication profile used to authenticate to GlobalProtect. + +**Workaround:** Disable GlobalProtect authentication cookies. Alternatively, disable (clear) **Retrieve user group from RADIUS** in the authentication profile and configure group mapping from Active Directory (AD) through LDAP. + +## PAN-97524 + +```caveat +Panorama management server only +``` + +The Security Zone and Virtual System columns (**Network** tab) display `None` after a Device Group and Template administrator with read-only privileges performs a context switch. + +## PAN-96446 + +A firewall that is not included in a Collector Group fails to generate a system log if logs are dropped when forwarded to a Panorama management server that is running in Management Only mode. + +## PAN-95773 + +On VM-Series firewalls that have Data Plane Development Kit (DPDK) enabled and that use the i40e network interface card (NIC), the `show session info` CLI command displays an inaccurate throughput and packet rate. + +**Workaround:** Disable DPDK by running the `set system setting dpdk-pkt-io off` CLI command. + +## PAN-95028 + +For administrator accounts that you created in PAN-OS 8.0.8 and earlier releases, the firewall does not apply password profile settings (**Device** > **Password Profiles**) until after you upgrade to PAN-OS 8.0.9 or a later release and then only after you modify the account passwords. (Administrator accounts that you create in PAN-OS 8.0.9 or a later release do not require you to change the passwords to apply password profile settings.) + +## PAN-94846 + +When DPDK is enabled on the VM-Series firewall with i40e virtual function (VF) driver, the VF does not detect the link status of the physical link. The VF link status remains up, regardless of changes to the physical link state. + +## PAN-94093 + +HTTP Header Insertion does not work when jumbo frames are received out of order. + +## PAN-93968 + +The firewall and Panorama web interfaces display vulnerability threat IDs that are not available in PAN-OS 9.0 releases (**Objects** > **Security Profiles** > **Vulnerability Protection** > **** > **Exceptions**). To confirm whether a particular threat ID is available in your release, monitor the release notes for each new Applications and Threats content update or check the Palo Alto Networks [Threat Vault](https://threatvault.paloaltonetworks.com) to see the minimum PAN-OS release version for a threat signature. + +## PAN-93607 + +When you configure a VM-500 firewall with an SCTP Protection profile (**Objects** > **Security Profiles** > **SCTP Protection**) and you try to add the profile to an existing Security Profile Group (**Objects** > **Security Profile Groups**), the Security Profile Group doesn’t list the SCTP Protection profile in its drop-down list of available profiles. + +**Workaround:** Create a new Security Profile Group and select the SCTP Protection profile from there. + +## PAN-93532 + +When you configure a firewall running PAN-OS 9.0 as an nCipher HSM client, the web interface on the firewall displays the nCipher server status as Not Authenticated, even though the HSM state is up (**Device** > **Setup** > **HSM**). + +## PAN-93193 + +The memory-optimized VM-50 Lite intermittently performs slowly and stops processing traffic when memory utilization is critically high. To prevent this issue, make sure that you do not: + +- Switch to the firewall **Context** on the Panorama management server. +- Commit changes when a dynamic update is being installed. +- Generate a custom report when a dynamic update is being installed. +- Generate custom reports during a commit. + +**Workaround:** When the firewall performs slowly, or you see a critical System log for memory utilization, wait for 5 minutes and then manually reboot the firewall. + +Use the Task Manager to verify that you are not performing memory intensive tasks such as installing dynamic updates, committing changes or generating reports, at the same time, on the firewall. + +## PAN-91802 + +On a VM-Series firewall, the **clear session all** CLI command does not clear GTP sessions. + +## PAN-83610 + +In rare cases, a PA-5200 Series firewall (with an FE100 network processor) that has session offload enabled (default) incorrectly resets the UDP checksum of outgoing UDP packets. + +**Workaround:** In PAN-OS 8.0.6 and later releases, you can persistently disable session offload for only UDP traffic using the `set session udp-off load no` CLI command. + +## PAN-83236 + +The VM-Series firewall on Google Compute Platform does not publish firewall metrics to Google Stack Monitoring when you manually configure a DNS server IP address (**Device** > **Setup** > **Services**). + +**Workaround:** The VM-Series firewall on Google Cloud Platform must use the DNS server that Google provides. + +## PAN-83215 + +SSL decryption based on ECDSA certificates does not work when you import the ECDSA private keys onto an nCipher nShield hardware security module (HSM). + +## PAN-81521 + +Endpoints failed to authenticate to GlobalProtect through Kerberos when you specify an FQDN instead of an IP address in the Kerberos server profile (**Device** > **Server Profiles** > **Kerberos**). + +**Workaround:** Replace the FQDN with the IP address in the Kerberos server profile. + +## PAN-77125 + +PA-7000 Series, PA-5450, PA-5200 Series, and PA-3200 Series firewalls configured in tap mode don’t close offloaded sessions after processing the associated traffic; the sessions remain open until they time out. + +**Workaround:** Configure the firewalls in virtual wire mode instead of tap mode, or disable session offloading by running the `set session off load no` CLI command. + +## PAN-75457 + +In WildFire appliance clusters that have three or more nodes, the Panorama management server does not support changing node roles. In a three-node cluster for example, you cannot use Panorama to configure the worker node as a controller node by adding the HA and cluster controller configurations, configure an existing controller node as a worker node by removing the HA configuration, and then commit and push the configuration. Attempts to change cluster node roles from Panorama results in a validation error—the commit fails and the cluster becomes unresponsive. + +## PAN-73530 + +The firewall does not generate a packet capture (pcap) when a Data Filtering profile blocks files. + +## PAN-73401 + +When you import a two-node WildFire appliance cluster into the Panorama management server, the controller nodes report their state as out-of-sync if either of the following conditions exist: + +- You did not configure a worker list to add at least one worker node to the cluster. (In a two-node cluster, both nodes are controller nodes configured as an HA pair. Adding a worker node would make the cluster a three-node cluster.) +- You did not configure a service advertisement (either by enabling or not enabling advertising DNS service on the controller nodes). + +**Workaround:** There are three possible workarounds to sync the controller nodes: + +- After you import the two-node cluster into Panorama, push the configuration from Panorama to the cluster. After the push succeeds, Panorama reports that the controller nodes are in sync. +- Configure a worker list on the cluster controller: + admin@wf500(active-controller)# `set deviceconfig cluster mode controller worker-list ` + (`` is the IP address of the worker node you are adding to the cluster.) This creates a three-node cluster. After you import the cluster into Panorama, Panorama reports that the controller nodes are in sync. When you want the cluster to have only two nodes, use a different workaround. +- Configure service advertisement on the local CLI of the cluster controller and then import the configuration into Panorama. The service advertisement can advertise that DNS is or is not enabled. + admin@wf500(active-controller)# `set deviceconfig cluster mode controller service-advertisement dns-service enabled yes` + or + admin@wf500(active-controller)# `set deviceconfig cluster mode controller service-advertisement dns-service enabled no` + Both commands result in Panorama reporting that the controller nodes are in sync. + +## PAN-70906 + +If the PAN-OS web interface and the GlobalProtect portal are enabled on the same IP address, then when a user logs out of the GlobalProtect portal, the administrative user is also logged out from the PAN-OS web interface. + +**Workaround:** Use the IP address to access the PAN-OS web interface and an FQDN to access the GlobalProtect portal. + +## PAN-69505 + +When viewing an external dynamic list that requires client authentication and you **Test Source URL**, the firewall fails to indicate whether it can reach the external dynamic list server and returns a URL access error (**Objects** > **External Dynamic Lists**). + +## PAN-40079 + +The VM-Series firewall on KVM, for all supported Linux distributions, does not support the Broadcom network adapters for PCI pass-through functionality. + +## PAN-39636 + +Regardless of the **Time Frame** you specify for a scheduled custom report on a Panorama M-Series appliance, the earliest possible start date for the report data is effectively the date when you configured the report (**Monitor** > **Manage Custom Reports**). For example, if you configure the report on the 15th of the month and set the **Time Frame** to **Last 30 Days**, the report that Panorama generates on the 16th will include only data from the 15th onward. This issue applies only to scheduled reports; on-demand reports include all data within the specified **Time Frame**. + +**Workaround:** To generate an on-demand report, click **Run Now** when you configure the custom report. + +## PAN-38255 + +When you perform a factory reset on a Panorama virtual appliance and configure the serial number, logging does not work until you reboot Panorama or execute the `debug software restart process management-server` CLI command. + +## PAN-31832 + +The following issues apply when configuring a firewall to use a hardware security module (HSM): + +- **nCipher nShield Connect**—The firewall requires at least four minutes to detect that an HSM was disconnected, causing SSL functionality to be unavailable during the delay. +- **SafeNet Network**—When losing connectivity to either or both HSMs in an HA configuration, the display of information from the `show high-availability state` and `show hsm info` commands are blocked for 20 seconds. diff --git a/web/data/issues/PAN-OS/known/10.1.11_2026-03-16.md b/web/data/issues/PAN-OS/known/10.1.11_2026-03-16.md new file mode 100644 index 0000000..28f5960 --- /dev/null +++ b/web/data/issues/PAN-OS/known/10.1.11_2026-03-16.md @@ -0,0 +1,907 @@ +--- +type: Known +product: PAN-OS +version: 10.1.11 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## APL-15000 + +When you move a firewall from one Strata Logging Service instance to another, it can take up to an hour for the firewall to begin sending logs to the new instance. + +## APL-8269 + +For data retrieved from Strata Logging Service, the Threat Name column in **Panorama** > **ACC** > **threat-activity** appears blank. + +## PLUG-12041 + +On an OpenShift cluster, MP pod may crash when the number of underlying threads exceeds beyond the per pod maximum limit of 1024. + +**Workaround:** Increase the process ID (PID) limit to 2048 in worker nodes. + +## PLUG-380 + +When you rename a device group, template, or template stack in Panorama that is part of a VMware NSX service definition, the new name is not reflected in NSX Manager. Therefore, any ESXi hosts that you add to a vSphere cluster are not added to the correct device group, template, or template stack and your Security policy is not pushed to VM-Series firewalls that you deploy after you rename those objects. There is no impact to existing VM-Series firewalls. + +## WF500-5559 + +An intermittent error while analyzing signed PE samples on the WildFire appliance might cause analysis failures. + +## WF500-5471 + +After using the firewall CLI to add a WildFire appliance with an IPv6 address, the initial connection may fail. + +**Workaround:** Retry connecting after you restart the web server with the following command: `debug software restart process web-server`. + +## PAN-281370 + +The Advanced WildFire Inline ML models **OOXML** and **Mach-O** erroneously display as being available from the CLI; however, they are only available on PAN-OS 11.1.3 and later releases. + +## PAN-260851 + +From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (**Objects** > **Applications**) tag. + +## PAN-242784 + +```caveat +This issue affects PAN-OS 10.1.11-h4 only. +``` + +DNS resolution may fail if DNS server IP is obtained through DHCP. + +**Workaround:** Configure the DNS server with a static IP or renew the DHCP IP when you see the issue. + +## PAN-237106 + +LSVPN satellite certificates may be generated with serial numbers exceeding 40 hexadecimal characters. This causes certificate revocation and deletion operations to fail with the following error messages: + +- `db-serialno can be at most 40 characters` +- `db-serialno is invalid` + +**Workaround:** + +To resolve this issue, use the following CLI commands with the LSVPN satellite serial number to manually delete or revoke the affected certificates: + +**Delete certificate information**:`delete sslmgr-store certificate-info portal name serialno ` + +**Revoke satellite certificates**:`delete sslmgr-store satellite-info-revoke-certificate portal serialno ` + +## PAN-235741 + +```caveat +This issue affects PAN-OS 10.1.11-h4 only. +``` + +DNS resolution fails for firewall and Panorama plugins if the DNS Server IP address is obtained through DHCP. + +## PAN-231658 + +```caveat +This issue affects PAN-OS 10.1.11-h5 only. +``` + +DNS resolution fails when interfaces are configured as DHCP and a DNS server is provided via DHCP while also statically configured with DNS servers. + +## PAN-230106 + +```caveat +This issue affects PAN-OS 10.1.11-h5 only. +``` + +The firewall is unable to retrieve the most current external dynamic list information from the server due to hostname resolution failure. + +## PAN-227435 + +```caveat +PA-410 firewalls only +``` + +Upgrading a firewall to PAN-OS 10.1.11-h1 or PAN-OS 10.1.11-h4 causes the logrcvr process to hang or crash. This causes the auto-commit process to fail or remain at `0%`. + +## PAN-227344 + +On the Panorama management server, PDF Summary Reports (**Monitor** > **PDF Reports** > **Manage PDF Summary**) display no data and are blank when predefined reports are included in the summary report. + +## PAN-223365 + +The Panorama management server is unable to query any logs if the ElasticSearch health status for any Log Collector (**Panorama** > **Managed Collector** is degraded. + +**Workaround:** [Log in to the Log Collector CLI](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli) and restart ElasticSearch. + +`admin``debug elasticsearch es-restart all` + +## PAN-223488 + +```caveat +This issue is now resolved. See PAN-OS 10.1.12 Addressed Issues. +``` + +Closed ElasticSearch shards are not deleted from a Panorama M-Series or virtual appliance. This causes the ElasticSearch shard purging to not work as expected, resulting in high disk usage. + +## PAN-221015 + +```caveat +This issue is now resolved. See PAN-OS 10.1.12 Addressed Issues. +``` + +On M-600 appliances in Panorama or Log Collector mode, the `es-1` and `es-2` ElasticSearch processes fail to restart when the M-600 appliance is rebooted. The results in the Managed Collector `ES` health status (**Panorama** > **Managed Collectors** > **Health Status**) to be degraded. + +**Workaround:** [Log in to the Panorama or Log Collector CLI](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli) experiencing degraded ElasticSearch health and restart all ElasticSearch processes. + +`admin>``debug elasticsearch es-restart optional all` + +## PAN-219644 + +```caveat +This issue is now resolved. See PAN-OS 10.1.12 Addressed Issues. +``` + +Firewalls forwarding logs to a syslog server over TLS (**Objects** > **Log Forwarding**) use the default Palo Alto Networks certificate instead of the custom certificate configured on the firewall. + +## PAN-219824 + +File system checks on the logging drive may take more time depending on the usage and file system content, resulting in autocommits taking longer to complete than expected. + +## PAN-218521 + +The ElasticSearch process on the M-600 appliance in Log Collector mode may enter a continuous reboot cycle. This results in the M-600 appliance becoming unresponsive, consuming logging disk space, and preventing new log ingestion. + +## PAN-217307 + +```caveat +This issue is now resolved. See PAN-OS 10.1.14 Addressed Issues. +``` + +The following Security policy rule (**Policies** > **Security**) filters return no results: + +`log-start eq no` + +`log-end eq no` + +`log-end eq yes` + +## PAN-213746 + +On the Panorama management server, the **Hostkey** displayed as `undefined undefined` if you override an SSH Service Profile (**Device** > **Certificate Management** > **SSH Service Profile**) Hostkey configured in a Template from the Template Stack. + +## PAN-212978 + +The Palo Alto Networks firewall stops responding when executing an SD-WAN debug operational CLI command. + +## PAN-211728 + +For VM-Series firewalls leveraging SD-WAN and deployed on VMware ESXi running VMX-13, Auto-Commits fail after upgrade to PAN-OS 10.1.9 and display the error: + +`total SD-WAN interfaces 3 exceed the platform maximum 0` + +**Workaround:** Attach a serial console to the VM-Series firewall before upgrade to PAN-OS 10.1.9. + +## PAN-204689 + +Upon upgrade to PAN-OS 10.1.9, the following GlobalProtect settings do not work: + +- **Allow user to disconnect GlobalProtect App** > **Allow with Passcode** +- **Allow user to Disable GlobalProtect App** > **Allow with Passcode** +- **Allow User to Uninstall GlobalProtect App** > **Allow with Password** + +## PAN-200081 + +When FIPS mode is enabled on VM-Series firewalls in Microsoft Azure environments, HA failover does not trigger the secondary IP address movement. + +## PAN-197341 + +On the Panorama management server, if you create multiple device group **Objects** with the same name in the Shared device group and any additional device groups (**Panorama** > **Device Groups**) under the same device group hierarchy that are used in one or more **Policies**, renaming the object with a shared name in any device group causes the object name to change in the policies where it is used. This issue applies only to device group objects that can be referenced in a Security policy rule. + +For example: + +1. You create a parent device group `DG-A` and a child device group `DG-B`. +2. You create address objects called `AddressObjA` in the `Shared`, `DG-A` and `DG-B` device groups and add `AddressObjA` to a Security policy rule under `DG-A` and `DG-B`. +3. Later, you change the `AddressObjA` name in the `Shared` device group to `AddressObjB`. + +Changing the name of the address object in the `Shared` device group causes the references in the Policy rule to use the renamed `Shared` object instead of the device group object. + +## PAN-196758 + +On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you **Preview Changes** (**Commit** > **Push to Devices** > **Edit Selections** or **Commit** > **Commit and Push** > **Edit Selections**). + +## PAN-194515 + +```caveat +PA-5450 firewall only +``` + +The Panorama web interface does not display any predefined template stack variables in the dropdown menu under **Device** > **Setup** > **Log Interface** > **IP Address**. + +**Workaround:** Configure the log interface IP address on the individual firewall web interface instead of on Panorama. + +## PAN-194424 + +```caveat +PA-5450 firewall only +``` + +Upgrading to PAN-OS 10.1.6-h2 while having a log interface configured can cause both the log interface and the management interface to remain connected to the log collector. + +**Workaround:** Restart the log receiver service by running the following CLI command: + +`debug software restart process log-receiver` + +## PAN-194202 + +```caveat +PA-5450 firewall only +``` + +If the management interface and Log Collector are configured on the same subnetwork, the firewall conducts log forwarding using the management interface instead of the logging interface. + +## PAN-193518 + +All logs (**Monitor** > **Logs**) generated by a firewall running a PAN-OS 10.0 release are not accessible if you downgrade from PAN-OS 10.1 to PAN-OS 10.0, and then upgrade back to PAN-OS 10.1. + +**Workaround:** If you need to downgrade from PAN-OS 10.1 to PAN-OS 10.0 and then back to PAN-OS 10.1, downgrade to PAN-OS 10.0.11 to ensure that all logs ingested while running a PAN-OS 10.0 release remain accessible after upgrade back to PAN-OS 10.1. + +## PAN-193004 + +```caveat +This issue is now resolved. See PAN-OS 10.1.12 Addressed Issues. +``` + +The Panorama management server fails to delete old IP Tag data. This causes the `/opt/pancfg` partition to reach maximum capacity which impacts Panorama performance. + +## PAN-188052 + +Devices in FIPS-CC mode are unable to connect to servers utilizing ECDSA-based host keys that impacts exporting logs (**Device** > **Scheduled Log Export**), exporting configurations (**Device** > **Scheduled Config Export**), or the `scp export` command in the CLI. + +**Workaround:** Use RSA-based host keys on the destination server. + +## PAN-187685 + +On the Panorama management server, the Template Status displays no synchronization status (**Panorama** > **Managed Devices** > **Summary**) after a bootstrapped firewall is successfully added to Panorama. + +**Workaround:** After the bootstrapped firewall is successfully added to Panorama, [log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) and select **Commit** > **Push to Devices**. + +## PAN-179888 + +On the Panorama management server, the number of managed firewall (**Panorama** > **Managed Devices** > **Health**) `Power Supplies` displays an incorrect count of power supplies. + +## PAN-174982 + +In HA active/active configurations where, when interfaces that were associated with a virtual router were deleted, the configuration change did not sync. + +## PAN-172274 + +When you activate the advanced URL filtering license, your license entitlements for PAN-DB and advanced URL filtering might not display correctly on the firewall — this is a display anomaly, not a licensing issue, and does not affect access to the services. + +**Workaround:** Issue the following command to retrieve and update the licenses: `license request fetch`. + +## PAN-172113 + +If you request a User Activity Report on Panorama and the vsys key value in the XML is an unsupported value, the resulting job becomes unresponsive at 10% and does not complete until you manually stop the job in the web interface. + +**Workaround:**Change the vsys key to a valid device group, commit your changes, and run the User Activity Report again. + +## PAN-172067 + +When you configure an HTTP server profile (**Device** > **Server Profiles** > **HTTP** or **Panorama** > **Server Profiles** > **HTTP**), the **Username** and **Password** fields are always required regardless of whether **Tag Registration** is enabled. + +**Workaround:** When you configure an HTTP server profile, always enter a username and password to successfully create the HTTP server profile. + +You must enter a username and password even if the HTTP server does not require it. The HTTP server ignores the username and password if they are not required for the firewall to connect. + +## PAN-172061 + +A process (`all_pktproc`) can cause intermittent crashes on the Passive PA-5450 firewall in an Active/Passive HA pair. This issue may be seen during an upgrade or reload of the firewall with traffic and when clearing sessions. + +## PAN-171938 + +No results are displayed when you **Show Application Filter** for a Security policy rule (**Policies** > **Security** > **Application** > **Value** > **Show Application Filter**). + +## PAN-171723 + +If you use Panorama to push a configuration that uses App-ID Cloud Engine (ACE) App-IDs and then you downgrade the firewall from PAN-OS 10.1 to PAN-OS 10.0, the installation succeeds but after you reboot, the auto-commit fails. + +**Workaround:** Remove all ACE application configurations before downgrading. + +## PAN-171706 + +If you are using Panorama to manage firewalls with multiple virtual systems and the virtual system that is the User-ID hub uses an alias, the local commit on Panorama is successful but the commit to the firewall fails. + +## PAN-171673 + +On the Panorama management server, the **ACC** returns inaccurate results when you filter for **New App-ID** in the **Application** usage widget. + +## PAN-171635 + +If you have an on-premise Active Directory and there is an existing group mapping configuration on the firewall, if you migrate the group mapping to the Cloud Identity Engine, the firewall does not remove the existing group mapping even if the configuration is disabled and the firewall is rebooted, which may conflict with new mappings from the Cloud Identity Engine. + +**Workaround**: Use the debug user-id clear domain-map command to remove the existing group mappings from the firewall. + +## PAN-171224 + +On the Panorama management server, a custom report (**Monitor** > **Managed Custom Reports**) with a high volume of unique data objects is not generated when you click **Run Now**. + +## PAN-171145 + +If you edit or remove the value for the `mail` attribute in your on-premise Active Directory, the changes may not be immediately reflected on the firewall after it syncs with the Cloud Identity Engine. + +## PAN-170923 + +In **Policies** > **Security** > **Policy Optimizer** > **New App Viewer**, when you select a Security policy rule in the bottom portion of the screen, the application data in the application browser (top portion of screen) does not match the Apps Seen on the selected rule. In addition, filtering in the application browser based on Apps Seen does not work. + +## PAN-170270 + +Using the CLI to power on a PA-5450 Networking Card (NC) in an Active HA firewall can cause its Passive peer to temporarily go down. + +## PAN-169906 + +The CN-Series Firewall as a Kubernetes Service does not support AF_XDP when deployed in CentOS. + +## PAN-168636 + +Connecting to the App-ID Cloud Engine (ACE) cloud using a management port with explicit proxy configured on it is not supported. Instead, use a data plane interface for the service route ([Prepare to Deploy App-ID Cloud Engine](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/app-id/cloud-based-app-id-service/prepare-to-deploy-app-id-cloud-engine.html) describes how to do this.) + +## PAN-168113 + +On the Panorama management server, you are unable to configure a master key (**Device** > **Master Key and Diagnostics**) for a managed firewall if an interface (**Network** > **Interfaces** > **Ethernet**) references a zone pushed from Panorama. + +**Workaround:** Remove the referenced zone from the interface configuration to successfully configure a master key. + +## PAN-167847 + +If you issue the command `opof stats`, then clear the results {opof stats -c}, the Active Sessions value is sometimes invalid. For example, you might see a negative number or an excessively large number. + +**Workaround:** Re-run the `opof stats` command after the offload completes. + +## PAN-167401 + +When a firewall or Panorama appliance configured with a proxy is upgraded to PAN-OS 10.0.3 or a later release, it fails to connect to edge service. + +## PAN-165669 + +If you configure a group that the firewall retrieves from the Cloud Identity Engine as the `user in` value in a filter query, Panorama is unable to retrieve the group membership and as a result, is unable to display this data in logs and custom reports. + +## PAN-164922 + +On the Panorama management server, a context switch to a managed firewall running a PAN-OS 8.1.0 to 8.1.19 release fails. + +## PAN-164885 + +```caveat +This issue is now resolved. See PAN-OS 10.1.14-h6 Addressed Issues +``` + +On the Panorama management server, pushes to managed firewalls (**Commit** > **Push to Devices** or **Commit and Push**) may fail when an EDL (**Objects** > **External Dynamic Lists**) is configured to **Check for updates** every 5 minutes due to the commit and EDL fetch processes overlapping. This is more likely to occur when multiple EDLs are configured to check for updates every 5 minutes. + +## PAN-164841 + +A successful deployment of a Panorama virtual appliance on Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform (GCP) is inaccessible when deploying using the PAN-OS 10.1.0-b6 release. + +## PAN-164647 + +On the Panorama management server, activating a license (**Panorama** > **Device Deployment** > **Licenses**) on managed firewalls in a high availability (HA) configuration causes the Safari web browser to become unresponsive. + +**Workaround:** [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) from a web browser other than Safari to successfully activate a license on managed firewalls in an HA configuration. + +## PAN-164618 + +The VM-Series firewall CLI and system logs display the license name `VM-SERIES-X`, while the user interface displays `VM-FLEX-X` (in both cases `X` is the number of vCPUs). In future releases the user interface will use the `VM-SERIES-X` format. + +## PAN-164586 + +If you use a value other than `mail` for the user or group email attribute in the Cloud Identity Engine, it displays in `user@domain` format in the CLI output. + +## PAN-163966 + +On the Panorama management server, the **ACC** and on demand reports (**Monitor** > **Manage Custom Reports**) are unable to fetch Directory Sync group membership when the Source User Group filter query is applied, resulting in no data being displayed for the filter when Directory Sync is configured as the Source User for a policy rule. + +## PAN-162836 + +On the VM-Series firewall, if you select **Device** > **Licenses** > **Deactivate VM** a popup window opens and you can choose **Subscriptions** or **Support** and press **Continue** to remove licenses and register the changes with the license server. When the license removal is complete the **Deactivate VM** window does not update its text to exclude deactivated licenses or close the window. + +**Workaround**: Wait until the license deactivation is complete, and click **Cancel** to close the window. + +## PAN-161666 + +The firewall includes any users configured in the Cloud Identity Engine in the count of groups. As a result, some CLI command output does not accurately display the number of groups the firewall has retrieved from the Cloud Identity Engine and counts users as groups in the `No. of Groups` in the command output. If the attempt to retrieve the user or group fails, the information for the user or group still displays in the CLI command output. + +## PAN-161451 + +If you issue the command `opof stats`, there are occasional zero packet and byte counts coming from the DPDK counters. This occurs when a session is in the tcp-reuse state, and has no impact on the existing session. + +## PAN-160238 + +If you migrate traffic from a firewall running a PAN-OS version earlier than 9.0 to a firewall running PAN-OS 9.0 or later, you experience intermittent VXLAN packet drops if TCI policy is not configured for inspecting VXLAN traffic flows. + +**Workaround:**On the new firewall, create an app override for VXLAN outer headers as described in [What is an Application Override?](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVLCA0) and the video tutorial [How to Configure an Application Override Policy on the Palo Alto Networks Firewall](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PPDrCAO). + +PAN-OS version 9.0 can inspect both inner and outer VXLAN flows. If you want to inspect inner flows, you must define a tunnel content inspection (TCI) policy. + +## PAN-157444 + +As a result of a telemetry handling update, the Source Zone field in the DNS analytics logs (viewable in the DNS Analytics tab within AutoFocus) might not display correct results. + +## PAN-157327 + +On downgrade to PAN-OS 9.1, Enterprise Data Loss Prevention (DLP) filtering settings (**Device** > **Setup** > **DLP**) are not removed and cause commit errors for the downgraded firewall if you do not uninstall the Enterprise DLP plugin before downgrade. + +**Workaround:** After you successfully downgrade a managed firewall to PAN-OS 9.1, commit and push from Panorama to remove the Enterprise DLP filtering settings and complete the downgrade. + +1. Downgrade your managed firewall to PAN-OS 9.1 +2. Log in to the firewall web interface and view the **Tasks** to verify all auto commits related to the downgrade have completed successfully. +3. Log in to the Panorama web interface and **Commit** > **Commit and Push** to your managed firewall downgraded to PAN-OS 9.1. + +## PAN-157103 + +Multi-channel functionality may not be properly utilized on an VM-Series firewall deployed in VMware NSX-V after the service is first deployed. + +**Workaround**: Execute the command `debug dataplane pow status` to view the number of channels being utilized by the dataplane. + +Per pan-task Netx statisticsCounter Name 1 2 3 4 5 6 Total---------------------------------------------ready_dvf 2 0 0 0 0 0 2 + +If multi-channel functionality is not working, disable your NSX-V security policy and reapply it. Then reboot the VM-Series firewall. When the firewall is back up, verify that multi-channel functionality is working by executing the command `debug dataplane pow status`. It should now show multiple channels being utilized. + +Per pan-task Netx statisticsCounter Name 1 2 3 4 5 6 Total---------------------------------------------ready_dvf 1 1 0 0 0 0 2 + +## PAN-156598 + +```caveat +Panorama only +``` + +If you configure a standard custom vulnerability signature in a custom Vulnerability Protection profile in a shared device group, the shared profile custom signatures do not populate in the other device groups when you configure a combination custom vulnerability signature. + +**Workaround:** Use the CLI to update the combination signature. + +## PAN-154292 + +On the Panorama management server, downgrading from a PAN-OS 10.0 release to a PAN-OS 9.1 release causes Panorama commit (**Commit** > **Commit to Panorama**) failures if a custom report (**Monitor** > **Manage Custom Reports**) is configured to Group By **Session ID**. + +**Workaround:** After successful downgrade, reconfigure the Group By setting in the custom report. + +## PAN-154034 + +On the Panorama management server, the Type column in the System logs (**Monitor** > **Logs** > **System**) for managed firewalls running a PAN-OS 9.1 release erroneously display `iot` as the type. + +## PAN-154032 + +On the Panorama management server, downgrading to PAN-OS 9.1 with the Panorama plugin for Cisco TrustSec version 1.0.2 installed does not automatically transform the plugin to be compatible with PAN-OS 9.1 + +**Workaround:** After successful downgrade to PAN-OS 9.1, **Remove Config** (**Panorama** > **Plugins**) of the Panorama plugin for Cisco TrustSec and then reconfigure the plugin. + +## PAN-153803 + +On the Panorama management server, scheduled email PDF reports (**Monitor** > **PDF Reports**) fail if a GIF image is used in the header or footer. + +## PAN-153557 + +On the Panorama management server CLI, the overall report status for a report query is marked as `Done` despite reports generated from logs in the Strata Logging Service from the PODamericas Collector Group jobs are still in a `Running` state. + +## PAN-153068 + +The Bonjour Reflector option is supported on up to 16 interfaces. If you enable it on more than 16 interfaces, the commit succeeds and the Bonjour Reflector option is enabled only for the first 16 interfaces and ignored for any additional interfaces. + +## PAN-151238 + +There is a known issue where M-100 appliances are able to download and install a PAN-OS 10.0 release image even though the M-100 appliance is no longer supported after PAN-OS 9.1. (Refer to the [hardware end-of-life dates](https://www.paloaltonetworks.com/services/support/end-of-life-announcements/hardware-end-of-life-dates.html).) + +## PAN-151085 + +On a PA-7000 Series firewall chassis having multiple slots, when HA clustering is enabled on an active/active HA pair, the session table count for one of the peers can show a higher count than the actual number of active sessions on that peer. This behavior can be seen when the session is being set up on a non-cache slot (for example, when a session distribution policy is set to round-robin or session-load); it is caused by the additional cache lookup that happens when HA cluster participation is enabled. + +## PAN-150801 + +Automatic quarantine of a device based on forwarding profile or log setting does not work on the PA-7000 Series firewalls. + +## PAN-150515 + +After you install the device certificate on a new Panorama management server, Panorama is not able to connect to the IoT Security edge service. + +**Workaround:** Restart Panorama to connect to the IoT Security edge service. + +## PAN-150345 + +During updates to the Device Dictionary, the IoT Security service does not push new Device-ID attributes (such as new device profiles) to the firewall until a manual commit occurs. + +**Workaround:** Perform a force commit to push the attributes in the content update to the firewall. + +## PAN-150361 + +In an Active-Passive high availability (HA) configuration, an error displays if you create a device object on the passive device. + +**Workaround:** Load the running configuration and perform a force commit to sync the devices. + +## PAN-148971 + +If you enter a search term for Events that are related to IoT in the System logs and apply the filter, the page displays an `Invalid term` error. + +**Workaround:** Specify `iot` as the **Type Attribute** to filter the logs and use the search term as the **Description Attribute**. For example: `( subtype eq iot ) and ( description contains 'gRPC connection' )`. + +## PAN-148924 + +In an active-passive HA configuration, tags for dynamic user groups are not persistent after rebooting the firewall because the active firewall does not sync the tags to the passive firewall during failover. + +## PAN-146995 + +After downgrading a Panorama management server from PAN-OS 10.0 to PAN-OS 9.1, the `VLD` and `logd` processes may crash when Panorama reboots. + +**Workaround:** Panorama automatically restarts the `VLD` and `logd` processes. + +## PAN-146807 + +Changing the device group configured in a monitoring definition from a child DG to a parent DG, or vice versa, might cause firewalls configured in the child DG to lose IP tag mapping information received from the monitoring definition. Only firewalls assigned to the parent DG receive IP tag mapping updates. + +**Workaround**: Perform a manual config sync on the device group that lost the IP tag mapping information. + +## PAN-146485 + +On the Panorama management server, adding, deleting, or modifying the upstream NAT configuration (**Panorama** > **SD-WAN** > **Devices**) does not display the branch template stack as `out of sync`. + +Additionally, adding, deleting, or modifying the BGP configuration (**Panorama** > **SD-WAN** > **Devices**) does not display the hub and branch template stacks as `out of sync`. For example, modifying the BGP configuration on the branch firewall does not cause the hub template stack to display as `out of sync`, nor does modifying the BGP configuration on the hub firewall cause the branch template stack as `out of sync`. + +**Workaround:** After performing a configuration change, **Commit and Push** the configuration changes to all hub and branch firewalls in the VPN cluster containing the firewall with the modified configuration. + +## PAN-145460 + +CN-MGMT pods fail to connect to the Panorama management server when using the Kubernetes plugin. + +**Workaround:** **Commit** the Panorama configuration after the CN-MGMT pod successfully registers with Panorama. + +## PAN-144889 + +On the Panorama management server, adding, deleting, or modifying the original subnet IP, or adding a new subnet after you successfully configure a tunnel IP subnet, for the SD-WAN 1.0.2 plugin does not display the managed firewall templates (**Panorama** > **Managed Devices** > **Summary**) as `Out of Sync`. + +**Workaround**: When modifying the original subnet IP, or adding a new subnet, push the template configuration changes to your managed firewalls and **Force Template Values** (**Commit** > **Push to Devices** > **Edit Selections**). + +## PAN-143132 + +Fetching the device certificate from the Palo Alto Networks Customer Support Portal (CSP) may fail and displays the following error in the CLI: + +`ERROR Failed to process S1C msg: Error` + +**Workaround:** Retrying fetching the device certificate from the Palo Alto Networks CSP. + +## PAN-141630 + +Current performance limitation: single data plane use only. The PA-5200 Series and PA-7000 Series firewalls that support 5G network slice security, 5G equipment ID security, and 5G subscriber ID security use a single data plane only, which currently limits the firewall performance. + +## PAN-140959 + +The Panorama management server allows you to downgrade Zero Touch Provisioning (ZTP) firewalls to PAN-OS 9.1.2 and earlier releases where ZTP functionality is not supported. + +## PAN-140008 + +ElasticSearch is forced to restart when the `masterd` process misses too many heartbeat messages on the Panorama management server resulting in a delay in a log query and ingestion. + +## PAN-136763 + +On the Panorama management server, managed firewalls display as `disconnected` when installing a PAN-OS software update (**Panorama** > **Device Deployment** > **Software**) but display as `connected` when you view your managed firewalls Summary (**Panorama** > **Managed Devices** > **Summary**) and from the CLI. + +**Workaround:** Log out and log back in to the Panorama web interface. + +## PAN-135742 + +There is an issue in HTTP2 session decryption where the App-ID in the decryption log is the App-ID of the parent session (which is web-browsing). + +## PAN-134053 + +ACC does not filter WildFire logs from Dynamic User Groups. + +## PAN-132598 + +The Panorama management server does not check for duplicate addresses in address groups (**Objects** > **Address Groups**) and duplicate services in service groups (**Objects** > **Service Groups**) when created from the CLI. + +## PAN-130550 + +```caveat +PA-3200 Series, PA-5220, PA-5250, PA-5260, and PA-7000 Series firewalls +``` + +For traffic between virtual systems (inter-vsys traffic), the firewall cannot perform source NAT using dynamic IP (DIP) address translation. + +**Workaround:** Use source NAT with Dynamic IP and Port (DIPP) translation on inter-vsys traffic. + +## PAN-127813 + +In the current release, SD-WAN auto-provisioning configures hubs and branches in a hub and spoke model, where branches don’t communicate with each other. Expected branch routes are for generic prefixes, which can be configured in the hub and advertised to all branches. Branches with unique prefixes are not published up to the hub. + +**Workaround:** Add any specific prefixes for branches to the hub advertise-list configuration. + +## PAN-127206 + +If you use the CLI to enable the cleartext option for the Include Username in HTTP Header Insertion Entries feature, the authentication request to the firewall may become unresponsive or time out. + +## PAN-123277 + +Dynamic tags from other sources are accessible using the CLI but do not display on the Panorama web interface. + +## PAN-123040 + +When you try to view network QoS statistics on an SD-WAN branch or hub, the QoS statistics and the hit count for the QoS rules don’t display. A workaround exists for this issue. Please contact Support for information about the workaround. + +## PAN-120440 + +There is an issue on M-500 Panorama management servers where any ethernet interface with an IPv6 address having Private PAN-DB-URL connectivity only supports the following format: `2001:DB9:85A3:0:0:8A2E:370:2`. + +## PAN-120423 + +PAN-OS 10.0.0 does not support the XML API for GlobalProtect logs. + +## PAN-120303 + +There is an issue where the firewall remains connected to the PAN-DB-URL server through the old management IP address on the M-500 Panorama management server, even when you configured the Eth1/1 interface. + +**Workaround:** Update the PAN-DB-URL IP address on the firewall using one of the methods below. + +- Modify the PAN-DB Server IP address on the managed firewall. + 1. On the web interface, delete the **PAN-DB Server** IP address (**Device** > **Setup** > **Content ID** > **URL Filtering** settings). + 2. **Commit** your changes. + 3. Add the new M-500 Eth1/1 IP PAN-DB IP address. + 4. **Commit** your changes. +- Restart the firewall (devsrvr) process. + 1. Log in to the firewall CLI. + 2. Restart the devsrvr process: `debug software restart process device-server` + +## PAN-116017 + +```caveat +Google Cloud Platform (GCP) only +``` + +The firewall does not accept the DNS value from the initial configuration (init-cfg) file when you bootstrap the firewall. + +**Workaround:** Add DNS value as part of the bootstrap.xml in the bootstrap folder and complete the bootstrap process. + +## PAN-115816 + +```caveat +Microsoft Azure only +``` + +There is an intermittent issue where an Ethernet (eth1) interface does not come up when you first boot up the firewall. + +**Workaround:** Reboot the firewall. + +## PAN-114495 + +Alibaba Cloud runs on a KVM hypervisor and supports two Virtio modes: DPDK (default) and MMAP. If you deploy a VM-Series firewall running PAN-OS 9.0 in DPDK packet mode and you then switch to MMAP packet mode, the VM-Series firewall duplicates packets that originate from or terminate on the firewall. As an example, if a load balancer or a server behind the firewall pings the VM-Series firewall after you switch from DPDK packet mode to MMAP packet mode, the firewall duplicates the ping packets. + +Throughput traffic is not duplicated if you deploy the VM-Series firewall using MMAP packet mode. + +## PAN-112694 + +```caveat +Firewalls with multiple virtual systems only +``` + +If you configure dynamic DNS (DDNS) on a new interface (associated with vsys1 or another virtual system) and you then create a **New** Certificate Profile from the drop-down, you must set the location for the Certificate Profile to Shared. If you configure DDNS on an existing interface and then create a new Certificate Profile, we also recommend that you choose the Shared location instead of a specific virtual system. Alternatively, you can select a preexisting certificate profile instead of creating a new one. + +## PAN-112456 + +You can temporarily submit a change request for a URL Category with three suggested categories; however, only two categories are supported. Do not add more than two suggested categories to a change request until we address this issue. If you submit more than two suggested categories, only the first two categories in the change request are evaluated. + +## PAN-112135 + +You cannot unregister tags for a subnet or range in a dynamic address group from the web interface. + +**Workaround:** Use an XML API request to unregister the tags for the subnet or range. + +## PAN-111928 + +Invalid configuration errors are not displayed as expected when you revert a Panorama management server configuration. + +**Workaround:** After you revert the Panorama configuration, **Commit** (**Commit** > **Commit to Panorama**) the reverted configuration to display the invalid configuration errors. + +## PAN-111866 + +The push scope selection on the Panorama web interface displays incorrectly even though the commit scope displays as expected. This issue occurs when one administrator makes configuration changes to separate device groups or templates that affect multiple firewalls and a different administrator attempts to push those changes. + +**Workaround:** Perform one of the following tasks. + +- Initiate a **Commit to Panorama** operation followed by a **Push to Devices** operation for the modified device group and template configurations. +- Manually select the devices that belong to the modified device group and template configurations. + +## PAN-111729 + +If you disable DPDK mode and enable it again, you must immediately reboot the firewall. + +## PAN-111670 + +Tagged VLAN traffic fails when sent through an SR-IOV adapter. + +## PAN-110794 + +DGA-based threats shown in the firewall threat log display the same name for all such instances. + +## PAN-109526 + +The system log does not correctly display the URL for CRL files; instead, the URLs are displayed with encoded characters. + +## PAN-104780 + +If you configure a HIP object to match only when a connecting endpoint is managed (**Objects** > **GlobalProtect** > **HIP Objects** > **** > **General** > **Managed**), iOS and Android endpoints that are managed by AirWatch are unable to successfully match the HIP object and the HIP report incorrectly indicates that these endpoints are not managed. This issue occurs because GlobalProtect gateways cannot correctly identify the managed status of these endpoints. + +Additionally, iOS endpoints that are managed by AirWatch are unable to match HIP objects based on the endpoint serial number because GlobalProtect gateways cannot identify the serial numbers of these endpoints; these serial numbers do not appear in the HIP report. + +## PAN-103276 + +Adding a disk to a virtual appliance running Panorama 8.1 or a later release on VMware ESXi 6.5 update1 causes the Panorama virtual appliance and host web client to become unresponsive. + +**Workaround:** Upgrade the ESXi host to ESXi 6.5 update2 and add the disk again. + +## PAN-101688 + +```caveat +Panorama plugins +``` + +The IP address-to-tag mapping information registered on a firewall or virtual system is not deleted when you remove the firewall or virtual system from a Device Group. + +**Workaround:** Log in to the CLI on the firewall and enter the following command to unregister the IP address-to-tag mappings: `debug object registered-ip clear all`. + +## PAN-101537 + +After you configure and push address and address group objects in Shared and vsys-specific device groups from the Panorama management server to managed firewalls, executing the `show log direction equal | in ` command on a managed firewall only returns address and address group objects pushed form the Shared device group. + +**Workaround:** Specify the vsys in the query string: + +`admin>` `set system target-vsys ` + +`admin>` `show log direction equal query equal ‘vsys eq ’ | in ` + +## PAN-98520 + +When booting or rebooting a PA-7000 Series Firewall with the SMC-B installed, the BIOS console output displays attempts to connect to the card's controller in the System Memory Speed section. The messages can be ignored. + +## PAN-97757 + +GlobalProtect authentication fails with an `Invalid username/password` error (because the user is not found in **Allow List**) after you enable GlobalProtect authentication cookies and add a RADIUS group to the **Allow List** of the authentication profile used to authenticate to GlobalProtect. + +**Workaround:** Disable GlobalProtect authentication cookies. Alternatively, disable (clear) **Retrieve user group from RADIUS** in the authentication profile and configure group mapping from Active Directory (AD) through LDAP. + +## PAN-97524 + +```caveat +Panorama management server only +``` + +The Security Zone and Virtual System columns (**Network** tab) display `None` after a Device Group and Template administrator with read-only privileges performs a context switch. + +## PAN-96446 + +A firewall that is not included in a Collector Group fails to generate a system log if logs are dropped when forwarded to a Panorama management server that is running in Management Only mode. + +## PAN-95773 + +On VM-Series firewalls that have Data Plane Development Kit (DPDK) enabled and that use the i40e network interface card (NIC), the `show session info` CLI command displays an inaccurate throughput and packet rate. + +**Workaround:** Disable DPDK by running the `set system setting dpdk-pkt-io off` CLI command. + +## PAN-95028 + +For administrator accounts that you created in PAN-OS 8.0.8 and earlier releases, the firewall does not apply password profile settings (**Device** > **Password Profiles**) until after you upgrade to PAN-OS 8.0.9 or a later release and then only after you modify the account passwords. (Administrator accounts that you create in PAN-OS 8.0.9 or a later release do not require you to change the passwords to apply password profile settings.) + +## PAN-94846 + +When DPDK is enabled on the VM-Series firewall with i40e virtual function (VF) driver, the VF does not detect the link status of the physical link. The VF link status remains up, regardless of changes to the physical link state. + +## PAN-94093 + +HTTP Header Insertion does not work when jumbo frames are received out of order. + +## PAN-93968 + +The firewall and Panorama web interfaces display vulnerability threat IDs that are not available in PAN-OS 9.0 releases (**Objects** > **Security Profiles** > **Vulnerability Protection** > **** > **Exceptions**). To confirm whether a particular threat ID is available in your release, monitor the release notes for each new Applications and Threats content update or check the Palo Alto Networks [Threat Vault](https://threatvault.paloaltonetworks.com) to see the minimum PAN-OS release version for a threat signature. + +## PAN-93607 + +When you configure a VM-500 firewall with an SCTP Protection profile (**Objects** > **Security Profiles** > **SCTP Protection**) and you try to add the profile to an existing Security Profile Group (**Objects** > **Security Profile Groups**), the Security Profile Group doesn’t list the SCTP Protection profile in its drop-down list of available profiles. + +**Workaround:** Create a new Security Profile Group and select the SCTP Protection profile from there. + +## PAN-93532 + +When you configure a firewall running PAN-OS 9.0 as an nCipher HSM client, the web interface on the firewall displays the nCipher server status as Not Authenticated, even though the HSM state is up (**Device** > **Setup** > **HSM**). + +## PAN-93193 + +The memory-optimized VM-50 Lite intermittently performs slowly and stops processing traffic when memory utilization is critically high. To prevent this issue, make sure that you do not: + +- Switch to the firewall **Context** on the Panorama management server. +- Commit changes when a dynamic update is being installed. +- Generate a custom report when a dynamic update is being installed. +- Generate custom reports during a commit. + +**Workaround:** When the firewall performs slowly, or you see a critical System log for memory utilization, wait for 5 minutes and then manually reboot the firewall. + +Use the Task Manager to verify that you are not performing memory intensive tasks such as installing dynamic updates, committing changes or generating reports, at the same time, on the firewall. + +## PAN-91802 + +On a VM-Series firewall, the **clear session all** CLI command does not clear GTP sessions. + +## PAN-83610 + +In rare cases, a PA-5200 Series firewall (with an FE100 network processor) that has session offload enabled (default) incorrectly resets the UDP checksum of outgoing UDP packets. + +**Workaround:** In PAN-OS 8.0.6 and later releases, you can persistently disable session offload for only UDP traffic using the `set session udp-off load no` CLI command. + +## PAN-83236 + +The VM-Series firewall on Google Cloud Platform does not publish firewall metrics to Google Stack Monitoring when you manually configure a DNS server IP address (**Device** > **Setup** > **Services**). + +**Workaround:** The VM-Series firewall on Google Cloud Platform must use the DNS server that Google provides. + +## PAN-83215 + +SSL decryption based on ECDSA certificates does not work when you import the ECDSA private keys onto an nCipher nShield hardware security module (HSM). + +## PAN-81521 + +Endpoints failed to authenticate to GlobalProtect through Kerberos when you specify an FQDN instead of an IP address in the Kerberos server profile (**Device** > **Server Profiles** > **Kerberos**). + +**Workaround:** Replace the FQDN with the IP address in the Kerberos server profile. + +## PAN-77125 + +PA-7000 Series, PA-5450, PA-5200 Series, and PA-3200 Series firewalls configured in tap mode don’t close offloaded sessions after processing the associated traffic; the sessions remain open until they time out. + +**Workaround:** Configure the firewalls in virtual wire mode instead of tap mode, or disable session offloading by running the `set session off load no` CLI command. + +## PAN-75457 + +In WildFire appliance clusters that have three or more nodes, the Panorama management server does not support changing node roles. In a three-node cluster for example, you cannot use Panorama to configure the worker node as a controller node by adding the HA and cluster controller configurations, configure an existing controller node as a worker node by removing the HA configuration, and then commit and push the configuration. Attempts to change cluster node roles from Panorama results in a validation error—the commit fails and the cluster becomes unresponsive. + +## PAN-73530 + +The firewall does not generate a packet capture (pcap) when a Data Filtering profile blocks files. + +## PAN-73401 + +When you import a two-node WildFire appliance cluster into the Panorama management server, the controller nodes report their state as out-of-sync if either of the following conditions exist: + +- You did not configure a worker list to add at least one worker node to the cluster. (In a two-node cluster, both nodes are controller nodes configured as an HA pair. Adding a worker node would make the cluster a three-node cluster.) +- You did not configure a service advertisement (either by enabling or not enabling advertising DNS service on the controller nodes). + +**Workaround:** There are three possible workarounds to sync the controller nodes: + +- After you import the two-node cluster into Panorama, push the configuration from Panorama to the cluster. After the push succeeds, Panorama reports that the controller nodes are in sync. +- Configure a worker list on the cluster controller: + admin@wf500(active-controller)# `set deviceconfig cluster mode controller worker-list ` + (`` is the IP address of the worker node you are adding to the cluster.) This creates a three-node cluster. After you import the cluster into Panorama, Panorama reports that the controller nodes are in sync. When you want the cluster to have only two nodes, use a different workaround. +- Configure service advertisement on the local CLI of the cluster controller and then import the configuration into Panorama. The service advertisement can advertise that DNS is or is not enabled. + admin@wf500(active-controller)# `set deviceconfig cluster mode controller service-advertisement dns-service enabled yes` + or + admin@wf500(active-controller)# `set deviceconfig cluster mode controller service-advertisement dns-service enabled no` + Both commands result in Panorama reporting that the controller nodes are in sync. + +## PAN-70906 + +If the PAN-OS web interface and the GlobalProtect portal are enabled on the same IP address, then when a user logs out of the GlobalProtect portal, the administrative user is also logged out from the PAN-OS web interface. + +**Workaround:** Use the IP address to access the PAN-OS web interface and an FQDN to access the GlobalProtect portal. + +## PAN-69505 + +When viewing an external dynamic list that requires client authentication and you **Test Source URL**, the firewall fails to indicate whether it can reach the external dynamic list server and returns a URL access error (**Objects** > **External Dynamic Lists**). + +## PAN-40079 + +The VM-Series firewall on KVM, for all supported Linux distributions, does not support the Broadcom network adapters for PCI pass-through functionality. + +## PAN-39636 + +Regardless of the **Time Frame** you specify for a scheduled custom report on a Panorama M-Series appliance, the earliest possible start date for the report data is effectively the date when you configured the report (**Monitor** > **Manage Custom Reports**). For example, if you configure the report on the 15th of the month and set the **Time Frame** to **Last 30 Days**, the report that Panorama generates on the 16th will include only data from the 15th onward. This issue applies only to scheduled reports; on-demand reports include all data within the specified **Time Frame**. + +**Workaround:** To generate an on-demand report, click **Run Now** when you configure the custom report. + +## PAN-38255 + +When you perform a factory reset on a Panorama virtual appliance and configure the serial number, logging does not work until you reboot Panorama or execute the `debug software restart process management-server` CLI command. + +## PAN-31832 + +The following issues apply when configuring a firewall to use a hardware security module (HSM): + +- **nCipher nShield Connect**—The firewall requires at least four minutes to detect that an HSM was disconnected, causing SSL functionality to be unavailable during the delay. +- **SafeNet Network**—When losing connectivity to either or both HSMs in an HA configuration, the display of information from the `show high-availability state` and `show hsm info` commands are blocked for 20 seconds. diff --git a/web/data/issues/PAN-OS/known/10.1.13_2026-03-16.md b/web/data/issues/PAN-OS/known/10.1.13_2026-03-16.md new file mode 100644 index 0000000..f87e382 --- /dev/null +++ b/web/data/issues/PAN-OS/known/10.1.13_2026-03-16.md @@ -0,0 +1,873 @@ +--- +type: Known +product: PAN-OS +version: 10.1.13 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## APL-15000 + +When you move a firewall from one Strata Logging Service instance to another, it can take up to an hour for the firewall to begin sending logs to the new instance. + +## APL-8269 + +For data retrieved from Strata Logging Service, the Threat Name column in **Panorama** > **ACC** > **threat-activity** appears blank. + +## PLUG-14947 + +If you are using the Panorama plugin for Azure, do not upgrade to PAN-OS 10.1.12. When installed on 10.1.12, the Panorama plugin for Azure fails to connect to Azure. + +## PLUG-12041 + +On an OpenShift cluster, MP pod may crash when the number of underlying threads exceeds beyond the per pod maximum limit of 1024. + +**Workaround:** Increase the process ID (PID) limit to 2048 in worker nodes. + +## PLUG-380 + +When you rename a device group, template, or template stack in Panorama that is part of a VMware NSX service definition, the new name is not reflected in NSX Manager. Therefore, any ESXi hosts that you add to a vSphere cluster are not added to the correct device group, template, or template stack and your Security policy is not pushed to VM-Series firewalls that you deploy after you rename those objects. There is no impact to existing VM-Series firewalls. + +## WF500-5559 + +An intermittent error while analyzing signed PE samples on the WildFire appliance might cause analysis failures. + +## WF500-5471 + +After using the firewall CLI to add a WildFire appliance with an IPv6 address, the initial connection may fail. + +**Workaround:** Retry connecting after you restart the web server with the following command: `debug software restart process web-server`. + +## PAN-281370 + +The Advanced WildFire Inline ML models **OOXML** and **Mach-O** erroneously display as being available from the CLI; however, they are only available on PAN-OS 11.1.3 and later releases. + +## PAN-260851 + +From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (**Objects** > **Applications**) tag. + +## PAN-242837 + +Default login credentials and SSH fail after enabling FIPS-CC Mode on a firewall or Panorama after converting through the Maintenance Recovery Tool (MRT). The firewall or Panorama becomes stuck and requires a factory reset to recover. + +## PAN-242784 + +```caveat +This issue affects PAN-OS 10.1.11-h4 only. +``` + +DNS resolution may fail if DNS server IP is obtained through DHCP. + +**Workaround:** Configure the DNS server with a static IP or renew the DHCP IP when you see the issue. + +## PAN-238769 + +FIPS-CC VM-Series only. Upgrading to PAN-OS 10.1.10-h2 or PAN-OS 10.1.11 changes all locally created Security policy actions to Deny. + +**Workaround:** Before upgrading, save a backup of the current configuration. After upgrading, load the backup configuration to restore the security policy action settings. + +## PAN-237106 + +LSVPN satellite certificates may be generated with serial numbers exceeding 40 hexadecimal characters. This causes certificate revocation and deletion operations to fail with the following error messages: + +- `db-serialno can be at most 40 characters` +- `db-serialno is invalid` + +**Workaround:** + +To resolve this issue, use the following CLI commands with the LSVPN satellite serial number to manually delete or revoke the affected certificates: + +**Delete certificate information**:`delete sslmgr-store certificate-info portal name serialno ` + +**Revoke satellite certificates**:`delete sslmgr-store satellite-info-revoke-certificate portal serialno ` + +## PAN-235741 + +```caveat +This issue affects PAN-OS 10.1.11-h4 only. +``` + +DNS resolution fails for firewall and Panorama plugins if the DNS Server IP address is obtained through DHCP. + +## PAN-231658 + +```caveat +This issue affects PAN-OS 10.1.11-h5 only. +``` + +DNS resolution fails when interfaces are configured as DHCP and a DNS server is provided via DHCP while also statically configured with DNS servers. + +## PAN-230106 + +```caveat +This issue affects PAN-OS 10.1.11-h5 only. +``` + +The firewall is unable to retrieve the most current external dynamic list information from the server due to hostname resolution failure. + +## PAN-227344 + +On the Panorama management server, PDF Summary Reports (**Monitor** > **PDF Reports** > **Manage PDF Summary**) display no data and are blank when predefined reports are included in the summary report. + +## PAN-223365 + +The Panorama management server is unable to query any logs if the ElasticSearch health status for any Log Collector (**Panorama** > **Managed Collector** is degraded. + +**Workaround:** [Log in to the Log Collector CLI](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli) and restart ElasticSearch. + +`admin``debug elasticsearch es-restart all` + +## PAN-219824 + +File system checks on the logging drive may take more time depending on the usage and file system content, resulting in autocommits taking longer to complete than expected. + +## PAN-218521 + +The ElasticSearch process on the M-600 appliance in Log Collector mode may enter a continuous reboot cycle. This results in the M-600 appliance becoming unresponsive, consuming logging disk space, and preventing new log ingestion. + +## PAN-217307 + +```caveat +This issue is now resolved. See PAN-OS 10.1.14 Addressed Issues. +``` + +The following Security policy rule (**Policies** > **Security**) filters return no results: + +`log-start eq no` + +`log-end eq no` + +`log-end eq yes` + +## PAN-213746 + +On the Panorama management server, the **Hostkey** displayed as `undefined undefined` if you override an SSH Service Profile (**Device** > **Certificate Management** > **SSH Service Profile**) Hostkey configured in a Template from the Template Stack. + +## PAN-212978 + +The Palo Alto Networks firewall stops responding when executing an SD-WAN debug operational CLI command. + +## PAN-211728 + +For VM-Series firewalls leveraging SD-WAN and deployed on VMware ESXi running VMX-13, Auto-Commits fail after upgrade to PAN-OS 10.1.9 and display the error: + +`total SD-WAN interfaces 3 exceed the platform maximum 0` + +**Workaround:** Attach a serial console to the VM-Series firewall before upgrade to PAN-OS 10.1.9. + +## PAN-204689 + +Upon upgrade to PAN-OS 10.1.9, the following GlobalProtect settings do not work: + +- **Allow user to disconnect GlobalProtect App** > **Allow with Passcode** +- **Allow user to Disable GlobalProtect App** > **Allow with Passcode** +- **Allow User to Uninstall GlobalProtect App** > **Allow with Password** + +## PAN-200081 + +When FIPS mode is enabled on VM-Series firewalls in Microsoft Azure environments, HA failover does not trigger the secondary IP address movement. + +## PAN-197341 + +On the Panorama management server, if you create multiple device group **Objects** with the same name in the Shared device group and any additional device groups (**Panorama** > **Device Groups**) under the same device group hierarchy that are used in one or more **Policies**, renaming the object with a shared name in any device group causes the object name to change in the policies where it is used. This issue applies only to device group objects that can be referenced in a Security policy rule. + +For example: + +1. You create a parent device group `DG-A` and a child device group `DG-B`. +2. You create address objects called `AddressObjA` in the `Shared`, `DG-A` and `DG-B` device groups and add `AddressObjA` to a Security policy rule under `DG-A` and `DG-B`. +3. Later, you change the `AddressObjA` name in the `Shared` device group to `AddressObjB`. + +Changing the name of the address object in the `Shared` device group causes the references in the Policy rule to use the renamed `Shared` object instead of the device group object. + +## PAN-196758 + +On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you **Preview Changes** (**Commit** > **Push to Devices** > **Edit Selections** or **Commit** > **Commit and Push** > **Edit Selections**). + +## PAN-194515 + +```caveat +PA-5450 firewall only +``` + +The Panorama web interface does not display any predefined template stack variables in the dropdown menu under **Device** > **Setup** > **Log Interface** > **IP Address**. + +**Workaround:** Configure the log interface IP address on the individual firewall web interface instead of on Panorama. + +## PAN-194424 + +```caveat +PA-5450 firewall only +``` + +Upgrading to PAN-OS 10.1.6-h2 while having a log interface configured can cause both the log interface and the management interface to remain connected to the log collector. + +**Workaround:** Restart the log receiver service by running the following CLI command: + +`debug software restart process log-receiver` + +## PAN-194202 + +```caveat +PA-5450 firewall only +``` + +If the management interface and Log Collector are configured on the same subnetwork, the firewall conducts log forwarding using the management interface instead of the logging interface. + +## PAN-193518 + +All logs (**Monitor** > **Logs**) generated by a firewall running a PAN-OS 10.0 release are not accessible if you downgrade from PAN-OS 10.1 to PAN-OS 10.0, and then upgrade back to PAN-OS 10.1. + +**Workaround:** If you need to downgrade from PAN-OS 10.1 to PAN-OS 10.0 and then back to PAN-OS 10.1, downgrade to PAN-OS 10.0.11 to ensure that all logs ingested while running a PAN-OS 10.0 release remain accessible after upgrade back to PAN-OS 10.1. + +## PAN-188052 + +Devices in FIPS-CC mode are unable to connect to servers utilizing ECDSA-based host keys that impacts exporting logs (**Device** > **Scheduled Log Export**), exporting configurations (**Device** > **Scheduled Config Export**), or the `scp export` command in the CLI. + +**Workaround:** Use RSA-based host keys on the destination server. + +## PAN-187685 + +On the Panorama management server, the Template Status displays no synchronization status (**Panorama** > **Managed Devices** > **Summary**) after a bootstrapped firewall is successfully added to Panorama. + +**Workaround:** After the bootstrapped firewall is successfully added to Panorama, [log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) and select **Commit** > **Push to Devices**. + +## PAN-179888 + +On the Panorama management server, the number of managed firewall (**Panorama** > **Managed Devices** > **Health**) `Power Supplies` displays an incorrect count of power supplies. + +## PAN-174982 + +In HA active/active configurations where, when interfaces that were associated with a virtual router were deleted, the configuration change did not sync. + +## PAN-172274 + +When you activate the advanced URL filtering license, your license entitlements for PAN-DB and advanced URL filtering might not display correctly on the firewall — this is a display anomaly, not a licensing issue, and does not affect access to the services. + +**Workaround:** Issue the following command to retrieve and update the licenses: `license request fetch`. + +## PAN-172113 + +If you request a User Activity Report on Panorama and the vsys key value in the XML is an unsupported value, the resulting job becomes unresponsive at 10% and does not complete until you manually stop the job in the web interface. + +**Workaround:**Change the vsys key to a valid device group, commit your changes, and run the User Activity Report again. + +## PAN-172067 + +When you configure an HTTP server profile (**Device** > **Server Profiles** > **HTTP** or **Panorama** > **Server Profiles** > **HTTP**), the **Username** and **Password** fields are always required regardless of whether **Tag Registration** is enabled. + +**Workaround:** When you configure an HTTP server profile, always enter a username and password to successfully create the HTTP server profile. + +You must enter a username and password even if the HTTP server does not require it. The HTTP server ignores the username and password if they are not required for the firewall to connect. + +## PAN-172061 + +A process (`all_pktproc`) can cause intermittent crashes on the Passive PA-5450 firewall in an Active/Passive HA pair. This issue may be seen during an upgrade or reload of the firewall with traffic and when clearing sessions. + +## PAN-171938 + +No results are displayed when you **Show Application Filter** for a Security policy rule (**Policies** > **Security** > **Application** > **Value** > **Show Application Filter**). + +## PAN-171723 + +If you use Panorama to push a configuration that uses App-ID Cloud Engine (ACE) App-IDs and then you downgrade the firewall from PAN-OS 10.1 to PAN-OS 10.0, the installation succeeds but after you reboot, the auto-commit fails. + +**Workaround:** Remove all ACE application configurations before downgrading. + +## PAN-171673 + +On the Panorama management server, the **ACC** returns inaccurate results when you filter for **New App-ID** in the **Application** usage widget. + +## PAN-171635 + +If you have an on-premise Active Directory and there is an existing group mapping configuration on the firewall, if you migrate the group mapping to the Cloud Identity Engine, the firewall does not remove the existing group mapping even if the configuration is disabled and the firewall is rebooted, which may conflict with new mappings from the Cloud Identity Engine. + +**Workaround**: Use the debug user-id clear domain-map command to remove the existing group mappings from the firewall. + +## PAN-171224 + +On the Panorama management server, a custom report (**Monitor** > **Managed Custom Reports**) with a high volume of unique data objects is not generated when you click **Run Now**. + +## PAN-171145 + +If you edit or remove the value for the `mail` attribute in your on-premise Active Directory, the changes may not be immediately reflected on the firewall after it syncs with the Cloud Identity Engine. + +## PAN-170923 + +In **Policies** > **Security** > **Policy Optimizer** > **New App Viewer**, when you select a Security policy rule in the bottom portion of the screen, the application data in the application browser (top portion of screen) does not match the Apps Seen on the selected rule. In addition, filtering in the application browser based on Apps Seen does not work. + +## PAN-170270 + +Using the CLI to power on a PA-5450 Networking Card (NC) in an Active HA firewall can cause its Passive peer to temporarily go down. + +## PAN-169906 + +The CN-Series Firewall as a Kubernetes Service does not support AF_XDP when deployed in CentOS. + +## PAN-168636 + +Connecting to the App-ID Cloud Engine (ACE) cloud using a management port with explicit proxy configured on it is not supported. Instead, use a data plane interface for the service route ([Prepare to Deploy App-ID Cloud Engine](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/app-id/cloud-based-app-id-service/prepare-to-deploy-app-id-cloud-engine.html) describes how to do this.) + +## PAN-168113 + +On the Panorama management server, you are unable to configure a master key (**Device** > **Master Key and Diagnostics**) for a managed firewall if an interface (**Network** > **Interfaces** > **Ethernet**) references a zone pushed from Panorama. + +**Workaround:** Remove the referenced zone from the interface configuration to successfully configure a master key. + +## PAN-167847 + +If you issue the command `opof stats`, then clear the results {opof stats -c}, the Active Sessions value is sometimes invalid. For example, you might see a negative number or an excessively large number. + +**Workaround:** Re-run the `opof stats` command after the offload completes. + +## PAN-167401 + +When a firewall or Panorama appliance configured with a proxy is upgraded to PAN-OS 10.0.3 or a later release, it fails to connect to edge service. + +## PAN-165669 + +If you configure a group that the firewall retrieves from the Cloud Identity Engine as the `user in` value in a filter query, Panorama is unable to retrieve the group membership and as a result, is unable to display this data in logs and custom reports. + +## PAN-164922 + +On the Panorama management server, a context switch to a managed firewall running a PAN-OS 8.1.0 to 8.1.19 release fails. + +## PAN-164885 + +```caveat +This issue is now resolved. See PAN-OS 10.1.14-h6 Addressed Issues +``` + +On the Panorama management server, pushes to managed firewalls (**Commit** > **Push to Devices** or **Commit and Push**) may fail when an EDL (**Objects** > **External Dynamic Lists**) is configured to **Check for updates** every 5 minutes due to the commit and EDL fetch processes overlapping. This is more likely to occur when multiple EDLs are configured to check for updates every 5 minutes. + +## PAN-164841 + +A successful deployment of a Panorama virtual appliance on Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform (GCP) is inaccessible when deploying using the PAN-OS 10.1.0-b6 release. + +## PAN-164647 + +On the Panorama management server, activating a license (**Panorama** > **Device Deployment** > **Licenses**) on managed firewalls in a high availability (HA) configuration causes the Safari web browser to become unresponsive. + +**Workaround:** [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) from a web browser other than Safari to successfully activate a license on managed firewalls in an HA configuration. + +## PAN-164618 + +The VM-Series firewall CLI and system logs display the license name `VM-SERIES-X`, while the user interface displays `VM-FLEX-X` (in both cases `X` is the number of vCPUs). In future releases the user interface will use the `VM-SERIES-X` format. + +## PAN-164586 + +If you use a value other than `mail` for the user or group email attribute in the Cloud Identity Engine, it displays in `user@domain` format in the CLI output. + +## PAN-163966 + +On the Panorama management server, the **ACC** and on demand reports (**Monitor** > **Manage Custom Reports**) are unable to fetch Directory Sync group membership when the Source User Group filter query is applied, resulting in no data being displayed for the filter when Directory Sync is configured as the Source User for a policy rule. + +## PAN-162836 + +On the VM-Series firewall, if you select **Device** > **Licenses** > **Deactivate VM** a popup window opens and you can choose **Subscriptions** or **Support** and press **Continue** to remove licenses and register the changes with the license server. When the license removal is complete the **Deactivate VM** window does not update its text to exclude deactivated licenses or close the window. + +**Workaround**: Wait until the license deactivation is complete, and click **Cancel** to close the window. + +## PAN-161666 + +The firewall includes any users configured in the Cloud Identity Engine in the count of groups. As a result, some CLI command output does not accurately display the number of groups the firewall has retrieved from the Cloud Identity Engine and counts users as groups in the `No. of Groups` in the command output. If the attempt to retrieve the user or group fails, the information for the user or group still displays in the CLI command output. + +## PAN-161451 + +If you issue the command `opof stats`, there are occasional zero packet and byte counts coming from the DPDK counters. This occurs when a session is in the tcp-reuse state, and has no impact on the existing session. + +## PAN-160238 + +If you migrate traffic from a firewall running a PAN-OS version earlier than 9.0 to a firewall running PAN-OS 9.0 or later, you experience intermittent VXLAN packet drops if TCI policy is not configured for inspecting VXLAN traffic flows. + +**Workaround:**On the new firewall, create an app override for VXLAN outer headers as described in [What is an Application Override?](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVLCA0) and the video tutorial [How to Configure an Application Override Policy on the Palo Alto Networks Firewall](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PPDrCAO). + +PAN-OS version 9.0 can inspect both inner and outer VXLAN flows. If you want to inspect inner flows, you must define a tunnel content inspection (TCI) policy. + +## PAN-157444 + +As a result of a telemetry handling update, the Source Zone field in the DNS analytics logs (viewable in the DNS Analytics tab within AutoFocus) might not display correct results. + +## PAN-157327 + +On downgrade to PAN-OS 9.1, Enterprise Data Loss Prevention (DLP) filtering settings (**Device** > **Setup** > **DLP**) are not removed and cause commit errors for the downgraded firewall if you do not uninstall the Enterprise DLP plugin before downgrade. + +**Workaround:** After you successfully downgrade a managed firewall to PAN-OS 9.1, commit and push from Panorama to remove the Enterprise DLP filtering settings and complete the downgrade. + +1. Downgrade your managed firewall to PAN-OS 9.1 +2. Log in to the firewall web interface and view the **Tasks** to verify all auto commits related to the downgrade have completed successfully. +3. Log in to the Panorama web interface and **Commit** > **Commit and Push** to your managed firewall downgraded to PAN-OS 9.1. + +## PAN-157103 + +Multi-channel functionality may not be properly utilized on an VM-Series firewall deployed in VMware NSX-V after the service is first deployed. + +**Workaround**: Execute the command `debug dataplane pow status` to view the number of channels being utilized by the dataplane. + +Per pan-task Netx statisticsCounter Name 1 2 3 4 5 6 Total---------------------------------------------ready_dvf 2 0 0 0 0 0 2 + +If multi-channel functionality is not working, disable your NSX-V security policy and reapply it. Then reboot the VM-Series firewall. When the firewall is back up, verify that multi-channel functionality is working by executing the command `debug dataplane pow status`. It should now show multiple channels being utilized. + +Per pan-task Netx statisticsCounter Name 1 2 3 4 5 6 Total---------------------------------------------ready_dvf 1 1 0 0 0 0 2 + +## PAN-156598 + +```caveat +Panorama only +``` + +If you configure a standard custom vulnerability signature in a custom Vulnerability Protection profile in a shared device group, the shared profile custom signatures do not populate in the other device groups when you configure a combination custom vulnerability signature. + +**Workaround:** Use the CLI to update the combination signature. + +## PAN-154292 + +On the Panorama management server, downgrading from a PAN-OS 10.0 release to a PAN-OS 9.1 release causes Panorama commit (**Commit** > **Commit to Panorama**) failures if a custom report (**Monitor** > **Manage Custom Reports**) is configured to Group By **Session ID**. + +**Workaround:** After successful downgrade, reconfigure the Group By setting in the custom report. + +## PAN-154034 + +On the Panorama management server, the Type column in the System logs (**Monitor** > **Logs** > **System**) for managed firewalls running a PAN-OS 9.1 release erroneously display `iot` as the type. + +## PAN-154032 + +On the Panorama management server, downgrading to PAN-OS 9.1 with the Panorama plugin for Cisco TrustSec version 1.0.2 installed does not automatically transform the plugin to be compatible with PAN-OS 9.1 + +**Workaround:** After successful downgrade to PAN-OS 9.1, **Remove Config** (**Panorama** > **Plugins**) of the Panorama plugin for Cisco TrustSec and then reconfigure the plugin. + +## PAN-153803 + +On the Panorama management server, scheduled email PDF reports (**Monitor** > **PDF Reports**) fail if a GIF image is used in the header or footer. + +## PAN-153557 + +On the Panorama management server CLI, the overall report status for a report query is marked as `Done` despite reports generated from logs in the Strata Logging Service from the PODamericas Collector Group jobs are still in a `Running` state. + +## PAN-153068 + +The Bonjour Reflector option is supported on up to 16 interfaces. If you enable it on more than 16 interfaces, the commit succeeds and the Bonjour Reflector option is enabled only for the first 16 interfaces and ignored for any additional interfaces. + +## PAN-151238 + +There is a known issue where M-100 appliances are able to download and install a PAN-OS 10.0 release image even though the M-100 appliance is no longer supported after PAN-OS 9.1. (Refer to the [hardware end-of-life dates](https://www.paloaltonetworks.com/services/support/end-of-life-announcements/hardware-end-of-life-dates.html).) + +## PAN-151085 + +On a PA-7000 Series firewall chassis having multiple slots, when HA clustering is enabled on an active/active HA pair, the session table count for one of the peers can show a higher count than the actual number of active sessions on that peer. This behavior can be seen when the session is being set up on a non-cache slot (for example, when a session distribution policy is set to round-robin or session-load); it is caused by the additional cache lookup that happens when HA cluster participation is enabled. + +## PAN-150801 + +Automatic quarantine of a device based on forwarding profile or log setting does not work on the PA-7000 Series firewalls. + +## PAN-150515 + +After you install the device certificate on a new Panorama management server, Panorama is not able to connect to the IoT Security edge service. + +**Workaround:** Restart Panorama to connect to the IoT Security edge service. + +## PAN-150345 + +During updates to the Device Dictionary, the IoT Security service does not push new Device-ID attributes (such as new device profiles) to the firewall until a manual commit occurs. + +**Workaround:** Perform a force commit to push the attributes in the content update to the firewall. + +## PAN-150361 + +In an Active-Passive high availability (HA) configuration, an error displays if you create a device object on the passive device. + +**Workaround:** Load the running configuration and perform a force commit to sync the devices. + +## PAN-148971 + +If you enter a search term for Events that are related to IoT in the System logs and apply the filter, the page displays an `Invalid term` error. + +**Workaround:** Specify `iot` as the **Type Attribute** to filter the logs and use the search term as the **Description Attribute**. For example: `( subtype eq iot ) and ( description contains 'gRPC connection' )`. + +## PAN-148924 + +In an active-passive HA configuration, tags for dynamic user groups are not persistent after rebooting the firewall because the active firewall does not sync the tags to the passive firewall during failover. + +## PAN-146995 + +After downgrading a Panorama management server from PAN-OS 10.0 to PAN-OS 9.1, the `VLD` and `logd` processes may crash when Panorama reboots. + +**Workaround:** Panorama automatically restarts the `VLD` and `logd` processes. + +## PAN-146807 + +Changing the device group configured in a monitoring definition from a child DG to a parent DG, or vice versa, might cause firewalls configured in the child DG to lose IP tag mapping information received from the monitoring definition. Only firewalls assigned to the parent DG receive IP tag mapping updates. + +**Workaround**: Perform a manual config sync on the device group that lost the IP tag mapping information. + +## PAN-146485 + +On the Panorama management server, adding, deleting, or modifying the upstream NAT configuration (**Panorama** > **SD-WAN** > **Devices**) does not display the branch template stack as `out of sync`. + +Additionally, adding, deleting, or modifying the BGP configuration (**Panorama** > **SD-WAN** > **Devices**) does not display the hub and branch template stacks as `out of sync`. For example, modifying the BGP configuration on the branch firewall does not cause the hub template stack to display as `out of sync`, nor does modifying the BGP configuration on the hub firewall cause the branch template stack as `out of sync`. + +**Workaround:** After performing a configuration change, **Commit and Push** the configuration changes to all hub and branch firewalls in the VPN cluster containing the firewall with the modified configuration. + +## PAN-145460 + +CN-MGMT pods fail to connect to the Panorama management server when using the Kubernetes plugin. + +**Workaround:** **Commit** the Panorama configuration after the CN-MGMT pod successfully registers with Panorama. + +## PAN-144889 + +On the Panorama management server, adding, deleting, or modifying the original subnet IP, or adding a new subnet after you successfully configure a tunnel IP subnet, for the SD-WAN 1.0.2 plugin does not display the managed firewall templates (**Panorama** > **Managed Devices** > **Summary**) as `Out of Sync`. + +**Workaround**: When modifying the original subnet IP, or adding a new subnet, push the template configuration changes to your managed firewalls and **Force Template Values** (**Commit** > **Push to Devices** > **Edit Selections**). + +## PAN-143132 + +Fetching the device certificate from the Palo Alto Networks Customer Support Portal (CSP) may fail and displays the following error in the CLI: + +`ERROR Failed to process S1C msg: Error` + +**Workaround:** Retrying fetching the device certificate from the Palo Alto Networks CSP. + +## PAN-141630 + +Current performance limitation: single data plane use only. The PA-5200 Series and PA-7000 Series firewalls that support 5G network slice security, 5G equipment ID security, and 5G subscriber ID security use a single data plane only, which currently limits the firewall performance. + +## PAN-140959 + +The Panorama management server allows you to downgrade Zero Touch Provisioning (ZTP) firewalls to PAN-OS 9.1.2 and earlier releases where ZTP functionality is not supported. + +## PAN-140008 + +ElasticSearch is forced to restart when the `masterd` process misses too many heartbeat messages on the Panorama management server resulting in a delay in a log query and ingestion. + +## PAN-136763 + +On the Panorama management server, managed firewalls display as `disconnected` when installing a PAN-OS software update (**Panorama** > **Device Deployment** > **Software**) but display as `connected` when you view your managed firewalls Summary (**Panorama** > **Managed Devices** > **Summary**) and from the CLI. + +**Workaround:** Log out and log back in to the Panorama web interface. + +## PAN-135742 + +There is an issue in HTTP2 session decryption where the App-ID in the decryption log is the App-ID of the parent session (which is web-browsing). + +## PAN-134053 + +ACC does not filter WildFire logs from Dynamic User Groups. + +## PAN-132598 + +The Panorama management server does not check for duplicate addresses in address groups (**Objects** > **Address Groups**) and duplicate services in service groups (**Objects** > **Service Groups**) when created from the CLI. + +## PAN-130550 + +```caveat +PA-3200 Series, PA-5220, PA-5250, PA-5260, and PA-7000 Series firewalls +``` + +For traffic between virtual systems (inter-vsys traffic), the firewall cannot perform source NAT using dynamic IP (DIP) address translation. + +**Workaround:** Use source NAT with Dynamic IP and Port (DIPP) translation on inter-vsys traffic. + +## PAN-127813 + +In the current release, SD-WAN auto-provisioning configures hubs and branches in a hub and spoke model, where branches don’t communicate with each other. Expected branch routes are for generic prefixes, which can be configured in the hub and advertised to all branches. Branches with unique prefixes are not published up to the hub. + +**Workaround:** Add any specific prefixes for branches to the hub advertise-list configuration. + +## PAN-127206 + +If you use the CLI to enable the cleartext option for the Include Username in HTTP Header Insertion Entries feature, the authentication request to the firewall may become unresponsive or time out. + +## PAN-123277 + +Dynamic tags from other sources are accessible using the CLI but do not display on the Panorama web interface. + +## PAN-123040 + +When you try to view network QoS statistics on an SD-WAN branch or hub, the QoS statistics and the hit count for the QoS rules don’t display. A workaround exists for this issue. Please contact Support for information about the workaround. + +## PAN-120440 + +There is an issue on M-500 Panorama management servers where any ethernet interface with an IPv6 address having Private PAN-DB-URL connectivity only supports the following format: `2001:DB9:85A3:0:0:8A2E:370:2`. + +## PAN-120423 + +PAN-OS 10.0.0 does not support the XML API for GlobalProtect logs. + +## PAN-120303 + +There is an issue where the firewall remains connected to the PAN-DB-URL server through the old management IP address on the M-500 Panorama management server, even when you configured the Eth1/1 interface. + +**Workaround:** Update the PAN-DB-URL IP address on the firewall using one of the methods below. + +- Modify the PAN-DB Server IP address on the managed firewall. + 1. On the web interface, delete the **PAN-DB Server** IP address (**Device** > **Setup** > **Content ID** > **URL Filtering** settings). + 2. **Commit** your changes. + 3. Add the new M-500 Eth1/1 IP PAN-DB IP address. + 4. **Commit** your changes. +- Restart the firewall (devsrvr) process. + 1. Log in to the firewall CLI. + 2. Restart the devsrvr process: `debug software restart process device-server` + +## PAN-116017 + +```caveat +Google Cloud Platform (GCP) only +``` + +The firewall does not accept the DNS value from the initial configuration (init-cfg) file when you bootstrap the firewall. + +**Workaround:** Add DNS value as part of the bootstrap.xml in the bootstrap folder and complete the bootstrap process. + +## PAN-115816 + +```caveat +Microsoft Azure only +``` + +There is an intermittent issue where an Ethernet (eth1) interface does not come up when you first boot up the firewall. + +**Workaround:** Reboot the firewall. + +## PAN-114495 + +Alibaba Cloud runs on a KVM hypervisor and supports two Virtio modes: DPDK (default) and MMAP. If you deploy a VM-Series firewall running PAN-OS 9.0 in DPDK packet mode and you then switch to MMAP packet mode, the VM-Series firewall duplicates packets that originate from or terminate on the firewall. As an example, if a load balancer or a server behind the firewall pings the VM-Series firewall after you switch from DPDK packet mode to MMAP packet mode, the firewall duplicates the ping packets. + +Throughput traffic is not duplicated if you deploy the VM-Series firewall using MMAP packet mode. + +## PAN-112694 + +```caveat +Firewalls with multiple virtual systems only +``` + +If you configure dynamic DNS (DDNS) on a new interface (associated with vsys1 or another virtual system) and you then create a **New** Certificate Profile from the drop-down, you must set the location for the Certificate Profile to Shared. If you configure DDNS on an existing interface and then create a new Certificate Profile, we also recommend that you choose the Shared location instead of a specific virtual system. Alternatively, you can select a preexisting certificate profile instead of creating a new one. + +## PAN-112456 + +You can temporarily submit a change request for a URL Category with three suggested categories; however, only two categories are supported. Do not add more than two suggested categories to a change request until we address this issue. If you submit more than two suggested categories, only the first two categories in the change request are evaluated. + +## PAN-112135 + +You cannot unregister tags for a subnet or range in a dynamic address group from the web interface. + +**Workaround:** Use an XML API request to unregister the tags for the subnet or range. + +## PAN-111928 + +Invalid configuration errors are not displayed as expected when you revert a Panorama management server configuration. + +**Workaround:** After you revert the Panorama configuration, **Commit** (**Commit** > **Commit to Panorama**) the reverted configuration to display the invalid configuration errors. + +## PAN-111866 + +The push scope selection on the Panorama web interface displays incorrectly even though the commit scope displays as expected. This issue occurs when one administrator makes configuration changes to separate device groups or templates that affect multiple firewalls and a different administrator attempts to push those changes. + +**Workaround:** Perform one of the following tasks. + +- Initiate a **Commit to Panorama** operation followed by a **Push to Devices** operation for the modified device group and template configurations. +- Manually select the devices that belong to the modified device group and template configurations. + +## PAN-111729 + +If you disable DPDK mode and enable it again, you must immediately reboot the firewall. + +## PAN-111670 + +Tagged VLAN traffic fails when sent through an SR-IOV adapter. + +## PAN-110794 + +DGA-based threats shown in the firewall threat log display the same name for all such instances. + +## PAN-109526 + +The system log does not correctly display the URL for CRL files; instead, the URLs are displayed with encoded characters. + +## PAN-104780 + +If you configure a HIP object to match only when a connecting endpoint is managed (**Objects** > **GlobalProtect** > **HIP Objects** > **** > **General** > **Managed**), iOS and Android endpoints that are managed by AirWatch are unable to successfully match the HIP object and the HIP report incorrectly indicates that these endpoints are not managed. This issue occurs because GlobalProtect gateways cannot correctly identify the managed status of these endpoints. + +Additionally, iOS endpoints that are managed by AirWatch are unable to match HIP objects based on the endpoint serial number because GlobalProtect gateways cannot identify the serial numbers of these endpoints; these serial numbers do not appear in the HIP report. + +## PAN-103276 + +Adding a disk to a virtual appliance running Panorama 8.1 or a later release on VMware ESXi 6.5 update1 causes the Panorama virtual appliance and host web client to become unresponsive. + +**Workaround:** Upgrade the ESXi host to ESXi 6.5 update2 and add the disk again. + +## PAN-101688 + +```caveat +Panorama plugins +``` + +The IP address-to-tag mapping information registered on a firewall or virtual system is not deleted when you remove the firewall or virtual system from a Device Group. + +**Workaround:** Log in to the CLI on the firewall and enter the following command to unregister the IP address-to-tag mappings: `debug object registered-ip clear all`. + +## PAN-101537 + +After you configure and push address and address group objects in Shared and vsys-specific device groups from the Panorama management server to managed firewalls, executing the `show log direction equal | in ` command on a managed firewall only returns address and address group objects pushed form the Shared device group. + +**Workaround:** Specify the vsys in the query string: + +`admin>` `set system target-vsys ` + +`admin>` `show log direction equal query equal ‘vsys eq ’ | in ` + +## PAN-98520 + +When booting or rebooting a PA-7000 Series Firewall with the SMC-B installed, the BIOS console output displays attempts to connect to the card's controller in the System Memory Speed section. The messages can be ignored. + +## PAN-97757 + +GlobalProtect authentication fails with an `Invalid username/password` error (because the user is not found in **Allow List**) after you enable GlobalProtect authentication cookies and add a RADIUS group to the **Allow List** of the authentication profile used to authenticate to GlobalProtect. + +**Workaround:** Disable GlobalProtect authentication cookies. Alternatively, disable (clear) **Retrieve user group from RADIUS** in the authentication profile and configure group mapping from Active Directory (AD) through LDAP. + +## PAN-97524 + +```caveat +Panorama management server only +``` + +The Security Zone and Virtual System columns (**Network** tab) display `None` after a Device Group and Template administrator with read-only privileges performs a context switch. + +## PAN-96446 + +A firewall that is not included in a Collector Group fails to generate a system log if logs are dropped when forwarded to a Panorama management server that is running in Management Only mode. + +## PAN-95773 + +On VM-Series firewalls that have Data Plane Development Kit (DPDK) enabled and that use the i40e network interface card (NIC), the `show session info` CLI command displays an inaccurate throughput and packet rate. + +**Workaround:** Disable DPDK by running the `set system setting dpdk-pkt-io off` CLI command. + +## PAN-95028 + +For administrator accounts that you created in PAN-OS 8.0.8 and earlier releases, the firewall does not apply password profile settings (**Device** > **Password Profiles**) until after you upgrade to PAN-OS 8.0.9 or a later release and then only after you modify the account passwords. (Administrator accounts that you create in PAN-OS 8.0.9 or a later release do not require you to change the passwords to apply password profile settings.) + +## PAN-94846 + +When DPDK is enabled on the VM-Series firewall with i40e virtual function (VF) driver, the VF does not detect the link status of the physical link. The VF link status remains up, regardless of changes to the physical link state. + +## PAN-94093 + +HTTP Header Insertion does not work when jumbo frames are received out of order. + +## PAN-93968 + +The firewall and Panorama web interfaces display vulnerability threat IDs that are not available in PAN-OS 9.0 releases (**Objects** > **Security Profiles** > **Vulnerability Protection** > **** > **Exceptions**). To confirm whether a particular threat ID is available in your release, monitor the release notes for each new Applications and Threats content update or check the Palo Alto Networks [Threat Vault](https://threatvault.paloaltonetworks.com) to see the minimum PAN-OS release version for a threat signature. + +## PAN-93607 + +When you configure a VM-500 firewall with an SCTP Protection profile (**Objects** > **Security Profiles** > **SCTP Protection**) and you try to add the profile to an existing Security Profile Group (**Objects** > **Security Profile Groups**), the Security Profile Group doesn’t list the SCTP Protection profile in its drop-down list of available profiles. + +**Workaround:** Create a new Security Profile Group and select the SCTP Protection profile from there. + +## PAN-93532 + +When you configure a firewall running PAN-OS 9.0 as an nCipher HSM client, the web interface on the firewall displays the nCipher server status as Not Authenticated, even though the HSM state is up (**Device** > **Setup** > **HSM**). + +## PAN-93193 + +The memory-optimized VM-50 Lite intermittently performs slowly and stops processing traffic when memory utilization is critically high. To prevent this issue, make sure that you do not: + +- Switch to the firewall **Context** on the Panorama management server. +- Commit changes when a dynamic update is being installed. +- Generate a custom report when a dynamic update is being installed. +- Generate custom reports during a commit. + +**Workaround:** When the firewall performs slowly, or you see a critical System log for memory utilization, wait for 5 minutes and then manually reboot the firewall. + +Use the Task Manager to verify that you are not performing memory intensive tasks such as installing dynamic updates, committing changes or generating reports, at the same time, on the firewall. + +## PAN-91802 + +On a VM-Series firewall, the **clear session all** CLI command does not clear GTP sessions. + +## PAN-83610 + +In rare cases, a PA-5200 Series firewall (with an FE100 network processor) that has session offload enabled (default) incorrectly resets the UDP checksum of outgoing UDP packets. + +**Workaround:** In PAN-OS 8.0.6 and later releases, you can persistently disable session offload for only UDP traffic using the `set session udp-off load no` CLI command. + +## PAN-83236 + +The VM-Series firewall on Google Cloud Platform does not publish firewall metrics to Google Stack Monitoring when you manually configure a DNS server IP address (**Device** > **Setup** > **Services**). + +**Workaround:** The VM-Series firewall on Google Cloud Platform must use the DNS server that Google provides. + +## PAN-83215 + +SSL decryption based on ECDSA certificates does not work when you import the ECDSA private keys onto an nCipher nShield hardware security module (HSM). + +## PAN-81521 + +Endpoints failed to authenticate to GlobalProtect through Kerberos when you specify an FQDN instead of an IP address in the Kerberos server profile (**Device** > **Server Profiles** > **Kerberos**). + +**Workaround:** Replace the FQDN with the IP address in the Kerberos server profile. + +## PAN-77125 + +PA-7000 Series, PA-5450, PA-5200 Series, and PA-3200 Series firewalls configured in tap mode don’t close offloaded sessions after processing the associated traffic; the sessions remain open until they time out. + +**Workaround:** Configure the firewalls in virtual wire mode instead of tap mode, or disable session offloading by running the `set session off load no` CLI command. + +## PAN-75457 + +In WildFire appliance clusters that have three or more nodes, the Panorama management server does not support changing node roles. In a three-node cluster for example, you cannot use Panorama to configure the worker node as a controller node by adding the HA and cluster controller configurations, configure an existing controller node as a worker node by removing the HA configuration, and then commit and push the configuration. Attempts to change cluster node roles from Panorama results in a validation error—the commit fails and the cluster becomes unresponsive. + +## PAN-73530 + +The firewall does not generate a packet capture (pcap) when a Data Filtering profile blocks files. + +## PAN-73401 + +When you import a two-node WildFire appliance cluster into the Panorama management server, the controller nodes report their state as out-of-sync if either of the following conditions exist: + +- You did not configure a worker list to add at least one worker node to the cluster. (In a two-node cluster, both nodes are controller nodes configured as an HA pair. Adding a worker node would make the cluster a three-node cluster.) +- You did not configure a service advertisement (either by enabling or not enabling advertising DNS service on the controller nodes). + +**Workaround:** There are three possible workarounds to sync the controller nodes: + +- After you import the two-node cluster into Panorama, push the configuration from Panorama to the cluster. After the push succeeds, Panorama reports that the controller nodes are in sync. +- Configure a worker list on the cluster controller: + admin@wf500(active-controller)# `set deviceconfig cluster mode controller worker-list ` + (`` is the IP address of the worker node you are adding to the cluster.) This creates a three-node cluster. After you import the cluster into Panorama, Panorama reports that the controller nodes are in sync. When you want the cluster to have only two nodes, use a different workaround. +- Configure service advertisement on the local CLI of the cluster controller and then import the configuration into Panorama. The service advertisement can advertise that DNS is or is not enabled. + admin@wf500(active-controller)# `set deviceconfig cluster mode controller service-advertisement dns-service enabled yes` + or + admin@wf500(active-controller)# `set deviceconfig cluster mode controller service-advertisement dns-service enabled no` + Both commands result in Panorama reporting that the controller nodes are in sync. + +## PAN-70906 + +If the PAN-OS web interface and the GlobalProtect portal are enabled on the same IP address, then when a user logs out of the GlobalProtect portal, the administrative user is also logged out from the PAN-OS web interface. + +**Workaround:** Use the IP address to access the PAN-OS web interface and an FQDN to access the GlobalProtect portal. + +## PAN-69505 + +When viewing an external dynamic list that requires client authentication and you **Test Source URL**, the firewall fails to indicate whether it can reach the external dynamic list server and returns a URL access error (**Objects** > **External Dynamic Lists**). + +## PAN-40079 + +The VM-Series firewall on KVM, for all supported Linux distributions, does not support the Broadcom network adapters for PCI pass-through functionality. + +## PAN-39636 + +Regardless of the **Time Frame** you specify for a scheduled custom report on a Panorama M-Series appliance, the earliest possible start date for the report data is effectively the date when you configured the report (**Monitor** > **Manage Custom Reports**). For example, if you configure the report on the 15th of the month and set the **Time Frame** to **Last 30 Days**, the report that Panorama generates on the 16th will include only data from the 15th onward. This issue applies only to scheduled reports; on-demand reports include all data within the specified **Time Frame**. + +**Workaround:** To generate an on-demand report, click **Run Now** when you configure the custom report. + +## PAN-38255 + +When you perform a factory reset on a Panorama virtual appliance and configure the serial number, logging does not work until you reboot Panorama or execute the `debug software restart process management-server` CLI command. + +## PAN-31832 + +The following issues apply when configuring a firewall to use a hardware security module (HSM): + +- **nCipher nShield Connect**—The firewall requires at least four minutes to detect that an HSM was disconnected, causing SSL functionality to be unavailable during the delay. +- **SafeNet Network**—When losing connectivity to either or both HSMs in an HA configuration, the display of information from the `show high-availability state` and `show hsm info` commands are blocked for 20 seconds. diff --git a/web/data/issues/PAN-OS/known/10.1.14_2026-03-16.md b/web/data/issues/PAN-OS/known/10.1.14_2026-03-16.md new file mode 100644 index 0000000..7703878 --- /dev/null +++ b/web/data/issues/PAN-OS/known/10.1.14_2026-03-16.md @@ -0,0 +1,867 @@ +--- +type: Known +product: PAN-OS +version: 10.1.14 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## APL-15000 + +When you move a firewall from one Strata Logging Service instance to another, it can take up to an hour for the firewall to begin sending logs to the new instance. + +## APL-8269 + +For data retrieved from Strata Logging Service, the Threat Name column in **Panorama** > **ACC** > **threat-activity** appears blank. + +## PLUG-14947 + +If you are using the Panorama plugin for Azure, do not upgrade to PAN-OS 10.1.12. When installed on 10.1.12, the Panorama plugin for Azure fails to connect to Azure. + +## PLUG-12041 + +On an OpenShift cluster, MP pod may crash when the number of underlying threads exceeds beyond the per pod maximum limit of 1024. + +**Workaround:** Increase the process ID (PID) limit to 2048 in worker nodes. + +## PLUG-380 + +When you rename a device group, template, or template stack in Panorama that is part of a VMware NSX service definition, the new name is not reflected in NSX Manager. Therefore, any ESXi hosts that you add to a vSphere cluster are not added to the correct device group, template, or template stack and your Security policy is not pushed to VM-Series firewalls that you deploy after you rename those objects. There is no impact to existing VM-Series firewalls. + +## WF500-5559 + +An intermittent error while analyzing signed PE samples on the WildFire appliance might cause analysis failures. + +## WF500-5471 + +After using the firewall CLI to add a WildFire appliance with an IPv6 address, the initial connection may fail. + +**Workaround:** Retry connecting after you restart the web server with the following command: `debug software restart process web-server`. + +## PAN-281370 + +The Advanced WildFire Inline ML models **OOXML** and **Mach-O** erroneously display as being available from the CLI; however, they are only available on PAN-OS 11.1.3 and later releases. + +## PAN-279746 + +An SSL/TLS Client Hello may not be sent if the Client Hello arrives at the firewall in multiple TCP segments and the traffic is not subject to SSL decryption. + +## PAN-279604 + +```caveat +(PAN-OS 10.1.14-h9 only) This issue is now resolved. See PAN-OS 10.1.14-h10 Addressed Issues. +``` + +The scheduled SaaS application usage reports are incorrectly generated and only the login page appears instead of the intended report content. + +## PAN-260851 + +From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (**Objects** > **Applications**) tag. + +## PAN-242784 + +```caveat +This issue affects PAN-OS 10.1.11-h4 only. +``` + +DNS resolution may fail if DNS server IP is obtained through DHCP. + +**Workaround:** Configure the DNS server with a static IP or renew the DHCP IP when you see the issue. + +## PAN-238769 + +FIPS-CC VM-Series only. Upgrading to PAN-OS 10.1.10-h2 or PAN-OS 10.1.11 changes all locally created Security policy actions to Deny. + +**Workaround:** Before upgrading, save a backup of the current configuration. After upgrading, load the backup configuration to restore the security policy action settings. + +## PAN-237106 + +LSVPN satellite certificates may be generated with serial numbers exceeding 40 hexadecimal characters. This causes certificate revocation and deletion operations to fail with the following error messages: + +- `db-serialno can be at most 40 characters` +- `db-serialno is invalid` + +**Workaround:** + +To resolve this issue, use the following CLI commands with the LSVPN satellite serial number to manually delete or revoke the affected certificates: + +**Delete certificate information**:`delete sslmgr-store certificate-info portal name serialno ` + +**Revoke satellite certificates**:`delete sslmgr-store satellite-info-revoke-certificate portal serialno ` + +## PAN-235741 + +```caveat +This issue affects PAN-OS 10.1.11-h4 only. +``` + +DNS resolution fails for firewall and Panorama plugins if the DNS Server IP address is obtained through DHCP. + +## PAN-231658 + +```caveat +This issue affects PAN-OS 10.1.11-h5 only. +``` + +DNS resolution fails when interfaces are configured as DHCP and a DNS server is provided via DHCP while also statically configured with DNS servers. + +## PAN-230106 + +```caveat +This issue affects PAN-OS 10.1.11-h5 only. +``` + +The firewall is unable to retrieve the most current external dynamic list information from the server due to hostname resolution failure. + +## PAN-227344 + +On the Panorama management server, PDF Summary Reports (**Monitor** > **PDF Reports** > **Manage PDF Summary**) display no data and are blank when predefined reports are included in the summary report. + +## PAN-223365 + +The Panorama management server is unable to query any logs if the ElasticSearch health status for any Log Collector (**Panorama** > **Managed Collector** is degraded. + +**Workaround:** [Log in to the Log Collector CLI](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli) and restart ElasticSearch. + +`admin``debug elasticsearch es-restart all` + +## PAN-219824 + +File system checks on the logging drive may take more time depending on the usage and file system content, resulting in autocommits taking longer to complete than expected. + +## PAN-218521 + +The ElasticSearch process on the M-600 appliance in Log Collector mode may enter a continuous reboot cycle. This results in the M-600 appliance becoming unresponsive, consuming logging disk space, and preventing new log ingestion. + +## PAN-213746 + +On the Panorama management server, the **Hostkey** displayed as `undefined undefined` if you override an SSH Service Profile (**Device** > **Certificate Management** > **SSH Service Profile**) Hostkey configured in a Template from the Template Stack. + +## PAN-212978 + +The Palo Alto Networks firewall stops responding when executing an SD-WAN debug operational CLI command. + +## PAN-211728 + +For VM-Series firewalls leveraging SD-WAN and deployed on VMware ESXi running VMX-13, Auto-Commits fail after upgrade to PAN-OS 10.1.9 and display the error: + +`total SD-WAN interfaces 3 exceed the platform maximum 0` + +**Workaround:** Attach a serial console to the VM-Series firewall before upgrade to PAN-OS 10.1.9. + +## PAN-204689 + +Upon upgrade to PAN-OS 10.1.9, the following GlobalProtect settings do not work: + +- **Allow user to disconnect GlobalProtect App** > **Allow with Passcode** +- **Allow user to Disable GlobalProtect App** > **Allow with Passcode** +- **Allow User to Uninstall GlobalProtect App** > **Allow with Password** + +## PAN-200081 + +When FIPS mode is enabled on VM-Series firewall in Microsoft Azure environments, HA failover does not trigger the secondary IP address movement. + +## PAN-197341 + +On the Panorama management server, if you create multiple device group **Objects** with the same name in the Shared device group and any additional device groups (**Panorama** > **Device Groups**) under the same device group hierarchy that are used in one or more **Policies**, renaming the object with a shared name in any device group causes the object name to change in the policies where it is used. This issue applies only to device group objects that can be referenced in a Security policy rule. + +For example: + +1. You create a parent device group `DG-A` and a child device group `DG-B`. +2. You create address objects called `AddressObjA` in the `Shared`, `DG-A` and `DG-B` device groups and add `AddressObjA` to a Security policy rule under `DG-A` and `DG-B`. +3. Later, you change the `AddressObjA` name in the `Shared` device group to `AddressObjB`. + +Changing the name of the address object in the `Shared` device group causes the references in the Policy rule to use the renamed `Shared` object instead of the device group object. + +## PAN-196758 + +On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you **Preview Changes** (**Commit** > **Push to Devices** > **Edit Selections** or **Commit** > **Commit and Push** > **Edit Selections**). + +## PAN-194515 + +```caveat +PA-5450 firewall only +``` + +The Panorama web interface does not display any predefined template stack variables in the dropdown menu under **Device** > **Setup** > **Log Interface** > **IP Address**. + +**Workaround:** Configure the log interface IP address on the individual firewall web interface instead of on Panorama. + +## PAN-194424 + +```caveat +PA-5450 firewall only +``` + +Upgrading to PAN-OS 10.1.6-h2 while having a log interface configured can cause both the log interface and the management interface to remain connected to the log collector. + +**Workaround:** Restart the log receiver service by running the following CLI command: + +`debug software restart process log-receiver` + +## PAN-194202 + +```caveat +PA-5450 firewall only +``` + +If the management interface and Log Collector are configured on the same subnetwork, the firewall conducts log forwarding using the management interface instead of the logging interface. + +## PAN-193518 + +All logs (**Monitor** > **Logs**) generated by a firewall running a PAN-OS 10.0 release are not accessible if you downgrade from PAN-OS 10.1 to PAN-OS 10.0, and then upgrade back to PAN-OS 10.1. + +**Workaround:** If you need to downgrade from PAN-OS 10.1 to PAN-OS 10.0 and then back to PAN-OS 10.1, downgrade to PAN-OS 10.0.11 to ensure that all logs ingested while running a PAN-OS 10.0 release remain accessible after upgrade back to PAN-OS 10.1. + +## PAN-188052 + +Devices in FIPS-CC mode are unable to connect to servers utilizing ECDSA-based host keys that impacts exporting logs (**Device** > **Scheduled Log Export**), exporting configurations (**Device** > **Scheduled Config Export**), or the `scp export` command in the CLI. + +**Workaround:** Use RSA-based host keys on the destination server. + +## PAN-187685 + +On the Panorama management server, the Template Status displays no synchronization status (**Panorama** > **Managed Devices** > **Summary**) after a bootstrapped firewall is successfully added to Panorama. + +**Workaround:** After the bootstrapped firewall is successfully added to Panorama, [log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) and select **Commit** > **Push to Devices**. + +## PAN-179888 + +On the Panorama management server, the number of managed firewall (**Panorama** > **Managed Devices** > **Health**) `Power Supplies` displays an incorrect count of power supplies. + +## PAN-174982 + +In HA active/active configurations where, when interfaces that were associated with a virtual router were deleted, the configuration change did not sync. + +## PAN-172274 + +When you activate the advanced URL filtering license, your license entitlements for PAN-DB and advanced URL filtering might not display correctly on the firewall — this is a display anomaly, not a licensing issue, and does not affect access to the services. + +**Workaround:** Issue the following command to retrieve and update the licenses: `license request fetch`. + +## PAN-172113 + +If you request a User Activity Report on Panorama and the vsys key value in the XML is an unsupported value, the resulting job becomes unresponsive at 10% and does not complete until you manually stop the job in the web interface. + +**Workaround:**Change the vsys key to a valid device group, commit your changes, and run the User Activity Report again. + +## PAN-172067 + +When you configure an HTTP server profile (**Device** > **Server Profiles** > **HTTP** or **Panorama** > **Server Profiles** > **HTTP**), the **Username** and **Password** fields are always required regardless of whether **Tag Registration** is enabled. + +**Workaround:** When you configure an HTTP server profile, always enter a username and password to successfully create the HTTP server profile. + +You must enter a username and password even if the HTTP server does not require it. The HTTP server ignores the username and password if they are not required for the firewall to connect. + +## PAN-172061 + +A process (`all_pktproc`) can cause intermittent crashes on the Passive PA-5450 firewall in an Active/Passive HA pair. This issue may be seen during an upgrade or reload of the firewall with traffic and when clearing sessions. + +## PAN-171938 + +No results are displayed when you **Show Application Filter** for a Security policy rule (**Policies** > **Security** > **Application** > **Value** > **Show Application Filter**). + +## PAN-171723 + +If you use Panorama to push a configuration that uses App-ID Cloud Engine (ACE) App-IDs and then you downgrade the firewall from PAN-OS 10.1 to PAN-OS 10.0, the installation succeeds but after you reboot, the auto-commit fails. + +**Workaround:** Remove all ACE application configurations before downgrading. + +## PAN-171673 + +On the Panorama management server, the **ACC** returns inaccurate results when you filter for **New App-ID** in the **Application** usage widget. + +## PAN-171635 + +If you have an on-premise Active Directory and there is an existing group mapping configuration on the firewall, if you migrate the group mapping to the Cloud Identity Engine, the firewall does not remove the existing group mapping even if the configuration is disabled and the firewall is rebooted, which may conflict with new mappings from the Cloud Identity Engine. + +**Workaround**: Use the debug user-id clear domain-map command to remove the existing group mappings from the firewall. + +## PAN-171224 + +On the Panorama management server, a custom report (**Monitor** > **Managed Custom Reports**) with a high volume of unique data objects is not generated when you click **Run Now**. + +## PAN-171145 + +If you edit or remove the value for the `mail` attribute in your on-premise Active Directory, the changes may not be immediately reflected on the firewall after it syncs with the Cloud Identity Engine. + +## PAN-170923 + +In **Policies** > **Security** > **Policy Optimizer** > **New App Viewer**, when you select a Security policy rule in the bottom portion of the screen, the application data in the application browser (top portion of screen) does not match the Apps Seen on the selected rule. In addition, filtering in the application browser based on Apps Seen does not work. + +## PAN-170270 + +Using the CLI to power on a PA-5450 Networking Card (NC) in an Active HA firewall can cause its Passive peer to temporarily go down. + +## PAN-169906 + +The CN-Series Firewall as a Kubernetes Service does not support AF_XDP when deployed in CentOS. + +## PAN-168636 + +Connecting to the App-ID Cloud Engine (ACE) cloud using a management port with explicit proxy configured on it is not supported. Instead, use a data plane interface for the service route ([Prepare to Deploy App-ID Cloud Engine](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/app-id/cloud-based-app-id-service/prepare-to-deploy-app-id-cloud-engine.html) describes how to do this.) + +## PAN-168113 + +On the Panorama management server, you are unable to configure a master key (**Device** > **Master Key and Diagnostics**) for a managed firewall if an interface (**Network** > **Interfaces** > **Ethernet**) references a zone pushed from Panorama. + +**Workaround:** Remove the referenced zone from the interface configuration to successfully configure a master key. + +## PAN-167847 + +If you issue the command `opof stats`, then clear the results {opof stats -c}, the Active Sessions value is sometimes invalid. For example, you might see a negative number or an excessively large number. + +**Workaround:** Re-run the `opof stats` command after the offload completes. + +## PAN-167401 + +When a firewall or Panorama appliance configured with a proxy is upgraded to PAN-OS 10.0.3 or a later release, it fails to connect to edge service. + +## PAN-165669 + +If you configure a group that the firewall retrieves from the Cloud Identity Engine as the `user in` value in a filter query, Panorama is unable to retrieve the group membership and as a result, is unable to display this data in logs and custom reports. + +## PAN-164922 + +On the Panorama management server, a context switch to a managed firewall running a PAN-OS 8.1.0 to 8.1.19 release fails. + +## PAN-164885 + +```caveat +This issue is now resolved. See PAN-OS 10.1.14-h6 Addressed Issues +``` + +On the Panorama management server, pushes to managed firewalls (**Commit** > **Push to Devices** or **Commit and Push**) may fail when an EDL (**Objects** > **External Dynamic Lists**) is configured to **Check for updates** every 5 minutes due to the commit and EDL fetch processes overlapping. This is more likely to occur when multiple EDLs are configured to check for updates every 5 minutes. + +## PAN-164841 + +A successful deployment of a Panorama virtual appliance on Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform (GCP) is inaccessible when deploying using the PAN-OS 10.1.0-b6 release. + +## PAN-164647 + +On the Panorama management server, activating a license (**Panorama** > **Device Deployment** > **Licenses**) on managed firewalls in a high availability (HA) configuration causes the Safari web browser to become unresponsive. + +**Workaround:** [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) from a web browser other than Safari to successfully activate a license on managed firewalls in an HA configuration. + +## PAN-164618 + +The VM-Series firewall CLI and system logs display the license name `VM-SERIES-X`, while the user interface displays `VM-FLEX-X` (in both cases `X` is the number of vCPUs). In future releases the user interface will use the `VM-SERIES-X` format. + +## PAN-164586 + +If you use a value other than `mail` for the user or group email attribute in the Cloud Identity Engine, it displays in `user@domain` format in the CLI output. + +## PAN-163966 + +On the Panorama management server, the **ACC** and on demand reports (**Monitor** > **Manage Custom Reports**) are unable to fetch Directory Sync group membership when the Source User Group filter query is applied, resulting in no data being displayed for the filter when Directory Sync is configured as the Source User for a policy rule. + +## PAN-162836 + +On the VM-Series firewall, if you select **Device** > **Licenses** > **Deactivate VM** a popup window opens and you can choose **Subscriptions** or **Support** and press **Continue** to remove licenses and register the changes with the license server. When the license removal is complete the **Deactivate VM** window does not update its text to exclude deactivated licenses or close the window. + +**Workaround**: Wait until the license deactivation is complete, and click **Cancel** to close the window. + +## PAN-161666 + +The firewall includes any users configured in the Cloud Identity Engine in the count of groups. As a result, some CLI command output does not accurately display the number of groups the firewall has retrieved from the Cloud Identity Engine and counts users as groups in the `No. of Groups` in the command output. If the attempt to retrieve the user or group fails, the information for the user or group still displays in the CLI command output. + +## PAN-161451 + +If you issue the command `opof stats`, there are occasional zero packet and byte counts coming from the DPDK counters. This occurs when a session is in the tcp-reuse state, and has no impact on the existing session. + +## PAN-160238 + +If you migrate traffic from a firewall running a PAN-OS version earlier than 9.0 to a firewall running PAN-OS 9.0 or later, you experience intermittent VXLAN packet drops if TCI policy is not configured for inspecting VXLAN traffic flows. + +**Workaround:**On the new firewall, create an app override for VXLAN outer headers as described in [What is an Application Override?](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVLCA0) and the video tutorial [How to Configure an Application Override Policy on the Palo Alto Networks Firewall](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PPDrCAO). + +PAN-OS version 9.0 can inspect both inner and outer VXLAN flows. If you want to inspect inner flows, you must define a tunnel content inspection (TCI) policy. + +## PAN-157444 + +As a result of a telemetry handling update, the Source Zone field in the DNS analytics logs (viewable in the DNS Analytics tab within AutoFocus) might not display correct results. + +## PAN-157327 + +On downgrade to PAN-OS 9.1, Enterprise Data Loss Prevention (DLP) filtering settings (**Device** > **Setup** > **DLP**) are not removed and cause commit errors for the downgraded firewall if you do not uninstall the Enterprise DLP plugin before downgrade. + +**Workaround:** After you successfully downgrade a managed firewall to PAN-OS 9.1, commit and push from Panorama to remove the Enterprise DLP filtering settings and complete the downgrade. + +1. Downgrade your managed firewall to PAN-OS 9.1 +2. Log in to the firewall web interface and view the **Tasks** to verify all auto commits related to the downgrade have completed successfully. +3. Log in to the Panorama web interface and **Commit** > **Commit and Push** to your managed firewall downgraded to PAN-OS 9.1. + +## PAN-157103 + +Multi-channel functionality may not be properly utilized on an VM-Series firewall deployed in VMware NSX-V after the service is first deployed. + +**Workaround**: Execute the command `debug dataplane pow status` to view the number of channels being utilized by the dataplane. + +Per pan-task Netx statisticsCounter Name 1 2 3 4 5 6 Total---------------------------------------------ready_dvf 2 0 0 0 0 0 2 + +If multi-channel functionality is not working, disable your NSX-V security policy and reapply it. Then reboot the VM-Series firewall. When the firewall is back up, verify that multi-channel functionality is working by executing the command `debug dataplane pow status`. It should now show multiple channels being utilized. + +Per pan-task Netx statisticsCounter Name 1 2 3 4 5 6 Total---------------------------------------------ready_dvf 1 1 0 0 0 0 2 + +## PAN-156598 + +```caveat +Panorama only +``` + +If you configure a standard custom vulnerability signature in a custom Vulnerability Protection profile in a shared device group, the shared profile custom signatures do not populate in the other device groups when you configure a combination custom vulnerability signature. + +**Workaround:** Use the CLI to update the combination signature. + +## PAN-154292 + +On the Panorama management server, downgrading from a PAN-OS 10.0 release to a PAN-OS 9.1 release causes Panorama commit (**Commit** > **Commit to Panorama**) failures if a custom report (**Monitor** > **Manage Custom Reports**) is configured to Group By **Session ID**. + +**Workaround:** After successful downgrade, reconfigure the Group By setting in the custom report. + +## PAN-154034 + +On the Panorama management server, the Type column in the System logs (**Monitor** > **Logs** > **System**) for managed firewalls running a PAN-OS 9.1 release erroneously display `iot` as the type. + +## PAN-154032 + +On the Panorama management server, downgrading to PAN-OS 9.1 with the Panorama plugin for Cisco TrustSec version 1.0.2 installed does not automatically transform the plugin to be compatible with PAN-OS 9.1 + +**Workaround:** After successful downgrade to PAN-OS 9.1, **Remove Config** (**Panorama** > **Plugins**) of the Panorama plugin for Cisco TrustSec and then reconfigure the plugin. + +## PAN-153803 + +On the Panorama management server, scheduled email PDF reports (**Monitor** > **PDF Reports**) fail if a GIF image is used in the header or footer. + +## PAN-153557 + +On the Panorama management server CLI, the overall report status for a report query is marked as `Done` despite reports generated from logs in the Strata Logging Service from the PODamericas Collector Group jobs are still in a `Running` state. + +## PAN-153068 + +The Bonjour Reflector option is supported on up to 16 interfaces. If you enable it on more than 16 interfaces, the commit succeeds and the Bonjour Reflector option is enabled only for the first 16 interfaces and ignored for any additional interfaces. + +## PAN-151238 + +There is a known issue where M-100 appliances are able to download and install a PAN-OS 10.0 release image even though the M-100 appliance is no longer supported after PAN-OS 9.1. (Refer to the [hardware end-of-life dates](https://www.paloaltonetworks.com/services/support/end-of-life-announcements/hardware-end-of-life-dates.html).) + +## PAN-151085 + +On a PA-7000 Series firewall chassis having multiple slots, when HA clustering is enabled on an active/active HA pair, the session table count for one of the peers can show a higher count than the actual number of active sessions on that peer. This behavior can be seen when the session is being set up on a non-cache slot (for example, when a session distribution policy is set to round-robin or session-load); it is caused by the additional cache lookup that happens when HA cluster participation is enabled. + +## PAN-150801 + +Automatic quarantine of a device based on forwarding profile or log setting does not work on the PA-7000 Series firewalls. + +## PAN-150515 + +After you install the device certificate on a new Panorama management server, Panorama is not able to connect to the IoT Security edge service. + +**Workaround:** Restart Panorama to connect to the IoT Security edge service. + +## PAN-150345 + +During updates to the Device Dictionary, the IoT Security service does not push new Device-ID attributes (such as new device profiles) to the firewall until a manual commit occurs. + +**Workaround:** Perform a force commit to push the attributes in the content update to the firewall. + +## PAN-150361 + +In an Active-Passive high availability (HA) configuration, an error displays if you create a device object on the passive device. + +**Workaround:** Load the running configuration and perform a force commit to sync the devices. + +## PAN-148971 + +If you enter a search term for Events that are related to IoT in the System logs and apply the filter, the page displays an `Invalid term` error. + +**Workaround:** Specify `iot` as the **Type Attribute** to filter the logs and use the search term as the **Description Attribute**. For example: `( subtype eq iot ) and ( description contains 'gRPC connection' )`. + +## PAN-148924 + +In an active-passive HA configuration, tags for dynamic user groups are not persistent after rebooting the firewall because the active firewall does not sync the tags to the passive firewall during failover. + +## PAN-146995 + +After downgrading a Panorama management server from PAN-OS 10.0 to PAN-OS 9.1, the `VLD` and `logd` processes may crash when Panorama reboots. + +**Workaround:** Panorama automatically restarts the `VLD` and `logd` processes. + +## PAN-146807 + +Changing the device group configured in a monitoring definition from a child DG to a parent DG, or vice versa, might cause firewalls configured in the child DG to lose IP tag mapping information received from the monitoring definition. Only firewalls assigned to the parent DG receive IP tag mapping updates. + +**Workaround**: Perform a manual config sync on the device group that lost the IP tag mapping information. + +## PAN-146485 + +On the Panorama management server, adding, deleting, or modifying the upstream NAT configuration (**Panorama** > **SD-WAN** > **Devices**) does not display the branch template stack as `out of sync`. + +Additionally, adding, deleting, or modifying the BGP configuration (**Panorama** > **SD-WAN** > **Devices**) does not display the hub and branch template stacks as `out of sync`. For example, modifying the BGP configuration on the branch firewall does not cause the hub template stack to display as `out of sync`, nor does modifying the BGP configuration on the hub firewall cause the branch template stack as `out of sync`. + +**Workaround:** After performing a configuration change, **Commit and Push** the configuration changes to all hub and branch firewalls in the VPN cluster containing the firewall with the modified configuration. + +## PAN-145460 + +CN-MGMT pods fail to connect to the Panorama management server when using the Kubernetes plugin. + +**Workaround:** **Commit** the Panorama configuration after the CN-MGMT pod successfully registers with Panorama. + +## PAN-144889 + +On the Panorama management server, adding, deleting, or modifying the original subnet IP, or adding a new subnet after you successfully configure a tunnel IP subnet, for the SD-WAN 1.0.2 plugin does not display the managed firewall templates (**Panorama** > **Managed Devices** > **Summary**) as `Out of Sync`. + +**Workaround**: When modifying the original subnet IP, or adding a new subnet, push the template configuration changes to your managed firewalls and **Force Template Values** (**Commit** > **Push to Devices** > **Edit Selections**). + +## PAN-143132 + +Fetching the device certificate from the Palo Alto Networks Customer Support Portal (CSP) may fail and displays the following error in the CLI: + +`ERROR Failed to process S1C msg: Error` + +**Workaround:** Retrying fetching the device certificate from the Palo Alto Networks CSP. + +## PAN-141630 + +Current performance limitation: single data plane use only. The PA-5200 Series and PA-7000 Series firewalls that support 5G network slice security, 5G equipment ID security, and 5G subscriber ID security use a single data plane only, which currently limits the firewall performance. + +## PAN-140959 + +The Panorama management server allows you to downgrade Zero Touch Provisioning (ZTP) firewalls to PAN-OS 9.1.2 and earlier releases where ZTP functionality is not supported. + +## PAN-140008 + +ElasticSearch is forced to restart when the `masterd` process misses too many heartbeat messages on the Panorama management server resulting in a delay in a log query and ingestion. + +## PAN-136763 + +On the Panorama management server, managed firewalls display as `disconnected` when installing a PAN-OS software update (**Panorama** > **Device Deployment** > **Software**) but display as `connected` when you view your managed firewalls Summary (**Panorama** > **Managed Devices** > **Summary**) and from the CLI. + +**Workaround:** Log out and log back in to the Panorama web interface. + +## PAN-135742 + +There is an issue in HTTP2 session decryption where the App-ID in the decryption log is the App-ID of the parent session (which is web-browsing). + +## PAN-134053 + +ACC does not filter WildFire logs from Dynamic User Groups. + +## PAN-132598 + +The Panorama management server does not check for duplicate addresses in address groups (**Objects** > **Address Groups**) and duplicate services in service groups (**Objects** > **Service Groups**) when created from the CLI. + +## PAN-130550 + +```caveat +PA-3200 Series, PA-5220, PA-5250, PA-5260, and PA-7000 Series firewalls +``` + +For traffic between virtual systems (inter-vsys traffic), the firewall cannot perform source NAT using dynamic IP (DIP) address translation. + +**Workaround:** Use source NAT with Dynamic IP and Port (DIPP) translation on inter-vsys traffic. + +## PAN-127813 + +In the current release, SD-WAN auto-provisioning configures hubs and branches in a hub and spoke model, where branches don’t communicate with each other. Expected branch routes are for generic prefixes, which can be configured in the hub and advertised to all branches. Branches with unique prefixes are not published up to the hub. + +**Workaround:** Add any specific prefixes for branches to the hub advertise-list configuration. + +## PAN-127206 + +If you use the CLI to enable the cleartext option for the Include Username in HTTP Header Insertion Entries feature, the authentication request to the firewall may become unresponsive or time out. + +## PAN-123277 + +Dynamic tags from other sources are accessible using the CLI but do not display on the Panorama web interface. + +## PAN-123040 + +When you try to view network QoS statistics on an SD-WAN branch or hub, the QoS statistics and the hit count for the QoS rules don’t display. A workaround exists for this issue. Please contact Support for information about the workaround. + +## PAN-120440 + +There is an issue on M-500 Panorama management servers where any ethernet interface with an IPv6 address having Private PAN-DB-URL connectivity only supports the following format: `2001:DB9:85A3:0:0:8A2E:370:2`. + +## PAN-120423 + +PAN-OS 10.0.0 does not support the XML API for GlobalProtect logs. + +## PAN-120303 + +There is an issue where the firewall remains connected to the PAN-DB-URL server through the old management IP address on the M-500 Panorama management server, even when you configured the Eth1/1 interface. + +**Workaround:** Update the PAN-DB-URL IP address on the firewall using one of the methods below. + +- Modify the PAN-DB Server IP address on the managed firewall. + 1. On the web interface, delete the **PAN-DB Server** IP address (**Device** > **Setup** > **Content ID** > **URL Filtering** settings). + 2. **Commit** your changes. + 3. Add the new M-500 Eth1/1 IP PAN-DB IP address. + 4. **Commit** your changes. +- Restart the firewall (devsrvr) process. + 1. Log in to the firewall CLI. + 2. Restart the devsrvr process: `debug software restart process device-server` + +## PAN-116017 + +```caveat +Google Cloud Platform (GCP) only +``` + +The firewall does not accept the DNS value from the initial configuration (init-cfg) file when you bootstrap the firewall. + +**Workaround:** Add DNS value as part of the bootstrap.xml in the bootstrap folder and complete the bootstrap process. + +## PAN-115816 + +```caveat +Microsoft Azure only +``` + +There is an intermittent issue where an Ethernet (eth1) interface does not come up when you first boot up the firewall. + +**Workaround:** Reboot the firewall. + +## PAN-114495 + +Alibaba Cloud runs on a KVM hypervisor and supports two Virtio modes: DPDK (default) and MMAP. If you deploy a VM-Series firewall running PAN-OS 9.0 in DPDK packet mode and you then switch to MMAP packet mode, the VM-Series firewall duplicates packets that originate from or terminate on the firewall. As an example, if a load balancer or a server behind the firewall pings the VM-Series firewall after you switch from DPDK packet mode to MMAP packet mode, the firewall duplicates the ping packets. + +Throughput traffic is not duplicated if you deploy the VM-Series firewall using MMAP packet mode. + +## PAN-112694 + +```caveat +Firewalls with multiple virtual systems only +``` + +If you configure dynamic DNS (DDNS) on a new interface (associated with vsys1 or another virtual system) and you then create a **New** Certificate Profile from the drop-down, you must set the location for the Certificate Profile to Shared. If you configure DDNS on an existing interface and then create a new Certificate Profile, we also recommend that you choose the Shared location instead of a specific virtual system. Alternatively, you can select a preexisting certificate profile instead of creating a new one. + +## PAN-112456 + +You can temporarily submit a change request for a URL Category with three suggested categories; however, only two categories are supported. Do not add more than two suggested categories to a change request until we address this issue. If you submit more than two suggested categories, only the first two categories in the change request are evaluated. + +## PAN-112135 + +You cannot unregister tags for a subnet or range in a dynamic address group from the web interface. + +**Workaround:** Use an XML API request to unregister the tags for the subnet or range. + +## PAN-111928 + +Invalid configuration errors are not displayed as expected when you revert a Panorama management server configuration. + +**Workaround:** After you revert the Panorama configuration, **Commit** (**Commit** > **Commit to Panorama**) the reverted configuration to display the invalid configuration errors. + +## PAN-111866 + +The push scope selection on the Panorama web interface displays incorrectly even though the commit scope displays as expected. This issue occurs when one administrator makes configuration changes to separate device groups or templates that affect multiple firewalls and a different administrator attempts to push those changes. + +**Workaround:** Perform one of the following tasks. + +- Initiate a **Commit to Panorama** operation followed by a **Push to Devices** operation for the modified device group and template configurations. +- Manually select the devices that belong to the modified device group and template configurations. + +## PAN-111729 + +If you disable DPDK mode and enable it again, you must immediately reboot the firewall. + +## PAN-111670 + +Tagged VLAN traffic fails when sent through an SR-IOV adapter. + +## PAN-110794 + +DGA-based threats shown in the firewall threat log display the same name for all such instances. + +## PAN-109526 + +The system log does not correctly display the URL for CRL files; instead, the URLs are displayed with encoded characters. + +## PAN-104780 + +If you configure a HIP object to match only when a connecting endpoint is managed (**Objects** > **GlobalProtect** > **HIP Objects** > **** > **General** > **Managed**), iOS and Android endpoints that are managed by AirWatch are unable to successfully match the HIP object and the HIP report incorrectly indicates that these endpoints are not managed. This issue occurs because GlobalProtect gateways cannot correctly identify the managed status of these endpoints. + +Additionally, iOS endpoints that are managed by AirWatch are unable to match HIP objects based on the endpoint serial number because GlobalProtect gateways cannot identify the serial numbers of these endpoints; these serial numbers do not appear in the HIP report. + +## PAN-103276 + +Adding a disk to a virtual appliance running Panorama 8.1 or a later release on VMware ESXi 6.5 update1 causes the Panorama virtual appliance and host web client to become unresponsive. + +**Workaround:** Upgrade the ESXi host to ESXi 6.5 update2 and add the disk again. + +## PAN-101688 + +```caveat +Panorama plugins +``` + +The IP address-to-tag mapping information registered on a firewall or virtual system is not deleted when you remove the firewall or virtual system from a Device Group. + +**Workaround:** Log in to the CLI on the firewall and enter the following command to unregister the IP address-to-tag mappings: `debug object registered-ip clear all`. + +## PAN-101537 + +After you configure and push address and address group objects in Shared and vsys-specific device groups from the Panorama management server to managed firewalls, executing the `show log direction equal | in ` command on a managed firewall only returns address and address group objects pushed form the Shared device group. + +**Workaround:** Specify the vsys in the query string: + +`admin>` `set system target-vsys ` + +`admin>` `show log direction equal query equal ‘vsys eq ’ | in ` + +## PAN-98520 + +When booting or rebooting a PA-7000 Series Firewall with the SMC-B installed, the BIOS console output displays attempts to connect to the card's controller in the System Memory Speed section. The messages can be ignored. + +## PAN-97757 + +GlobalProtect authentication fails with an `Invalid username/password` error (because the user is not found in **Allow List**) after you enable GlobalProtect authentication cookies and add a RADIUS group to the **Allow List** of the authentication profile used to authenticate to GlobalProtect. + +**Workaround:** Disable GlobalProtect authentication cookies. Alternatively, disable (clear) **Retrieve user group from RADIUS** in the authentication profile and configure group mapping from Active Directory (AD) through LDAP. + +## PAN-97524 + +```caveat +Panorama management server only +``` + +The Security Zone and Virtual System columns (**Network** tab) display `None` after a Device Group and Template administrator with read-only privileges performs a context switch. + +## PAN-96446 + +A firewall that is not included in a Collector Group fails to generate a system log if logs are dropped when forwarded to a Panorama management server that is running in Management Only mode. + +## PAN-95773 + +On VM-Series firewalls that have Data Plane Development Kit (DPDK) enabled and that use the i40e network interface card (NIC), the `show session info` CLI command displays an inaccurate throughput and packet rate. + +**Workaround:** Disable DPDK by running the `set system setting dpdk-pkt-io off` CLI command. + +## PAN-95028 + +For administrator accounts that you created in PAN-OS 8.0.8 and earlier releases, the firewall does not apply password profile settings (**Device** > **Password Profiles**) until after you upgrade to PAN-OS 8.0.9 or a later release and then only after you modify the account passwords. (Administrator accounts that you create in PAN-OS 8.0.9 or a later release do not require you to change the passwords to apply password profile settings.) + +## PAN-94846 + +When DPDK is enabled on the VM-Series firewall with i40e virtual function (VF) driver, the VF does not detect the link status of the physical link. The VF link status remains up, regardless of changes to the physical link state. + +## PAN-94093 + +HTTP Header Insertion does not work when jumbo frames are received out of order. + +## PAN-93968 + +The firewall and Panorama web interfaces display vulnerability threat IDs that are not available in PAN-OS 9.0 releases (**Objects** > **Security Profiles** > **Vulnerability Protection** > **** > **Exceptions**). To confirm whether a particular threat ID is available in your release, monitor the release notes for each new Applications and Threats content update or check the Palo Alto Networks [Threat Vault](https://threatvault.paloaltonetworks.com) to see the minimum PAN-OS release version for a threat signature. + +## PAN-93607 + +When you configure a VM-500 firewall with an SCTP Protection profile (**Objects** > **Security Profiles** > **SCTP Protection**) and you try to add the profile to an existing Security Profile Group (**Objects** > **Security Profile Groups**), the Security Profile Group doesn’t list the SCTP Protection profile in its drop-down list of available profiles. + +**Workaround:** Create a new Security Profile Group and select the SCTP Protection profile from there. + +## PAN-93532 + +When you configure a firewall running PAN-OS 9.0 as an nCipher HSM client, the web interface on the firewall displays the nCipher server status as Not Authenticated, even though the HSM state is up (**Device** > **Setup** > **HSM**). + +## PAN-93193 + +The memory-optimized VM-50 Lite intermittently performs slowly and stops processing traffic when memory utilization is critically high. To prevent this issue, make sure that you do not: + +- Switch to the firewall **Context** on the Panorama management server. +- Commit changes when a dynamic update is being installed. +- Generate a custom report when a dynamic update is being installed. +- Generate custom reports during a commit. + +**Workaround:** When the firewall performs slowly, or you see a critical System log for memory utilization, wait for 5 minutes and then manually reboot the firewall. + +Use the Task Manager to verify that you are not performing memory intensive tasks such as installing dynamic updates, committing changes or generating reports, at the same time, on the firewall. + +## PAN-91802 + +On a VM-Series firewall, the **clear session all** CLI command does not clear GTP sessions. + +## PAN-83610 + +In rare cases, a PA-5200 Series firewall (with an FE100 network processor) that has session offload enabled (default) incorrectly resets the UDP checksum of outgoing UDP packets. + +**Workaround:** In PAN-OS 8.0.6 and later releases, you can persistently disable session offload for only UDP traffic using the `set session udp-off load no` CLI command. + +## PAN-83236 + +The VM-Series firewall on Google Cloud Platform does not publish firewall metrics to Google Stack Monitoring when you manually configure a DNS server IP address (**Device** > **Setup** > **Services**). + +**Workaround:** The VM-Series firewall on Google Cloud Platform must use the DNS server that Google provides. + +## PAN-83215 + +SSL decryption based on ECDSA certificates does not work when you import the ECDSA private keys onto an nCipher nShield hardware security module (HSM). + +## PAN-81521 + +Endpoints failed to authenticate to GlobalProtect through Kerberos when you specify an FQDN instead of an IP address in the Kerberos server profile (**Device** > **Server Profiles** > **Kerberos**). + +**Workaround:** Replace the FQDN with the IP address in the Kerberos server profile. + +## PAN-77125 + +PA-7000 Series, PA-5450, PA-5200 Series, and PA-3200 Series firewalls configured in tap mode don’t close offloaded sessions after processing the associated traffic; the sessions remain open until they time out. + +**Workaround:** Configure the firewalls in virtual wire mode instead of tap mode, or disable session offloading by running the `set session off load no` CLI command. + +## PAN-75457 + +In WildFire appliance clusters that have three or more nodes, the Panorama management server does not support changing node roles. In a three-node cluster for example, you cannot use Panorama to configure the worker node as a controller node by adding the HA and cluster controller configurations, configure an existing controller node as a worker node by removing the HA configuration, and then commit and push the configuration. Attempts to change cluster node roles from Panorama results in a validation error—the commit fails and the cluster becomes unresponsive. + +## PAN-73530 + +The firewall does not generate a packet capture (pcap) when a Data Filtering profile blocks files. + +## PAN-73401 + +When you import a two-node WildFire appliance cluster into the Panorama management server, the controller nodes report their state as out-of-sync if either of the following conditions exist: + +- You did not configure a worker list to add at least one worker node to the cluster. (In a two-node cluster, both nodes are controller nodes configured as an HA pair. Adding a worker node would make the cluster a three-node cluster.) +- You did not configure a service advertisement (either by enabling or not enabling advertising DNS service on the controller nodes). + +**Workaround:** There are three possible workarounds to sync the controller nodes: + +- After you import the two-node cluster into Panorama, push the configuration from Panorama to the cluster. After the push succeeds, Panorama reports that the controller nodes are in sync. +- Configure a worker list on the cluster controller: + admin@wf500(active-controller)# `set deviceconfig cluster mode controller worker-list ` + (`` is the IP address of the worker node you are adding to the cluster.) This creates a three-node cluster. After you import the cluster into Panorama, Panorama reports that the controller nodes are in sync. When you want the cluster to have only two nodes, use a different workaround. +- Configure service advertisement on the local CLI of the cluster controller and then import the configuration into Panorama. The service advertisement can advertise that DNS is or is not enabled. + admin@wf500(active-controller)# `set deviceconfig cluster mode controller service-advertisement dns-service enabled yes` + or + admin@wf500(active-controller)# `set deviceconfig cluster mode controller service-advertisement dns-service enabled no` + Both commands result in Panorama reporting that the controller nodes are in sync. + +## PAN-70906 + +If the PAN-OS web interface and the GlobalProtect portal are enabled on the same IP address, then when a user logs out of the GlobalProtect portal, the administrative user is also logged out from the PAN-OS web interface. + +**Workaround:** Use the IP address to access the PAN-OS web interface and an FQDN to access the GlobalProtect portal. + +## PAN-69505 + +When viewing an external dynamic list that requires client authentication and you **Test Source URL**, the firewall fails to indicate whether it can reach the external dynamic list server and returns a URL access error (**Objects** > **External Dynamic Lists**). + +## PAN-40079 + +The VM-Series firewall on KVM, for all supported Linux distributions, does not support the Broadcom network adapters for PCI pass-through functionality. + +## PAN-39636 + +Regardless of the **Time Frame** you specify for a scheduled custom report on a Panorama M-Series appliance, the earliest possible start date for the report data is effectively the date when you configured the report (**Monitor** > **Manage Custom Reports**). For example, if you configure the report on the 15th of the month and set the **Time Frame** to **Last 30 Days**, the report that Panorama generates on the 16th will include only data from the 15th onward. This issue applies only to scheduled reports; on-demand reports include all data within the specified **Time Frame**. + +**Workaround:** To generate an on-demand report, click **Run Now** when you configure the custom report. + +## PAN-38255 + +When you perform a factory reset on a Panorama virtual appliance and configure the serial number, logging does not work until you reboot Panorama or execute the `debug software restart process management-server` CLI command. + +## PAN-31832 + +The following issues apply when configuring a firewall to use a hardware security module (HSM): + +- **nCipher nShield Connect**—The firewall requires at least four minutes to detect that an HSM was disconnected, causing SSL functionality to be unavailable during the delay. +- **SafeNet Network**—When losing connectivity to either or both HSMs in an HA configuration, the display of information from the `show high-availability state` and `show hsm info` commands are blocked for 20 seconds. diff --git a/web/data/issues/PAN-OS/known/10.1.2_2026-03-16.md b/web/data/issues/PAN-OS/known/10.1.2_2026-03-16.md new file mode 100644 index 0000000..ac3a8e6 --- /dev/null +++ b/web/data/issues/PAN-OS/known/10.1.2_2026-03-16.md @@ -0,0 +1,1035 @@ +--- +type: Known +product: PAN-OS +version: 10.1.2 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## APL-15000 + +When you move a firewall from one Strata Logging Service instance to another, it can take up to an hour for the firewall to begin sending logs to the new instance. + +## APL-8269 + +For data retrieved from Strata Logging Service, the Threat Name column in **Panorama** > **ACC** > **threat-activity** appears blank. + +## PLUG-380 + +When you rename a device group, template, or template stack in Panorama that is part of a VMware NSX service definition, the new name is not reflected in NSX Manager. Therefore, any ESXi hosts that you add to a vSphere cluster are not added to the correct device group, template, or template stack and your Security policy is not pushed to VM-Series firewalls that you deploy after you rename those objects. There is no impact to existing VM-Series firewalls. + +## WF500-5559 + +An intermittent error while analyzing signed PE samples on the WildFire appliance might cause analysis failures. + +## WF500-5471 + +After using the firewall CLI to add a WildFire appliance with an IPv6 address, the initial connection may fail. + +**Workaround:** Retry connecting after you restart the web server with the following command: `debug software restart process web-server`. + +## PAN-281370 + +The Advanced WildFire Inline ML models **OOXML** and **Mach-O** erroneously display as being available from the CLI; however, they are only available on PAN-OS 11.1.3 and later releases. + +## PAN-260851 + +From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (**Objects** > **Applications**) tag. + +## PAN-228273 + +On the Panorama management server in FIPS-CC mode, the ElasticSearch cluster fails to come up and the `show log-collector-es-cluster health` command displays the `status` is `red`. This results in log ingestion issues for Panorama in Panorama only or Log Collector mode. + +## PAN-227344 + +On the Panorama management server, PDF Summary Reports (**Monitor** > **PDF Reports** > **Manage PDF Summary**) display no data and are blank when predefined reports are included in the summary report. + +## PAN-223488 + +```caveat +This issue is now resolved. See PAN-OS 10.1.12 Addressed Issues. +``` + +On the M-600 appliance, closed ElasticSearch shards are not deleted from the M-600 appliance. This causes the ElasticSearch shard purging to not work as expected, resulting in high disk usage. + +## PAN-223365 + +The Panorama management server is unable to query any logs if the ElasticSearch health status for any Log Collector (**Panorama** > **Managed Collector** is degraded. + +**Workaround:** [Log in to the Log Collector CLI](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli) and restart ElasticSearch. + +`admin``debug elasticsearch es-restart all` + +## PAN-218521 + +The ElasticSearch process on the M-600 appliance in Log Collector mode may enter a continuous reboot cycle. This results in the M-600 appliance becoming unresponsive, consuming logging disk space, and preventing new log ingestion. + +## PAN-217307 + +```caveat +This issue is now resolved. See PAN-OS 10.1.14 Addressed Issues. +``` + +The following Security policy rule (**Policies** > **Security**) filters return no results: + +`log-start eq no` + +`log-end eq no` + +`log-end eq yes` + +## PAN-216214 + +For Panorama-managed firewalls in an Active/Active High Availability (HA) configuration where you configure the firewall HA settings (**Device** > **High Availability**) in a template or template stack (**Panorama** > **Templates**), performing a local commit on one of the HA firewalls triggers an HA config sync on the peer firewall. This causes the HA peer configuration to go `Out of Sync`. + +## PAN-213746 + +On the Panorama management server, the **Hostkey** displayed as `undefined undefined` if you override an SSH Service Profile (**Device** > **Certificate Management** > **SSH Service Profile**) Hostkey configured in a Template from the Template Stack. + +## PAN-212889 + +```caveat +This issue is now resolved. See PAN-OS 10.1.11 Addressed Issues. +``` + +On the Panorama management server, different threat names are used when querying the same threat in the Threat Monitor (**Monitor** > **App Scope** > **Threat Monitor**) and **ACC**. This results in the ACC displaying `no data to display` when you are redirected to the ACC after clicking a threat name in the Threat Monitor. + +## PAN-208325 + +```caveat +This issue is now resolved. See PAN-OS 10.1.10 Addressed Issues. +``` + +The following NextGen firewalls are unable to automatically renew the device certificate (**Device** > **Setup** > **Management** or **Panorama** > **Setup** > **Management**). + +- PA-410 Firewall +- PA-440, PA-450, and PA-460 Firewalls +- PA-5450 Firewall + +**Workaround:** Log in to the [firewall CLI](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-cli-quick-start/get-started-with-the-cli/access-the-cli) and fetch the device certificate. + +`admin>``request certificate fetch` + +## PAN-206268 + +```caveat +This issue is now resolved. See PAN-OS 10.1.10 Addressed Issues. +``` + +On the Panorama management server, the Auth Key field was erroneously displayed when you configure the Panorama Settings (**Device** > **Setup** > **Management**) as part of a template or template stack configuration. + +## PAN-206243 + +The PA-220 firewall reaches the maximum disk usage capacity multiple a day that requires a disk cleanup. A critical system log (**Monitor** > **Logs** > **System**) is generated each time the firewall reaches maximum disk usage capacity. + +## PAN-205187 + +ElasticSearch may not start properly when a newly installed Panorama virtual appliance powers on for the first time, resulting in the Panorama virtual appliance being unable to query logs forwarded from the managed firewall to a Log Collector. + +**Workaround:** [Log in to the Panorama CLI](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli) and start the PAN-OS software. + +`admin>``request restart software` + +## PAN-201855 + +On the Panorama management server, cloning any template (**Panorama** > **Templates**) corrupts certificates (**Device** > **Certificate Management** > **Certificates**) with the **Block Private Key Export** setting enabled across all templates. This results in managed firewalls experiencing issues wherever the corrupted certificate is referenced. + +For example, you have template A, B, and C where templates A and B have certificates with the **Block Private Key Export** setting enabled. Cloning template C corrupts the certificates with **Block Private Key Export** setting enabled in templates A and B. + +**Workaround:** After cloning a template, delete and re-import the corrupted certificates. + +## PAN-199557 + +On M-600 appliances in an Active/Passive high availability (HA) configuration, the `configd` process restarts due to a memory leak on the `Active` Panorama HA peer. This causes the Panorama web interface and CLI to become unresponsive. + +**Workaround:** Manually reboot the `Active` Panorama HA peer. + +## PAN-197341 + +On the Panorama management server, if you create multiple device group **Objects** with the same name in the Shared device group and any additional device groups (**Panorama** > **Device Groups**) under the same device group hierarchy that are used in one or more **Policies**, renaming the object with a shared name in any device group causes the object name to change in the policies where it is used. This issue applies only to device group objects that can be referenced in a Security policy rule. + +For example: + +1. You create a parent device group `DG-A` and a child device group `DG-B`. +2. You create address objects called `AddressObjA` in the `Shared`, `DG-A` and `DG-B` device groups and add `AddressObjA` to a Security policy rule under `DG-A` and `DG-B`. +3. Later, you change the `AddressObjA` name in the `Shared` device group to `AddressObjB`. + +Changing the name of the address object in the `Shared` device group causes the references in the Policy rule to use the renamed `Shared` object instead of the device group object. + +## PAN-196758 + +On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you **Preview Changes** (**Commit** > **Push to Devices** > **Edit Selections** or **Commit** > **Commit and Push** > **Edit Selections**). + +## PAN-194519 + +```caveat +PA-5450 firewall only +``` + +Trying to configure a custom payload format under **Device** > **Server Profiles** > **HTTP** yields a Javascript error. + +## PAN-194515 + +```caveat +PA-5450 firewall only +``` + +The Panorama web interface does not display any predefined template stack variables in the dropdown menu under **Device** > **Setup** > **Log Interface** > **IP Address**. + +**Workaround:** Configure the log interface IP address on the individual firewall web interface instead of on Panorama. + +## PAN-193518 + +All logs (**Monitor** > **Logs**) generated by a firewall running a PAN-OS 10.0 release are not accessible if you downgrade from PAN-OS 10.1 to PAN-OS 10.0, and then upgrade back to PAN-OS 10.1. + +## PAN-192403 + +```caveat +PA-5450 firewall only +``` + +There is no commit warning in the web interface when configuring the management interface and logging interface in the same subnetwork. Having both interfaces in the same subnetwork can cause routing and connectivity issues. + +## PAN-190727 + +```caveat +PA-5450 firewall only +``` + +Documentation for configuring the log interface is unavailable on the web interface and in the PAN-OS Administrator’s Guide. + +## PAN-188052 + +Devices in FIPS-CC mode are unable to connect to servers utilizing ECDSA-based host keys that impacts exporting logs (**Device** > **Scheduled Log Export**), exporting configurations (**Device** > **Scheduled Config Export**), or the `scp export` command in the CLI. + +**Workaround:** Use RSA-based host keys on the destination server. + +## PAN-187685 + +On the Panorama management server, the Template Status displays no synchronization status (**Panorama** > **Managed Devices** > **Summary**) after a bootstrapped firewall is successfully added to Panorama. + +**Workaround:** After the bootstrapped firewall is successfully added to Panorama, [log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) and select **Commit** > **Push to Devices**. + +## PAN-186262 + +The Panorama management server in Panorama or Log Collector mode may become unresponsive as Elasticsearch accumulates internal connections related to logging processes. The chances Panorama becomes unresponsive increases the longer Panorama remains powered on. + +**Workaround:** Reboot Panorama if it becomes unresponsive. + +## PAN-185286 + +```caveat +PA-5400 Series firewalls only +``` + +On the Panorama management server, the device health resources (**Panorama** > **Managed Devices** > **Health**) do not populate. + +## PAN-181116 + +```caveat +This issue is now resolved. See PAN-OS 10.1.5 Addressed Issues. +``` + +After upgrading to PAN-OS 10.1, some GlobalProtect tunnels fall back to SSL instead of IPSec due to the inadvertent encapsulation of the ICMP keepalive response from the firewall. + +## PAN-180661 + +```caveat +This issue is now resolved. See PAN-OS 10.1.6 Addressed Issues. +``` + +On the Panorama management server, pushing an unsupported Minimum Password Complexity (**Device** > **Setup** > **Management**) to a managed firewall erroneously displays `commit time out` as the reason the commit failed. + +## PAN-178194 + +```caveat +This issue is now resolved. See PAN-OS 10.1.7 Addressed Issues. +``` + +A UI issue in PAN-OS renders the contents of the **Inline ML** tab in the **URL Filtering Profile** inaccessible on firewalls licensed for Advanced URL Filtering. Additionally, a message indicating that a **License required for URL filtering to function** is unavailable displays at the bottom of the UI. These errors do not affect the operation of Advanced URL Filtering or URL Filtering Inline ML. + +**Workaround:** Configuration settings for URL Filtering Inline ML must be applied through the CLI. The following configuration commands are available: + +- Define URL exceptions for specific web sites— + `admin#``set profiles url-filtering mlav-category-exception` + +- Configuration settings for each inline ML model— + `admin#``set profiles url-filtering mlav-engine-urlbased-enabled` + +## PAN-178190 + +Traffic, threat, and URL logs are not viewable from the firewall web interface (**Monitor** > **Logs**) and CLI after upgrade to PAN-OS 10.1.2. + +## PAN-177455 + +```caveat +This issue is now resolved. See PAN-OS 10.1.6 Addressed Issues. +``` + +PAN-OS 10.1.2 is not supported on PA-7000 Series firewalls with HA (High Availability) clustering enabled and using an HA4 communication link. Attempting to load PAN-OS 10.1.2 on the firewall causes the PA-7000 100G NPC to go offline. As a result, the firewall fails to boot normally and enters maintenance mode. HA Pairs of Active-Passive and Active-Active firewalls are not affected. + +## PAN-175717 + +```caveat +This issue is now resolved. See PAN-OS 10.1.5 Addressed Issues +``` + +Firewalls managed by a Panorama management server enter maintenance mode if: + +- Panorama is running PAN-OS 10.2 and managed firewalls are downgraded from PAN-OS 10.2 to PAN-OS 10.1.4 or earlier PAN-OS release. +- Panorama is upgraded from PAN-OS 10.1 to PAN-OS 10.2 and managed firewalls are running PAN-OS 10.1.4 or earlier PAN-OS 10.1 release. + +**Workaround:** When downgrading managed firewalls, downgrade to PAN-OS 10.1.5 first and then continue on your downgrade path. When upgrading Panorama, upgrade to PAN-OS 10.1.5 first and then continue on your upgrade path. + +## PAN-175149 + +```caveat +PA-800 and PA-7000 Series firewalls and the PA-220 firewall only +``` + +Fixed an issue where ACC and scheduled reports (**Monitor** > **Manage** > **Manage Custom Reports**) incorrectly displayed the IPv6 address instead of the IPv4 address. + +## PAN-174982 + +In HA active/active configurations where, when interfaces that were associated with a virtual router were deleted, the configuration change did not sync. + +## PAN-174201 + +```caveat +This issue is now resolved. See PAN-OS 10.1.3 Addressed Issues. +``` + +The vldmgr process stops responding after upgrading to PAN-OS 10.1.0 if logs are in the burst list. + +## PAN-173509 + +```caveat +This issue is now resolved. See PAN-OS 10.1.5 Addressed Issues. +``` + +Superuser administrators with read-only privileges (**Device** > **Administrators** and **Panorama** > **Administrators**) are unable to view the hardware ACL blocking setting and duration in the CLI using the commands: + +`admin>``show system setting hardware-acl-blocking-enable` + +`admin>``show system setting hardware-acl-blocking-duration` + +## PAN-172274 + +When you activate the advanced URL filtering license, your license entitlements for PAN-DB and advanced URL filtering might not display correctly on the firewall — this is a display anomaly, not a licensing issue, and does not affect access to the services. + +**Workaround:** Issue the following command to retrieve and update the licenses: `license request fetch`. + +## PAN-172113 + +If you request a User Activity Report on Panorama and the vsys key value in the XML is an unsupported value, the resulting job becomes unresponsive at 10% and does not complete until you manually stop the job in the web interface. + +**Workaround:**Change the vsys key to a valid device group, commit your changes, and run the User Activity Report again. + +## PAN-172091 + +If you have configured a virtual system as a User-ID hub and a firewall that receives IP address-to-username mapping from the hub has a security policy that includes a QoS policy rule, the firewall does not match the user to the QoS policy rule if the traffic attempts to access a virtual system that is not the hub. + +## PAN-172208 + +```caveat +This issue is now resolved. See PAN-OS 10.1.3 Addressed Issues. +``` + +The PA-5450 firewall may reload in rare conditions while handling high stress SSL traffic when CPU utilization reaches 100% or packet broker capacity exceeds 40%. + +## PAN-172171 + +```caveat +This issue is now resolved. See PAN-OS 10.1.3 Addressed Issues. +``` + +In an HA Active/Passive configuration using Auto mode, a Passive PA-5450 firewall under traffic stress can get stuck in maintenance mode after receiving the `slot7-path_monitor Path monitor failure` service failure. + +**Workaround:** Use Active/Passive Shutdown mode instead of Auto mode. + +## PAN-172132 + +```caveat +This issue is now resolved by PAN-189643. See PAN-OS 10.1.6 Addressed Issues. +``` + +QoS fails to run on a tunnel interface (for example, tunnel.1). + +## PAN-172067 + +When you configure an HTTP server profile (**Device** > **Server Profiles** > **HTTP** or **Panorama** > **Server Profiles** > **HTTP**), the **Username** and **Password** fields are always required regardless of whether **Tag Registration** is enabled. + +**Workaround:** When you configure an HTTP server profile, always enter a username and password to successfully create the HTTP server profile. + +You must enter a username and password even if the HTTP server does not require it. The HTTP server ignores the username and password if they are not required for the firewall to connect. + +## PAN-172061 + +A process (`all_pktproc`) can cause intermittent crashes on the Passive PA-5450 firewall in an Active/Passive HA pair. This issue may be seen during an upgrade or reload of the firewall with traffic and when clearing sessions. + +## PAN-171938 + +No results are displayed when you **Show Application Filter** for a Security policy rule (**Policies** > **Security** > **Application** > **Value** > **Show Application Filter**). + +## PAN-171839 + +The Enable Bonjour Reflector option under **Network** > **Interfaces** > **Layer 3 Interface** > **IPv4** is not supported on the PA-5450 firewall. + +## PAN-171723 + +If you use Panorama to push a configuration that uses App-ID Cloud Engine (ACE) App-IDs and then you downgrade the firewall from PAN-OS 10.1 to PAN-OS 10.0, the installation succeeds but after you reboot, the auto-commit fails. + +**Workaround:** Remove all ACE application configurations before downgrading. + +## PAN-171714 + +```caveat +This issue is now resolved. See PAN-OS 10.1.7 Addressed Issues. +``` + +If you use the NetBIOS format (`domain\user`) for the IP address-to-username mapping and the firewall receives the group mapping information from the Cloud Identity Engine, the firewall does not successfully match the user to the correct group. + +## PAN-171706 + +```caveat +This issue is now resolved. See PAN-OS 10.1.11 Addressed Issues. +``` + +If you are using Panorama to manage firewalls with multiple virtual systems and the virtual system that is the User-ID hub uses an alias, the local commit on Panorama is successful but the commit to the firewall fails. + +## PAN-171673 + +On the Panorama management server, the **ACC** returns inaccurate results when you filter for **New App-ID** in the **Application** usage widget. + +## PAN-171635 + +If you have an on-premise Active Directory and there is an existing group mapping configuration on the firewall, if you migrate the group mapping to the Cloud Identity Engine, the firewall does not remove the existing group mapping even if the configuration is disabled and the firewall is rebooted, which may conflict with new mappings from the Cloud Identity Engine. + +**Workaround**: Use the debug user-id clear domain-map command to remove the existing group mappings from the firewall. + +## PAN-171224 + +On the Panorama management server, a custom report (**Monitor** > **Managed Custom Reports**) with a high volume of unique data objects is not generated when you click **Run Now**. + +## PAN-171145 + +If you edit or remove the value for the `mail` attribute in your on-premise Active Directory, the changes may not be immediately reflected on the firewall after it syncs with the Cloud Identity Engine. + +## PAN-171127 + +```caveat +This issue is now resolved. See PAN-OS 10.1.4 Addressed Issues +``` + +On the Panorama management server, custom reports (**Monitor** > **Manage Custom Reports**) for the **Device Application Statistics** and **Device Traffic Summary** databases display `null` for the Application fields. + +## PAN-170923 + +In **Policies** > **Security** > **Policy Optimizer** > **New App Viewer**, when you select a Security policy rule in the bottom portion of the screen, the application data in the application browser (top portion of screen) does not match the Apps Seen on the selected rule. In addition, filtering in the application browser based on Apps Seen does not work. + +## PAN-170462 + +```caveat +This issue is now resolved. See PAN-OS 10.1.6 Addressed Issues. +``` + +SaaS applications downloaded from the App-ID Cloud Engine (ACE) do not appear in daily application reports (**Monitor** > **Reports** > **Application Reports**) or in the **Application** column of the **Application Usage** widget in **ACC** > **Network Activity**. + +## PAN-170270 + +Using the CLI to power on a PA-5450 Networking Card (NC) in an Active HA firewall can cause its Passive peer to temporarily go down. + +## PAN-169906 + +The CN-Series Firewall as a Kubernetes Service does not support AF_XDP when deployed in CentOS. + +## PAN-168636 + +Connecting to the App-ID Cloud Engine (ACE) cloud using a management port with explicit proxy configured on it is not supported. Instead, use a data plane interface for the service route ([Prepare to Deploy App-ID Cloud Engine](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/app-id/cloud-based-app-id-service/prepare-to-deploy-app-id-cloud-engine.html) describes how to do this.) + +## PAN-168113 + +On the Panorama management server, you are unable to configure a master key (**Device** > **Master Key and Diagnostics**) for a managed firewall if an interface (**Network** > **Interfaces** > **Ethernet**) references a zone pushed from Panorama. + +**Workaround:** Remove the referenced zone from the interface configuration to successfully configure a master key. + +## PAN-167847 + +If you issue the command `opof stats`, then clear the results {opof stats -c}, the Active Sessions value is sometimes invalid. For example, you might see a negative number or an excessively large number. + +**Workaround:** Re-run the `opof stats` command after the offload completes. + +## PAN-167401 + +When a firewall or Panorama appliance configured with a proxy is upgraded to PAN-OS 10.0.3 or a later release, it fails to connect to edge service. + +## PAN-166464 + +```caveat +This issue is now resolved. See PAN-OS 10.1.6-h6 Addressed Issues. +``` + +PAN-OS reports the PA-5450 fan numbers incorrectly by listing them in the opposite order. This does not affect fan operation. For further information, contact Customer Support. + +## PAN-165669 + +If you configure a group that the firewall retrieves from the Cloud Identity Engine as the `user in` value in a filter query, Panorama is unable to retrieve the group membership and as a result, is unable to display this data in logs and custom reports. + +## PAN-164922 + +On the Panorama management server, a context switch to a managed firewall running a PAN-OS 8.1.0 to 8.1.19 release fails. + +## PAN-164885 + +```caveat +This issue is now resolved. See PAN-OS 10.1.14-h6 Addressed Issues +``` + +On the Panorama management server, pushes to managed firewalls (**Commit** > **Push to Devices** or **Commit and Push**) may fail when an EDL (**Objects** > **External Dynamic Lists**) is configured to **Check for updates** every 5 minutes due to the commit and EDL fetch processes overlapping. This is more likely to occur when multiple EDLs are configured to check for updates every 5 minutes. + +## PAN-164841 + +A successful deployment of a Panorama virtual appliance on Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform (GCP) is inaccessible when deploying using the PAN-OS 10.1.0-b6 release. + +## PAN-164647 + +On the Panorama management server, activating a license (**Panorama** > **Device Deployment** > **Licenses**) on managed firewalls in a high availability (HA) configuration causes the Safari web browser to become unresponsive. + +**Workaround:** [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) from a web browser other than Safari to successfully activate a license on managed firewalls in an HA configuration. + +## PAN-164586 + +If you use a value other than `mail` for the user or group email attribute in the Cloud Identity Engine, it displays in `user@domain` format in the CLI output. + +## PAN-163966 + +On the Panorama management server, the **ACC** and on demand reports (**Monitor** > **Manage Custom Reports**) are unable to fetch Directory Sync group membership when the Source User Group filter query is applied, resulting in no data being displayed for the filter when Directory Sync is configured as the Source User for a policy rule. + +## PAN-162836 + +On the VM-Series firewall, if you select **Device** > **Licenses** > **Deactivate VM** a popup window opens and you can choose **Subscriptions** or **Support** and press **Continue** to remove licenses and register the changes with the license server. When the license removal is complete the **Deactivate VM** window does not update its text to exclude deactivated licenses or close the window. + +**Workaround**: Wait until the license deactivation is complete, and click **Cancel** to close the window. + +## PAN-162164 + +```caveat +This issue is now resolved. See PAN-OS 10.1.6 Addressed Issues. +``` + +When upgrading a multi-dataplane firewall from PAN-OS 10.0 to 10.1, if the configuration includes the DHCP Broadcast Session option enabled, the commit fails. Auto-commit is not affected. + +**Workaround:**Load the configuration from running config (load config from running-config.xml) and perform a commit. + +## PAN-162088 + +```caveat +This issue is now resolved. See PAN-OS 10.1.9 Addressed Issues. +``` + +On the Panorama management server in a high availability (HA) configuration, content updates (**Panorama** > **Dynamic Updates**) manually uploaded to the active HA peer are not synchronized to the passive HA peer when you **Install** a content update and enable **Sync to HA Peer**. + +## PAN-161666 + +The firewall includes any users configured in the Cloud Identity Engine in the count of groups. As a result, some CLI command output does not accurately display the number of groups the firewall has retrieved from the Cloud Identity Engine and counts users as groups in the `No. of Groups` in the command output. If the attempt to retrieve the user or group fails, the information for the user or group still displays in the CLI command output. + +## PAN-161451 + +If you issue the command `opof stats`, there are occasional zero packet and byte counts coming from the DPDK counters. This occurs when a session is in the tcp-reuse state, and has no impact on the existing session. + +## PAN-160238 + +If you migrate traffic from a firewall running a PAN-OS version earlier than 9.0 to a firewall running PAN-OS 9.0 or later, you experience intermittent VXLAN packet drops if TCI policy is not configured for inspecting VXLAN traffic flows. + +**Workaround:**On the new firewall, create an app override for VXLAN outer headers as described in [What is an Application Override?](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVLCA0) and the video tutorial [How to Configure an Application Override Policy on the Palo Alto Networks Firewall](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PPDrCAO). + +PAN-OS version 9.0 can inspect both inner and outer VXLAN flows. If you want to inspect inner flows, you must define a tunnel content inspection (TCI) policy. + +## PAN-157444 + +As a result of a telemetry handling update, the Source Zone field in the DNS analytics logs (viewable in the DNS Analytics tab within AutoFocus) might not display correct results. + +## PAN-157327 + +On downgrade to PAN-OS 9.1, Enterprise Data Loss Prevention (DLP) filtering settings (**Device** > **Setup** > **DLP**) are not removed and cause commit errors for the downgraded firewall if you do not uninstall the Enterprise DLP plugin before downgrade. + +**Workaround:** After you successfully downgrade a managed firewall to PAN-OS 9.1, commit and push from Panorama to remove the Enterprise DLP filtering settings and complete the downgrade. + +1. Downgrade your managed firewall to PAN-OS 9.1 +2. Log in to the firewall web interface and view the **Tasks** to verify all auto commits related to the downgrade have completed successfully. +3. Log in to the Panorama web interface and **Commit** > **Commit and Push** to your managed firewall downgraded to PAN-OS 9.1. + +## PAN-157103 + +Multi-channel functionality may not be properly utilized on an VM-Series firewall deployed in VMware NSX-V after the service is first deployed. + +**Workaround**: Execute the command `debug dataplane pow status` to view the number of channels being utilized by the dataplane. + +Per pan-task Netx statisticsCounter Name 1 2 3 4 5 6 Total---------------------------------------------ready_dvf 2 0 0 0 0 0 2 + +If multi-channel functionality is not working, disable your NSX-V security policy and reapply it. Then reboot the VM-Series firewall. When the firewall is back up, verify that multi-channel functionality is working by executing the command `debug dataplane pow status`. It should now show multiple channels being utilized. + +Per pan-task Netx statisticsCounter Name 1 2 3 4 5 6 Total---------------------------------------------ready_dvf 1 1 0 0 0 0 2 + +## PAN-156598 + +```caveat +Panorama only +``` + +If you configure a standard custom vulnerability signature in a custom Vulnerability Protection profile in a shared device group, the shared profile custom signatures do not populate in the other device groups when you configure a combination custom vulnerability signature. + +**Workaround:** Use the CLI to update the combination signature. + +## PAN-154292 + +On the Panorama management server, downgrading from a PAN-OS 10.0 release to a PAN-OS 9.1 release causes Panorama commit (**Commit** > **Commit to Panorama**) failures if a custom report (**Monitor** > **Manage Custom Reports**) is configured to Group By **Session ID**. + +**Workaround:** After successful downgrade, reconfigure the Group By setting in the custom report. + +## PAN-154034 + +On the Panorama management server, the Type column in the System logs (**Monitor** > **Logs** > **System**) for managed firewalls running a PAN-OS 9.1 release erroneously display `iot` as the type. + +## PAN-154032 + +On the Panorama management server, downgrading to PAN-OS 9.1 with the Panorama plugin for Cisco TrustSec version 1.0.2 installed does not automatically transform the plugin to be compatible with PAN-OS 9.1 + +**Workaround:** After successful downgrade to PAN-OS 9.1, **Remove Config** (**Panorama** > **Plugins**) of the Panorama plugin for Cisco TrustSec and then reconfigure the plugin. + +## PAN-153803 + +On the Panorama management server, scheduled email PDF reports (**Monitor** > **PDF Reports**) fail if a GIF image is used in the header or footer. + +## PAN-153557 + +On the Panorama management server CLI, the overall report status for a report query is marked as `Done` despite reports generated from logs in the Strata Logging Service from the PODamericas Collector Group jobs are still in a `Running` state. + +## PAN-153068 + +The Bonjour Reflector option is supported on up to 16 interfaces. If you enable it on more than 16 interfaces, the commit succeeds and the Bonjour Reflector option is enabled only for the first 16 interfaces and ignored for any additional interfaces. + +## PAN-151238 + +There is a known issue where M-100 appliances are able to download and install a PAN-OS 10.0 release image even though the M-100 appliance is no longer supported after PAN-OS 9.1. (Refer to the [hardware end-of-life dates](https://www.paloaltonetworks.com/services/support/end-of-life-announcements/hardware-end-of-life-dates.html).) + +## PAN-151085 + +On a PA-7000 Series firewall chassis having multiple slots, when HA clustering is enabled on an active/active HA pair, the session table count for one of the peers can show a higher count than the actual number of active sessions on that peer. This behavior can be seen when the session is being set up on a non-cache slot (for example, when a session distribution policy is set to round-robin or session-load); it is caused by the additional cache lookup that happens when HA cluster participation is enabled. + +## PAN-150801 + +Automatic quarantine of a device based on forwarding profile or log setting does not work on the PA-7000 Series firewalls. + +## PAN-150515 + +After you install the device certificate on a new Panorama management server, Panorama is not able to connect to the IoT Security edge service. + +**Workaround:** Restart Panorama to connect to the IoT Security edge service. + +## PAN-150345 + +During updates to the Device Dictionary, the IoT Security service does not push new Device-ID attributes (such as new device profiles) to the firewall until a manual commit occurs. + +**Workaround:** Perform a force commit to push the attributes in the content update to the firewall. + +## PAN-150361 + +In an Active-Passive high availability (HA) configuration, an error displays if you create a device object on the passive device. + +**Workaround:** Load the running configuration and perform a force commit to sync the devices. + +## PAN-148971 + +If you enter a search term for Events that are related to IoT in the System logs and apply the filter, the page displays an `Invalid term` error. + +**Workaround:** Specify `iot` as the **Type Attribute** to filter the logs and use the search term as the **Description Attribute**. For example: `( subtype eq iot ) and ( description contains 'gRPC connection' )`. + +## PAN-148924 + +In an active-passive HA configuration, tags for dynamic user groups are not persistent after rebooting the firewall because the active firewall does not sync the tags to the passive firewall during failover. + +## PAN-146995 + +After downgrading a Panorama management server from PAN-OS 10.0 to PAN-OS 9.1, the `VLD` and `logd` processes may crash when Panorama reboots. + +**Workaround:** Panorama automatically restarts the `VLD` and `logd` processes. + +## PAN-146807 + +Changing the device group configured in a monitoring definition from a child DG to a parent DG, or vice versa, might cause firewalls configured in the child DG to lose IP tag mapping information received from the monitoring definition. Only firewalls assigned to the parent DG receive IP tag mapping updates. + +**Workaround**: Perform a manual config sync on the device group that lost the IP tag mapping information. + +## PAN-146485 + +On the Panorama management server, adding, deleting, or modifying the upstream NAT configuration (**Panorama** > **SD-WAN** > **Devices**) does not display the branch template stack as `out of sync`. + +Additionally, adding, deleting, or modifying the BGP configuration (**Panorama** > **SD-WAN** > **Devices**) does not display the hub and branch template stacks as `out of sync`. For example, modifying the BGP configuration on the branch firewall does not cause the hub template stack to display as `out of sync`, nor does modifying the BGP configuration on the hub firewall cause the branch template stack as `out of sync`. + +**Workaround:** After performing a configuration change, **Commit and Push** the configuration changes to all hub and branch firewalls in the VPN cluster containing the firewall with the modified configuration. + +## PAN-145460 + +CN-MGMT pods fail to connect to the Panorama management server when using the Kubernetes plugin. + +**Workaround:** **Commit** the Panorama configuration after the CN-MGMT pod successfully registers with Panorama. + +## PAN-144889 + +On the Panorama management server, adding, deleting, or modifying the original subnet IP, or adding a new subnet after you successfully configure a tunnel IP subnet, for the SD-WAN 1.0.2 plugin does not display the managed firewall templates (**Panorama** > **Managed Devices** > **Summary**) as `Out of Sync`. + +**Workaround**: When modifying the original subnet IP, or adding a new subnet, push the template configuration changes to your managed firewalls and **Force Template Values** (**Commit** > **Push to Devices** > **Edit Selections**). + +## PAN-143132 + +Fetching the device certificate from the Palo Alto Networks Customer Support Portal (CSP) may fail and displays the following error in the CLI: + +`ERROR Failed to process S1C msg: Error` + +**Workaround:** Retrying fetching the device certificate from the Palo Alto Networks CSP. + +## PAN-141630 + +Current performance limitation: single data plane use only. The PA-5200 Series and PA-7000 Series firewalls that support 5G network slice security, 5G equipment ID security, and 5G subscriber ID security use a single data plane only, which currently limits the firewall performance. + +## PAN-140959 + +The Panorama management server allows you to downgrade Zero Touch Provisioning (ZTP) firewalls to PAN-OS 9.1.2 and earlier releases where ZTP functionality is not supported. + +## PAN-140008 + +ElasticSearch is forced to restart when the `masterd` process misses too many heartbeat messages on the Panorama management server resulting in a delay in a log query and ingestion. + +## PAN-136763 + +On the Panorama management server, managed firewalls display as `disconnected` when installing a PAN-OS software update (**Panorama** > **Device Deployment** > **Software**) but display as `connected` when you view your managed firewalls Summary (**Panorama** > **Managed Devices** > **Summary**) and from the CLI. + +**Workaround:** Log out and log back in to the Panorama web interface. + +## PAN-135742 + +There is an issue in HTTP2 session decryption where the App-ID in the decryption log is the App-ID of the parent session (which is web-browsing). + +## PAN-134053 + +ACC does not filter WildFire logs from Dynamic User Groups. + +## PAN-132598 + +The Panorama management server does not check for duplicate addresses in address groups (**Objects** > **Address Groups**) and duplicate services in service groups (**Objects** > **Service Groups**) when created from the CLI. + +## PAN-130550 + +```caveat +PA-3200 Series, PA-5220, PA-5250, PA-5260, and PA-7000 Series firewalls +``` + +For traffic between virtual systems (inter-vsys traffic), the firewall cannot perform source NAT using dynamic IP (DIP) address translation. + +**Workaround:** Use source NAT with Dynamic IP and Port (DIPP) translation on inter-vsys traffic. + +## PAN-127813 + +In the current release, SD-WAN auto-provisioning configures hubs and branches in a hub and spoke model, where branches don’t communicate with each other. Expected branch routes are for generic prefixes, which can be configured in the hub and advertised to all branches. Branches with unique prefixes are not published up to the hub. + +**Workaround:** Add any specific prefixes for branches to the hub advertise-list configuration. + +## PAN-127206 + +If you use the CLI to enable the cleartext option for the Include Username in HTTP Header Insertion Entries feature, the authentication request to the firewall may become unresponsive or time out. + +## PAN-123277 + +Dynamic tags from other sources are accessible using the CLI but do not display on the Panorama web interface. + +## PAN-123040 + +When you try to view network QoS statistics on an SD-WAN branch or hub, the QoS statistics and the hit count for the QoS rules don’t display. A workaround exists for this issue. Please contact Support for information about the workaround. + +## PAN-120440 + +There is an issue on M-500 Panorama management servers where any ethernet interface with an IPv6 address having Private PAN-DB-URL connectivity only supports the following format: `2001:DB9:85A3:0:0:8A2E:370:2`. + +## PAN-120423 + +PAN-OS 10.0.0 does not support the XML API for GlobalProtect logs. + +## PAN-120303 + +There is an issue where the firewall remains connected to the PAN-DB-URL server through the old management IP address on the M-500 Panorama management server, even when you configured the Eth1/1 interface. + +**Workaround:** Update the PAN-DB-URL IP address on the firewall using one of the methods below. + +- Modify the PAN-DB Server IP address on the managed firewall. + 1. On the web interface, delete the **PAN-DB Server** IP address (**Device** > **Setup** > **Content ID** > **URL Filtering** settings). + 2. **Commit** your changes. + 3. Add the new M-500 Eth1/1 IP PAN-DB IP address. + 4. **Commit** your changes. +- Restart the firewall (devsrvr) process. + 1. Log in to the firewall CLI. + 2. Restart the devsrvr process: `debug software restart process device-server` + +## PAN-116017 + +```caveat +Google Cloud Platform (GCP) only +``` + +The firewall does not accept the DNS value from the initial configuration (init-cfg) file when you bootstrap the firewall. + +**Workaround:** Add DNS value as part of the bootstrap.xml in the bootstrap folder and complete the bootstrap process. + +## PAN-115816 + +```caveat +Microsoft Azure only +``` + +There is an intermittent issue where an Ethernet (eth1) interface does not come up when you first boot up the firewall. + +**Workaround:** Reboot the firewall. + +## PAN-114495 + +Alibaba Cloud runs on a KVM hypervisor and supports two Virtio modes: DPDK (default) and MMAP. If you deploy a VM-Series firewall running PAN-OS 9.0 in DPDK packet mode and you then switch to MMAP packet mode, the VM-Series firewall duplicates packets that originate from or terminate on the firewall. As an example, if a load balancer or a server behind the firewall pings the VM-Series firewall after you switch from DPDK packet mode to MMAP packet mode, the firewall duplicates the ping packets. + +Throughput traffic is not duplicated if you deploy the VM-Series firewall using MMAP packet mode. + +## PAN-112694 + +```caveat +Firewalls with multiple virtual systems only +``` + +If you configure dynamic DNS (DDNS) on a new interface (associated with vsys1 or another virtual system) and you then create a **New** Certificate Profile from the drop-down, you must set the location for the Certificate Profile to Shared. If you configure DDNS on an existing interface and then create a new Certificate Profile, we also recommend that you choose the Shared location instead of a specific virtual system. Alternatively, you can select a preexisting certificate profile instead of creating a new one. + +## PAN-112456 + +You can temporarily submit a change request for a URL Category with three suggested categories; however, only two categories are supported. Do not add more than two suggested categories to a change request until we address this issue. If you submit more than two suggested categories, only the first two categories in the change request are evaluated. + +## PAN-112135 + +You cannot unregister tags for a subnet or range in a dynamic address group from the web interface. + +**Workaround:** Use an XML API request to unregister the tags for the subnet or range. + +## PAN-111928 + +Invalid configuration errors are not displayed as expected when you revert a Panorama management server configuration. + +**Workaround:** After you revert the Panorama configuration, **Commit** (**Commit** > **Commit to Panorama**) the reverted configuration to display the invalid configuration errors. + +## PAN-111866 + +The push scope selection on the Panorama web interface displays incorrectly even though the commit scope displays as expected. This issue occurs when one administrator makes configuration changes to separate device groups or templates that affect multiple firewalls and a different administrator attempts to push those changes. + +**Workaround:** Perform one of the following tasks. + +- Initiate a **Commit to Panorama** operation followed by a **Push to Devices** operation for the modified device group and template configurations. +- Manually select the devices that belong to the modified device group and template configurations. + +## PAN-111729 + +If you disable DPDK mode and enable it again, you must immediately reboot the firewall. + +## PAN-111670 + +Tagged VLAN traffic fails when sent through an SR-IOV adapter. + +## PAN-110794 + +DGA-based threats shown in the firewall threat log display the same name for all such instances. + +## PAN-109526 + +The system log does not correctly display the URL for CRL files; instead, the URLs are displayed with encoded characters. + +## PAN-104780 + +If you configure a HIP object to match only when a connecting endpoint is managed (**Objects** > **GlobalProtect** > **HIP Objects** > **** > **General** > **Managed**), iOS and Android endpoints that are managed by AirWatch are unable to successfully match the HIP object and the HIP report incorrectly indicates that these endpoints are not managed. This issue occurs because GlobalProtect gateways cannot correctly identify the managed status of these endpoints. + +Additionally, iOS endpoints that are managed by AirWatch are unable to match HIP objects based on the endpoint serial number because GlobalProtect gateways cannot identify the serial numbers of these endpoints; these serial numbers do not appear in the HIP report. + +## PAN-103276 + +Adding a disk to a virtual appliance running Panorama 8.1 or a later release on VMware ESXi 6.5 update1 causes the Panorama virtual appliance and host web client to become unresponsive. + +**Workaround:** Upgrade the ESXi host to ESXi 6.5 update2 and add the disk again. + +## PAN-101688 + +```caveat +Panorama plugins +``` + +The IP address-to-tag mapping information registered on a firewall or virtual system is not deleted when you remove the firewall or virtual system from a Device Group. + +**Workaround:** Log in to the CLI on the firewall and enter the following command to unregister the IP address-to-tag mappings: `debug object registered-ip clear all`. + +## PAN-101537 + +After you configure and push address and address group objects in Shared and vsys-specific device groups from the Panorama management server to managed firewalls, executing the `show log direction equal | in ` command on a managed firewall only returns address and address group objects pushed form the Shared device group. + +**Workaround:** Specify the vsys in the query string: + +`admin>` `set system target-vsys ` + +`admin>` `show log direction equal query equal ‘vsys eq ’ | in ` + +## PAN-98520 + +When booting or rebooting a PA-7000 Series Firewall with the SMC-B installed, the BIOS console output displays attempts to connect to the card's controller in the System Memory Speed section. The messages can be ignored. + +## PAN-97757 + +GlobalProtect authentication fails with an `Invalid username/password` error (because the user is not found in **Allow List**) after you enable GlobalProtect authentication cookies and add a RADIUS group to the **Allow List** of the authentication profile used to authenticate to GlobalProtect. + +**Workaround:** Disable GlobalProtect authentication cookies. Alternatively, disable (clear) **Retrieve user group from RADIUS** in the authentication profile and configure group mapping from Active Directory (AD) through LDAP. + +## PAN-97524 + +```caveat +Panorama management server only +``` + +The Security Zone and Virtual System columns (**Network** tab) display `None` after a Device Group and Template administrator with read-only privileges performs a context switch. + +## PAN-96446 + +A firewall that is not included in a Collector Group fails to generate a system log if logs are dropped when forwarded to a Panorama management server that is running in Management Only mode. + +## PAN-95773 + +On VM-Series firewalls that have Data Plane Development Kit (DPDK) enabled and that use the i40e network interface card (NIC), the `show session info` CLI command displays an inaccurate throughput and packet rate. + +**Workaround:** Disable DPDK by running the `set system setting dpdk-pkt-io off` CLI command. + +## PAN-95028 + +For administrator accounts that you created in PAN-OS 8.0.8 and earlier releases, the firewall does not apply password profile settings (**Device** > **Password Profiles**) until after you upgrade to PAN-OS 8.0.9 or a later release and then only after you modify the account passwords. (Administrator accounts that you create in PAN-OS 8.0.9 or a later release do not require you to change the passwords to apply password profile settings.) + +## PAN-94846 + +When DPDK is enabled on the VM-Series firewall with i40e virtual function (VF) driver, the VF does not detect the link status of the physical link. The VF link status remains up, regardless of changes to the physical link state. + +## PAN-94093 + +HTTP Header Insertion does not work when jumbo frames are received out of order. + +## PAN-93968 + +The firewall and Panorama web interfaces display vulnerability threat IDs that are not available in PAN-OS 9.0 releases (**Objects** > **Security Profiles** > **Vulnerability Protection** > **** > **Exceptions**). To confirm whether a particular threat ID is available in your release, monitor the release notes for each new Applications and Threats content update or check the Palo Alto Networks [Threat Vault](https://threatvault.paloaltonetworks.com) to see the minimum PAN-OS release version for a threat signature. + +## PAN-93607 + +When you configure a VM-500 firewall with an SCTP Protection profile (**Objects** > **Security Profiles** > **SCTP Protection**) and you try to add the profile to an existing Security Profile Group (**Objects** > **Security Profile Groups**), the Security Profile Group doesn’t list the SCTP Protection profile in its drop-down list of available profiles. + +**Workaround:** Create a new Security Profile Group and select the SCTP Protection profile from there. + +## PAN-93532 + +When you configure a firewall running PAN-OS 9.0 as an nCipher HSM client, the web interface on the firewall displays the nCipher server status as Not Authenticated, even though the HSM state is up (**Device** > **Setup** > **HSM**). + +## PAN-93193 + +The memory-optimized VM-50 Lite intermittently performs slowly and stops processing traffic when memory utilization is critically high. To prevent this issue, make sure that you do not: + +- Switch to the firewall **Context** on the Panorama management server. +- Commit changes when a dynamic update is being installed. +- Generate a custom report when a dynamic update is being installed. +- Generate custom reports during a commit. + +**Workaround:** When the firewall performs slowly, or you see a critical System log for memory utilization, wait for 5 minutes and then manually reboot the firewall. + +Use the Task Manager to verify that you are not performing memory intensive tasks such as installing dynamic updates, committing changes or generating reports, at the same time, on the firewall. + +## PAN-91802 + +On a VM-Series firewall, the **clear session all** CLI command does not clear GTP sessions. + +## PAN-83610 + +In rare cases, a PA-5200 Series firewall (with an FE100 network processor) that has session offload enabled (default) incorrectly resets the UDP checksum of outgoing UDP packets. + +**Workaround:** In PAN-OS 8.0.6 and later releases, you can persistently disable session offload for only UDP traffic using the `set session udp-off load no` CLI command. + +## PAN-83236 + +The VM-Series firewall on Google Cloud Platform does not publish firewall metrics to Google Stack Monitoring when you manually configure a DNS server IP address (**Device** > **Setup** > **Services**). + +**Workaround:** The VM-Series firewall on Google Cloud Platform must use the DNS server that Google provides. + +## PAN-83215 + +SSL decryption based on ECDSA certificates does not work when you import the ECDSA private keys onto an nCipher nShield hardware security module (HSM). + +## PAN-81521 + +Endpoints failed to authenticate to GlobalProtect through Kerberos when you specify an FQDN instead of an IP address in the Kerberos server profile (**Device** > **Server Profiles** > **Kerberos**). + +**Workaround:** Replace the FQDN with the IP address in the Kerberos server profile. + +## PAN-77125 + +PA-7000 Series, PA-5450, PA-5200 Series, and PA-3200 Series firewalls configured in tap mode don’t close offloaded sessions after processing the associated traffic; the sessions remain open until they time out. + +**Workaround:** Configure the firewalls in virtual wire mode instead of tap mode, or disable session offloading by running the `set session off load no` CLI command. + +## PAN-75457 + +In WildFire appliance clusters that have three or more nodes, the Panorama management server does not support changing node roles. In a three-node cluster for example, you cannot use Panorama to configure the worker node as a controller node by adding the HA and cluster controller configurations, configure an existing controller node as a worker node by removing the HA configuration, and then commit and push the configuration. Attempts to change cluster node roles from Panorama results in a validation error—the commit fails and the cluster becomes unresponsive. + +## PAN-73530 + +The firewall does not generate a packet capture (pcap) when a Data Filtering profile blocks files. + +## PAN-73401 + +When you import a two-node WildFire appliance cluster into the Panorama management server, the controller nodes report their state as out-of-sync if either of the following conditions exist: + +- You did not configure a worker list to add at least one worker node to the cluster. (In a two-node cluster, both nodes are controller nodes configured as an HA pair. Adding a worker node would make the cluster a three-node cluster.) +- You did not configure a service advertisement (either by enabling or not enabling advertising DNS service on the controller nodes). + +**Workaround:** There are three possible workarounds to sync the controller nodes: + +- After you import the two-node cluster into Panorama, push the configuration from Panorama to the cluster. After the push succeeds, Panorama reports that the controller nodes are in sync. +- Configure a worker list on the cluster controller: + admin@wf500(active-controller)# `set deviceconfig cluster mode controller worker-list ` + (`` is the IP address of the worker node you are adding to the cluster.) This creates a three-node cluster. After you import the cluster into Panorama, Panorama reports that the controller nodes are in sync. When you want the cluster to have only two nodes, use a different workaround. +- Configure service advertisement on the local CLI of the cluster controller and then import the configuration into Panorama. The service advertisement can advertise that DNS is or is not enabled. + admin@wf500(active-controller)# `set deviceconfig cluster mode controller service-advertisement dns-service enabled yes` + or + admin@wf500(active-controller)# `set deviceconfig cluster mode controller service-advertisement dns-service enabled no` + Both commands result in Panorama reporting that the controller nodes are in sync. + +## PAN-70906 + +If the PAN-OS web interface and the GlobalProtect portal are enabled on the same IP address, then when a user logs out of the GlobalProtect portal, the administrative user is also logged out from the PAN-OS web interface. + +**Workaround:** Use the IP address to access the PAN-OS web interface and an FQDN to access the GlobalProtect portal. + +## PAN-69505 + +When viewing an external dynamic list that requires client authentication and you **Test Source URL**, the firewall fails to indicate whether it can reach the external dynamic list server and returns a URL access error (**Objects** > **External Dynamic Lists**). + +## PAN-40079 + +The VM-Series firewall on KVM, for all supported Linux distributions, does not support the Broadcom network adapters for PCI pass-through functionality. + +## PAN-39636 + +Regardless of the **Time Frame** you specify for a scheduled custom report on a Panorama M-Series appliance, the earliest possible start date for the report data is effectively the date when you configured the report (**Monitor** > **Manage Custom Reports**). For example, if you configure the report on the 15th of the month and set the **Time Frame** to **Last 30 Days**, the report that Panorama generates on the 16th will include only data from the 15th onward. This issue applies only to scheduled reports; on-demand reports include all data within the specified **Time Frame**. + +**Workaround:** To generate an on-demand report, click **Run Now** when you configure the custom report. + +## PAN-38255 + +When you perform a factory reset on a Panorama virtual appliance and configure the serial number, logging does not work until you reboot Panorama or execute the `debug software restart process management-server` CLI command. + +## PAN-31832 + +The following issues apply when configuring a firewall to use a hardware security module (HSM): + +- **nCipher nShield Connect**—The firewall requires at least four minutes to detect that an HSM was disconnected, causing SSL functionality to be unavailable during the delay. +- **SafeNet Network**—When losing connectivity to either or both HSMs in an HA configuration, the display of information from the `show high-availability state` and `show hsm info` commands are blocked for 20 seconds. diff --git a/web/data/issues/PAN-OS/known/10.1.5_2026-03-16.md b/web/data/issues/PAN-OS/known/10.1.5_2026-03-16.md new file mode 100644 index 0000000..cdf6b74 --- /dev/null +++ b/web/data/issues/PAN-OS/known/10.1.5_2026-03-16.md @@ -0,0 +1,1000 @@ +--- +type: Known +product: PAN-OS +version: 10.1.5 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## APL-15000 + +When you move a firewall from one Strata Logging Service instance to another, it can take up to an hour for the firewall to begin sending logs to the new instance. + +## APL-8269 + +For data retrieved from Strata Logging Service, the Threat Name column in **Panorama** > **ACC** > **threat-activity** appears blank. + +## PLUG-380 + +When you rename a device group, template, or template stack in Panorama that is part of a VMware NSX service definition, the new name is not reflected in NSX Manager. Therefore, any ESXi hosts that you add to a vSphere cluster are not added to the correct device group, template, or template stack and your Security policy is not pushed to VM-Series firewalls that you deploy after you rename those objects. There is no impact to existing VM-Series firewalls. + +## WF500-5559 + +An intermittent error while analyzing signed PE samples on the WildFire appliance might cause analysis failures. + +## WF500-5471 + +After using the firewall CLI to add a WildFire appliance with an IPv6 address, the initial connection may fail. + +**Workaround:** Retry connecting after you restart the web server with the following command: `debug software restart process web-server`. + +## PAN-281370 + +The Advanced WildFire Inline ML models **OOXML** and **Mach-O** erroneously display as being available from the CLI; however, they are only available on PAN-OS 11.1.3 and later releases. + +## PAN-260851 + +From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (**Objects** > **Applications**) tag. + +## PAN-228273 + +On the Panorama management server in FIPS-CC mode, the ElasticSearch cluster fails to come up and the `show log-collector-es-cluster health` command displays the `status` is `red`. This results in log ingestion issues for Panorama in Panorama only or Log Collector mode. + +## PAN-227344 + +On the Panorama management server, PDF Summary Reports (**Monitor** > **PDF Reports** > **Manage PDF Summary**) display no data and are blank when predefined reports are included in the summary report. + +## PAN-223488 + +```caveat +This issue is now resolved. PAN-OS 10.1.12 Addressed Issues. +``` + +On the M-600 appliance, closed ElasticSearch shards are not deleted from the M-600 appliance. This causes the ElasticSearch shard purging to not work as expected, resulting in high disk usage. + +## PAN-223365 + +The Panorama management server is unable to query any logs if the ElasticSearch health status for any Log Collector (**Panorama** > **Managed Collector** is degraded. + +**Workaround:** [Log in to the Log Collector CLI](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli) and restart ElasticSearch. + +`admin``debug elasticsearch es-restart all` + +## PAN-218521 + +The ElasticSearch process on the M-600 appliance in Log Collector mode may enter a continuous reboot cycle. This results in the M-600 appliance becoming unresponsive, consuming logging disk space, and preventing new log ingestion. + +## PAN-217307 + +```caveat +This issue is now resolved. See PAN-OS 10.1.14 Addressed Issues. +``` + +The following Security policy rule (**Policies** > **Security**) filters return no results: + +`log-start eq no` + +`log-end eq no` + +`log-end eq yes` + +## PAN-216214 + +For Panorama-managed firewalls in an Active/Active High Availability (HA) configuration where you configure the firewall HA settings (**Device** > **High Availability**) in a template or template stack (**Panorama** > **Templates**), performing a local commit on one of the HA firewalls triggers an HA config sync on the peer firewall. This causes the HA peer configuration to go `Out of Sync`. + +## PAN-215679 + +After installing the VM-Series firewall on Azure Stack HCI or Hyper-V, the memory usage increases to 70%. + +## PAN-213746 + +On the Panorama management server, the **Hostkey** displayed as `undefined undefined` if you override an SSH Service Profile (**Device** > **Certificate Management** > **SSH Service Profile**) Hostkey configured in a Template from the Template Stack. + +## PAN-212889 + +```caveat +This issue is now resolved. See PAN-OS 10.1.11 Addressed Issues. +``` + +On the Panorama management server, different threat names are used when querying the same threat in the Threat Monitor (**Monitor** > **App Scope** > **Threat Monitor**) and **ACC**. This results in the ACC displaying `no data to display` when you are redirected to the ACC after clicking a threat name in the Threat Monitor and filtering the same threat name in the Global Filters. + +## PAN-208325 + +```caveat +This issue is now resolved. See PAN-OS 10.1.10 Addressed Issues. +``` + +The following NextGen firewalls are unable to automatically renew the device certificate (**Device** > **Setup** > **Management** or **Panorama** > **Setup** > **Management**). + +- PA-410 Firewall +- PA-440, PA-450, and PA-460 Firewalls +- PA-5450 Firewall + +**Workaround:** Log in to the [firewall CLI](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-cli-quick-start/get-started-with-the-cli/access-the-cli) and fetch the device certificate. + +`admin>``request certificate fetch` + +## PAN-206268 + +```caveat +This issue is now resolved. See PAN-OS 10.1.10 Addressed Issues. +``` + +On the Panorama management server, the Auth Key field was erroneously displayed when you configure the Panorama Settings (**Device** > **Setup** > **Management**) as part of a template or template stack configuration. + +## PAN-206243 + +The PA-220 firewall reaches the maximum disk usage capacity multiple a day that requires a disk cleanup. A critical system log (**Monitor** > **Logs** > **System**) is generated each time the firewall reaches maximum disk usage capacity. + +## PAN-205187 + +ElasticSearch may not start properly when a newly installed Panorama virtual appliance powers on for the first time, resulting in the Panorama virtual appliance being unable to query logs forwarded from the managed firewall to a Log Collector. + +**Workaround:** [Log in to the Panorama CLI](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli) and start the PAN-OS software. + +`admin>``request restart software` + +## PAN-201855 + +On the Panorama management server, cloning any template (**Panorama** > **Templates**) corrupts certificates (**Device** > **Certificate Management** > **Certificates**) with the **Block Private Key Export** setting enabled across all templates. This results in managed firewalls experiencing issues wherever the corrupted certificate is referenced. + +For example, you have template A, B, and C where templates A and B have certificates with the **Block Private Key Export** setting enabled. Cloning template C corrupts the certificates with **Block Private Key Export** setting enabled in templates A and B. + +**Workaround:** After cloning a template, delete and re-import the corrupted certificates. + +## PAN-199557 + +On M-600 appliances in an Active/Passive high availability (HA) configuration, the `configd` process restarts due to a memory leak on the `Active` Panorama HA peer. This causes the Panorama web interface and CLI to become unresponsive. + +**Workaround:** Manually reboot the `Active` Panorama HA peer. + +## PAN-197341 + +On the Panorama management server, if you create multiple device group **Objects** with the same name in the Shared device group and any additional device groups (**Panorama** > **Device Groups**) under the same device group hierarchy that are used in one or more **Policies**, renaming the object with a shared name in any device group causes the object name to change in the policies where it is used. This issue applies only to device group objects that can be referenced in a Security policy rule. + +For example: + +1. You create a parent device group `DG-A` and a child device group `DG-B`. +2. You create address objects called `AddressObjA` in the `Shared`, `DG-A` and `DG-B` device groups and add `AddressObjA` to a Security policy rule under `DG-A` and `DG-B`. +3. Later, you change the `AddressObjA` name in the `Shared` device group to `AddressObjB`. + +Changing the name of the address object in the `Shared` device group causes the references in the Policy rule to use the renamed `Shared` object instead of the device group object. + +## PAN-197097 + +```caveat +This issue is now resolved. See PAN-OS 10.1.9 Addressed Issues. +``` + +Large Scale VPN (LSVPN) does not support IPv6 addresses on the satellite firewall. + +## PAN-196758 + +On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you **Preview Changes** (**Commit** > **Push to Devices** > **Edit Selections** or **Commit** > **Commit and Push** > **Edit Selections**). + +## PAN-196309 + +```caveat +PA-5450 firewall only +``` + +In PAN-OS 10.1.5-h1, a firewall configured with a Policy-Based Forwarding policy flaps when a commit is performed, even when the next hop is reachable. + +## PAN-194519 + +```caveat +PA-5450 firewall only +``` + +Trying to configure a custom payload format under **Device** > **Server Profiles** > **HTTP** yields a Javascript error. + +## PAN-194515 + +```caveat +PA-5450 firewall only +``` + +The Panorama web interface does not display any predefined template stack variables in the dropdown menu under **Device** > **Setup** > **Log Interface** > **IP Address**. + +**Workaround:** Configure the log interface IP address on the individual firewall web interface instead of on Panorama. + +## PAN-193518 + +All logs (**Monitor** > **Logs**) generated by a firewall running a PAN-OS 10.0 release are not accessible if you downgrade from PAN-OS 10.1 to PAN-OS 10.0, and then upgrade back to PAN-OS 10.1. + +**Workaround:** If you need to downgrade from PAN-OS 10.1 to PAN-OS 10.0 and then back to PAN-OS 10.1, downgrade to PAN-OS 10.0.11 to ensure that all logs ingested while running a PAN-OS 10.0 release remain accessible after upgrade back to PAN-OS 10.1. + +## PAN-192403 + +```caveat +PA-5450 firewall only +``` + +There is no commit warning in the web interface when configuring the management interface and logging interface in the same subnetwork. Having both interfaces in the same subnetwork can cause routing and connectivity issues. + +## PAN-191558 + +```caveat +This issue is now resolved. See PAN-OS 10.1.6-h3 Addressed Issues. +``` + +After an upgrade to PAN-OS 10.1.5, Global Find did not display all results related to a searched item. + +## PAN-190727 + +```caveat +PA-5450 firewall only +``` + +Documentation for configuring the log interface is unavailable on the web interface and in the PAN-OS Administrator’s Guide. + +## PAN-189057 + +```caveat +HA configuration +``` + +On the Panorama management server, Panorama enters a `non-functional` state due to `php.debug.log` life taking up too much space. + +**Workaround:** Disable the debug flag for Panorama. + +1. [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface). +2. In the same browser you are logged into the Panorama web interface, enter the following URL. + `https:///debug` +3. Uncheck (disable) **Debug** or **Clear Debug**. +4. () Repeat this step on each Panorama high availability (HA) peer if Panorama is in a HA configuration. + +## PAN-188052 + +Devices in FIPS-CC mode are unable to connect to servers utilizing ECDSA-based host keys that impacts exporting logs (**Device** > **Scheduled Log Export**), exporting configurations (**Device** > **Scheduled Config Export**), or the `scp export` command in the CLI. + +**Workaround:** Use RSA-based host keys on the destination server. + +## PAN-187685 + +On the Panorama management server, the Template Status displays no synchronization status (**Panorama** > **Managed Devices** > **Summary**) after a bootstrapped firewall is successfully added to Panorama. + +**Workaround:** After the bootstrapped firewall is successfully added to Panorama, [log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) and select **Commit** > **Push to Devices**. + +## PAN-185286 + +```caveat +PA-5400 Series firewalls only +``` + +On the Panorama management server, the device health resources (**Panorama** > **Managed Devices** > **Health**) do not populate. + +## PAN-180661 + +```caveat +This issue is now resolved. See PAN-OS 10.1.6 Addressed Issues. +``` + +On the Panorama management server, pushing an unsupported Minimum Password Complexity (**Device** > **Setup** > **Management**) to a managed firewall erroneously displays `commit time out` as the reason the commit failed. + +## PAN-178194 + +```caveat +This issue is now resolved. See PAN-OS 10.1.7 Addressed Issues. +``` + +A UI issue in PAN-OS renders the contents of the **Inline ML** tab in the **URL Filtering Profile** inaccessible on firewalls licensed for Advanced URL Filtering. Additionally, a message indicating that a **License required for URL filtering to function** is unavailable displays at the bottom of the UI. These errors do not affect the operation of Advanced URL Filtering or URL Filtering Inline ML. + +**Workaround:** Configuration settings for URL Filtering Inline ML must be applied through the CLI. The following configuration commands are available: + +- Define URL exceptions for specific web sites— + `admin#``set profiles url-filtering mlav-category-exception` + +- Configuration settings for each inline ML model— + `admin#``set profiles url-filtering mlav-engine-urlbased-enabled` + +## PAN-177455 + +```caveat +This issue is now resolved. See PAN-OS 10.1.6 Addressed Issues. +``` + +PAN-OS 10.1.2 is not supported on PA-7000 Series firewalls with HA (High Availability) clustering enabled and using an HA4 communication link. Attempting to load PAN-OS 10.1.2 on the firewall causes the PA-7000 100G NPC to go offline. As a result, the firewall fails to boot normally and enters maintenance mode. HA Pairs of Active-Passive and Active-Active firewalls are not affected. + +## PAN-175022 + +```caveat +This issue is now resolved. See PAN-OS 10.1.6 Addressed Issues. +``` + +The PAN-OS web interface table of contents do not display or the help contents reload continuously. + +## PAN-174982 + +In HA active/active configurations where, when interfaces that were associated with a virtual router were deleted, the configuration change did not sync. + +## PAN-172274 + +When you activate the advanced URL filtering license, your license entitlements for PAN-DB and advanced URL filtering might not display correctly on the firewall — this is a display anomaly, not a licensing issue, and does not affect access to the services. + +**Workaround:** Issue the following command to retrieve and update the licenses: `license request fetch`. + +## PAN-172113 + +If you request a User Activity Report on Panorama and the vsys key value in the XML is an unsupported value, the resulting job becomes unresponsive at 10% and does not complete until you manually stop the job in the web interface. + +**Workaround:**Change the vsys key to a valid device group, commit your changes, and run the User Activity Report again. + +## PAN-172132 + +```caveat +This issue is now resolved by PAN-189643. See PAN-OS 10.1.6 Addressed Issues. +``` + +QoS fails to run on a tunnel interface (for example, tunnel.1). + +## PAN-172067 + +When you configure an HTTP server profile (**Device** > **Server Profiles** > **HTTP** or **Panorama** > **Server Profiles** > **HTTP**), the **Username** and **Password** fields are always required regardless of whether **Tag Registration** is enabled. + +**Workaround:** When you configure an HTTP server profile, always enter a username and password to successfully create the HTTP server profile. + +You must enter a username and password even if the HTTP server does not require it. The HTTP server ignores the username and password if they are not required for the firewall to connect. + +## PAN-172061 + +A process (`all_pktproc`) can cause intermittent crashes on the Passive PA-5450 firewall in an Active/Passive HA pair. This issue may be seen during an upgrade or reload of the firewall with traffic and when clearing sessions. + +## PAN-171938 + +No results are displayed when you **Show Application Filter** for a Security policy rule (**Policies** > **Security** > **Application** > **Value** > **Show Application Filter**). + +## PAN-171723 + +If you use Panorama to push a configuration that uses App-ID Cloud Engine (ACE) App-IDs and then you downgrade the firewall from PAN-OS 10.1 to PAN-OS 10.0, the installation succeeds but after you reboot, the auto-commit fails. + +**Workaround:** Remove all ACE application configurations before downgrading. + +## PAN-171714 + +```caveat +This issue is now resolved. See PAN-OS 10.1.7 Addressed Issues. +``` + +If you use the NetBIOS format (`domain\user`) for the IP address-to-username mapping and the firewall receives the group mapping information from the Cloud Identity Engine, the firewall does not successfully match the user to the correct group. + +## PAN-171706 + +```caveat +This issue is now resolved. See PAN-OS 10.1.11 Addressed Issues. +``` + +If you are using Panorama to manage firewalls with multiple virtual systems and the virtual system that is the User-ID hub uses an alias, the local commit on Panorama is successful but the commit to the firewall fails. + +## PAN-171673 + +On the Panorama management server, the **ACC** returns inaccurate results when you filter for **New App-ID** in the **Application** usage widget. + +## PAN-171635 + +If you have an on-premise Active Directory and there is an existing group mapping configuration on the firewall, if you migrate the group mapping to the Cloud Identity Engine, the firewall does not remove the existing group mapping even if the configuration is disabled and the firewall is rebooted, which may conflict with new mappings from the Cloud Identity Engine. + +**Workaround**: Use the debug user-id clear domain-map command to remove the existing group mappings from the firewall. + +## PAN-171224 + +On the Panorama management server, a custom report (**Monitor** > **Managed Custom Reports**) with a high volume of unique data objects is not generated when you click **Run Now**. + +## PAN-171145 + +If you edit or remove the value for the `mail` attribute in your on-premise Active Directory, the changes may not be immediately reflected on the firewall after it syncs with the Cloud Identity Engine. + +## PAN-170923 + +In **Policies** > **Security** > **Policy Optimizer** > **New App Viewer**, when you select a Security policy rule in the bottom portion of the screen, the application data in the application browser (top portion of screen) does not match the Apps Seen on the selected rule. In addition, filtering in the application browser based on Apps Seen does not work. + +## PAN-170462 + +```caveat +This issue is now resolved. See PAN-OS 10.1.6 Addressed Issues. +``` + +SaaS applications downloaded from the App-ID Cloud Engine (ACE) do not appear in daily application reports (**Monitor** > **Reports** > **Application Reports**) or in the **Application** column of the **Application Usage** widget in **ACC** > **Network Activity**. + +## PAN-170270 + +Using the CLI to power on a PA-5450 Networking Card (NC) in an Active HA firewall can cause its Passive peer to temporarily go down. + +## PAN-169906 + +The CN-Series Firewall as a Kubernetes Service does not support AF_XDP when deployed in CentOS. + +## PAN-168636 + +Connecting to the App-ID Cloud Engine (ACE) cloud using a management port with explicit proxy configured on it is not supported. Instead, use a data plane interface for the service route ([Prepare to Deploy App-ID Cloud Engine](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/app-id/cloud-based-app-id-service/prepare-to-deploy-app-id-cloud-engine.html) describes how to do this.) + +## PAN-168113 + +On the Panorama management server, you are unable to configure a master key (**Device** > **Master Key and Diagnostics**) for a managed firewall if an interface (**Network** > **Interfaces** > **Ethernet**) references a zone pushed from Panorama. + +**Workaround:** Remove the referenced zone from the interface configuration to successfully configure a master key. + +## PAN-167847 + +If you issue the command `opof stats`, then clear the results {opof stats -c}, the Active Sessions value is sometimes invalid. For example, you might see a negative number or an excessively large number. + +**Workaround:** Re-run the `opof stats` command after the offload completes. + +## PAN-167401 + +When a firewall or Panorama appliance configured with a proxy is upgraded to PAN-OS 10.0.3 or a later release, it fails to connect to edge service. + +## PAN-166464 + +```caveat +This issue is now resolved. See PAN-OS 10.1.6-h6 Addressed Issues. +``` + +PAN-OS reports the PA-5450 fan numbers incorrectly by listing them in the opposite order. This does not affect fan operation. For further information, contact Customer Support. + +## PAN-165669 + +If you configure a group that the firewall retrieves from the Cloud Identity Engine as the `user in` value in a filter query, Panorama is unable to retrieve the group membership and as a result, is unable to display this data in logs and custom reports. + +## PAN-164922 + +On the Panorama management server, a context switch to a managed firewall running a PAN-OS 8.1.0 to 8.1.19 release fails. + +## PAN-164885 + +```caveat +This issue is now resolved. See PAN-OS 10.1.14-h6 Addressed Issues +``` + +On the Panorama management server, pushes to managed firewalls (**Commit** > **Push to Devices** or **Commit and Push**) may fail when an EDL (**Objects** > **External Dynamic Lists**) is configured to **Check for updates** every 5 minutes due to the commit and EDL fetch processes overlapping. This is more likely to occur when multiple EDLs are configured to check for updates every 5 minutes. + +## PAN-164841 + +A successful deployment of a Panorama virtual appliance on Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform (GCP) is inaccessible when deploying using the PAN-OS 10.1.0-b6 release. + +## PAN-164647 + +On the Panorama management server, activating a license (**Panorama** > **Device Deployment** > **Licenses**) on managed firewalls in a high availability (HA) configuration causes the Safari web browser to become unresponsive. + +**Workaround:** [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) from a web browser other than Safari to successfully activate a license on managed firewalls in an HA configuration. + +## PAN-164618 + +The VM-Series firewall CLI and system logs display the license name `VM-SERIES-X`, while the user interface displays `VM-FLEX-X` (in both cases `X` is the number of vCPUs). In future releases the user interface will use the `VM-SERIES-X` format. + +## PAN-164586 + +If you use a value other than `mail` for the user or group email attribute in the Cloud Identity Engine, it displays in `user@domain` format in the CLI output. + +## PAN-163966 + +On the Panorama management server, the **ACC** and on demand reports (**Monitor** > **Manage Custom Reports**) are unable to fetch Directory Sync group membership when the Source User Group filter query is applied, resulting in no data being displayed for the filter when Directory Sync is configured as the Source User for a policy rule. + +## PAN-162836 + +On the VM-Series firewall, if you select **Device** > **Licenses** > **Deactivate VM** a popup window opens and you can choose **Subscriptions** or **Support** and press **Continue** to remove licenses and register the changes with the license server. When the license removal is complete the **Deactivate VM** window does not update its text to exclude deactivated licenses or close the window. + +**Workaround**: Wait until the license deactivation is complete, and click **Cancel** to close the window. + +## PAN-162164 + +```caveat +This issue is now resolved. See PAN-OS 10.1.6 Addressed Issues. +``` + +When upgrading a multi-dataplane firewall from PAN-OS 10.0 to 10.1, if the configuration includes the DHCP Broadcast Session option enabled, the commit fails. Auto-commit is not affected. + +**Workaround:**Load the configuration from running config (load config from running-config.xml) and perform a commit. + +## PAN-162088 + +```caveat +This issue is now resolved. See PAN-OS 10.1.9 Addressed Issues. +``` + +On the Panorama management server in a high availability (HA) configuration, content updates (**Panorama** > **Dynamic Updates**) manually uploaded to the active HA peer are not synchronized to the passive HA peer when you **Install** a content update and enable **Sync to HA Peer**. + +## PAN-161666 + +The firewall includes any users configured in the Cloud Identity Engine in the count of groups. As a result, some CLI command output does not accurately display the number of groups the firewall has retrieved from the Cloud Identity Engine and counts users as groups in the `No. of Groups` in the command output. If the attempt to retrieve the user or group fails, the information for the user or group still displays in the CLI command output. + +## PAN-161451 + +If you issue the command `opof stats`, there are occasional zero packet and byte counts coming from the DPDK counters. This occurs when a session is in the tcp-reuse state, and has no impact on the existing session. + +## PAN-160238 + +If you migrate traffic from a firewall running a PAN-OS version earlier than 9.0 to a firewall running PAN-OS 9.0 or later, you experience intermittent VXLAN packet drops if TCI policy is not configured for inspecting VXLAN traffic flows. + +**Workaround:**On the new firewall, create an app override for VXLAN outer headers as described in [What is an Application Override?](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVLCA0) and the video tutorial [How to Configure an Application Override Policy on the Palo Alto Networks Firewall](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PPDrCAO). + +PAN-OS version 9.0 can inspect both inner and outer VXLAN flows. If you want to inspect inner flows, you must define a tunnel content inspection (TCI) policy. + +## PAN-157444 + +As a result of a telemetry handling update, the Source Zone field in the DNS analytics logs (viewable in the DNS Analytics tab within AutoFocus) might not display correct results. + +## PAN-157327 + +On downgrade to PAN-OS 9.1, Enterprise Data Loss Prevention (DLP) filtering settings (**Device** > **Setup** > **DLP**) are not removed and cause commit errors for the downgraded firewall if you do not uninstall the Enterprise DLP plugin before downgrade. + +**Workaround:** After you successfully downgrade a managed firewall to PAN-OS 9.1, commit and push from Panorama to remove the Enterprise DLP filtering settings and complete the downgrade. + +1. Downgrade your managed firewall to PAN-OS 9.1 +2. Log in to the firewall web interface and view the **Tasks** to verify all auto commits related to the downgrade have completed successfully. +3. Log in to the Panorama web interface and **Commit** > **Commit and Push** to your managed firewall downgraded to PAN-OS 9.1. + +## PAN-157103 + +Multi-channel functionality may not be properly utilized on an VM-Series firewall deployed in VMware NSX-V after the service is first deployed. + +**Workaround**: Execute the command `debug dataplane pow status` to view the number of channels being utilized by the dataplane. + +Per pan-task Netx statisticsCounter Name 1 2 3 4 5 6 Total---------------------------------------------ready_dvf 2 0 0 0 0 0 2 + +If multi-channel functionality is not working, disable your NSX-V security policy and reapply it. Then reboot the VM-Series firewall. When the firewall is back up, verify that multi-channel functionality is working by executing the command `debug dataplane pow status`. It should now show multiple channels being utilized. + +Per pan-task Netx statisticsCounter Name 1 2 3 4 5 6 Total---------------------------------------------ready_dvf 1 1 0 0 0 0 2 + +## PAN-156598 + +```caveat +Panorama only +``` + +If you configure a standard custom vulnerability signature in a custom Vulnerability Protection profile in a shared device group, the shared profile custom signatures do not populate in the other device groups when you configure a combination custom vulnerability signature. + +**Workaround:** Use the CLI to update the combination signature. + +## PAN-154292 + +On the Panorama management server, downgrading from a PAN-OS 10.0 release to a PAN-OS 9.1 release causes Panorama commit (**Commit** > **Commit to Panorama**) failures if a custom report (**Monitor** > **Manage Custom Reports**) is configured to Group By **Session ID**. + +**Workaround:** After successful downgrade, reconfigure the Group By setting in the custom report. + +## PAN-154034 + +On the Panorama management server, the Type column in the System logs (**Monitor** > **Logs** > **System**) for managed firewalls running a PAN-OS 9.1 release erroneously display `iot` as the type. + +## PAN-154032 + +On the Panorama management server, downgrading to PAN-OS 9.1 with the Panorama plugin for Cisco TrustSec version 1.0.2 installed does not automatically transform the plugin to be compatible with PAN-OS 9.1 + +**Workaround:** After successful downgrade to PAN-OS 9.1, **Remove Config** (**Panorama** > **Plugins**) of the Panorama plugin for Cisco TrustSec and then reconfigure the plugin. + +## PAN-153803 + +On the Panorama management server, scheduled email PDF reports (**Monitor** > **PDF Reports**) fail if a GIF image is used in the header or footer. + +## PAN-153557 + +On the Panorama management server CLI, the overall report status for a report query is marked as `Done` despite reports generated from logs in the Strata Logging Service from the PODamericas Collector Group jobs are still in a `Running` state. + +## PAN-153068 + +The Bonjour Reflector option is supported on up to 16 interfaces. If you enable it on more than 16 interfaces, the commit succeeds and the Bonjour Reflector option is enabled only for the first 16 interfaces and ignored for any additional interfaces. + +## PAN-151238 + +There is a known issue where M-100 appliances are able to download and install a PAN-OS 10.0 release image even though the M-100 appliance is no longer supported after PAN-OS 9.1. (Refer to the [hardware end-of-life dates](https://www.paloaltonetworks.com/services/support/end-of-life-announcements/hardware-end-of-life-dates.html).) + +## PAN-151085 + +On a PA-7000 Series firewall chassis having multiple slots, when HA clustering is enabled on an active/active HA pair, the session table count for one of the peers can show a higher count than the actual number of active sessions on that peer. This behavior can be seen when the session is being set up on a non-cache slot (for example, when a session distribution policy is set to round-robin or session-load); it is caused by the additional cache lookup that happens when HA cluster participation is enabled. + +## PAN-150801 + +Automatic quarantine of a device based on forwarding profile or log setting does not work on the PA-7000 Series firewalls. + +## PAN-150515 + +After you install the device certificate on a new Panorama management server, Panorama is not able to connect to the IoT Security edge service. + +**Workaround:** Restart Panorama to connect to the IoT Security edge service. + +## PAN-150345 + +During updates to the Device Dictionary, the IoT Security service does not push new Device-ID attributes (such as new device profiles) to the firewall until a manual commit occurs. + +**Workaround:** Perform a force commit to push the attributes in the content update to the firewall. + +## PAN-150361 + +In an Active-Passive high availability (HA) configuration, an error displays if you create a device object on the passive device. + +**Workaround:** Load the running configuration and perform a force commit to sync the devices. + +## PAN-148971 + +If you enter a search term for Events that are related to IoT in the System logs and apply the filter, the page displays an `Invalid term` error. + +**Workaround:** Specify `iot` as the **Type Attribute** to filter the logs and use the search term as the **Description Attribute**. For example: `( subtype eq iot ) and ( description contains 'gRPC connection' )`. + +## PAN-148924 + +In an active-passive HA configuration, tags for dynamic user groups are not persistent after rebooting the firewall because the active firewall does not sync the tags to the passive firewall during failover. + +## PAN-146995 + +After downgrading a Panorama management server from PAN-OS 10.0 to PAN-OS 9.1, the `VLD` and `logd` processes may crash when Panorama reboots. + +**Workaround:** Panorama automatically restarts the `VLD` and `logd` processes. + +## PAN-146807 + +Changing the device group configured in a monitoring definition from a child DG to a parent DG, or vice versa, might cause firewalls configured in the child DG to lose IP tag mapping information received from the monitoring definition. Only firewalls assigned to the parent DG receive IP tag mapping updates. + +**Workaround**: Perform a manual config sync on the device group that lost the IP tag mapping information. + +## PAN-146485 + +On the Panorama management server, adding, deleting, or modifying the upstream NAT configuration (**Panorama** > **SD-WAN** > **Devices**) does not display the branch template stack as `out of sync`. + +Additionally, adding, deleting, or modifying the BGP configuration (**Panorama** > **SD-WAN** > **Devices**) does not display the hub and branch template stacks as `out of sync`. For example, modifying the BGP configuration on the branch firewall does not cause the hub template stack to display as `out of sync`, nor does modifying the BGP configuration on the hub firewall cause the branch template stack as `out of sync`. + +**Workaround:** After performing a configuration change, **Commit and Push** the configuration changes to all hub and branch firewalls in the VPN cluster containing the firewall with the modified configuration. + +## PAN-145460 + +CN-MGMT pods fail to connect to the Panorama management server when using the Kubernetes plugin. + +**Workaround:** **Commit** the Panorama configuration after the CN-MGMT pod successfully registers with Panorama. + +## PAN-144889 + +On the Panorama management server, adding, deleting, or modifying the original subnet IP, or adding a new subnet after you successfully configure a tunnel IP subnet, for the SD-WAN 1.0.2 plugin does not display the managed firewall templates (**Panorama** > **Managed Devices** > **Summary**) as `Out of Sync`. + +**Workaround**: When modifying the original subnet IP, or adding a new subnet, push the template configuration changes to your managed firewalls and **Force Template Values** (**Commit** > **Push to Devices** > **Edit Selections**). + +## PAN-143132 + +Fetching the device certificate from the Palo Alto Networks Customer Support Portal (CSP) may fail and displays the following error in the CLI: + +`ERROR Failed to process S1C msg: Error` + +**Workaround:** Retrying fetching the device certificate from the Palo Alto Networks CSP. + +## PAN-141630 + +Current performance limitation: single data plane use only. The PA-5200 Series and PA-7000 Series firewalls that support 5G network slice security, 5G equipment ID security, and 5G subscriber ID security use a single data plane only, which currently limits the firewall performance. + +## PAN-140959 + +The Panorama management server allows you to downgrade Zero Touch Provisioning (ZTP) firewalls to PAN-OS 9.1.2 and earlier releases where ZTP functionality is not supported. + +## PAN-140008 + +ElasticSearch is forced to restart when the `masterd` process misses too many heartbeat messages on the Panorama management server resulting in a delay in a log query and ingestion. + +## PAN-136763 + +On the Panorama management server, managed firewalls display as `disconnected` when installing a PAN-OS software update (**Panorama** > **Device Deployment** > **Software**) but display as `connected` when you view your managed firewalls Summary (**Panorama** > **Managed Devices** > **Summary**) and from the CLI. + +**Workaround:** Log out and log back in to the Panorama web interface. + +## PAN-135742 + +There is an issue in HTTP2 session decryption where the App-ID in the decryption log is the App-ID of the parent session (which is web-browsing). + +## PAN-134053 + +ACC does not filter WildFire logs from Dynamic User Groups. + +## PAN-132598 + +The Panorama management server does not check for duplicate addresses in address groups (**Objects** > **Address Groups**) and duplicate services in service groups (**Objects** > **Service Groups**) when created from the CLI. + +## PAN-130550 + +```caveat +PA-3200 Series, PA-5220, PA-5250, PA-5260, and PA-7000 Series firewalls +``` + +For traffic between virtual systems (inter-vsys traffic), the firewall cannot perform source NAT using dynamic IP (DIP) address translation. + +**Workaround:** Use source NAT with Dynamic IP and Port (DIPP) translation on inter-vsys traffic. + +## PAN-127813 + +In the current release, SD-WAN auto-provisioning configures hubs and branches in a hub and spoke model, where branches don’t communicate with each other. Expected branch routes are for generic prefixes, which can be configured in the hub and advertised to all branches. Branches with unique prefixes are not published up to the hub. + +**Workaround:** Add any specific prefixes for branches to the hub advertise-list configuration. + +## PAN-127206 + +If you use the CLI to enable the cleartext option for the Include Username in HTTP Header Insertion Entries feature, the authentication request to the firewall may become unresponsive or time out. + +## PAN-123277 + +Dynamic tags from other sources are accessible using the CLI but do not display on the Panorama web interface. + +## PAN-123040 + +When you try to view network QoS statistics on an SD-WAN branch or hub, the QoS statistics and the hit count for the QoS rules don’t display. A workaround exists for this issue. Please contact Support for information about the workaround. + +## PAN-120440 + +There is an issue on M-500 Panorama management servers where any ethernet interface with an IPv6 address having Private PAN-DB-URL connectivity only supports the following format: `2001:DB9:85A3:0:0:8A2E:370:2`. + +## PAN-120423 + +PAN-OS 10.0.0 does not support the XML API for GlobalProtect logs. + +## PAN-120303 + +There is an issue where the firewall remains connected to the PAN-DB-URL server through the old management IP address on the M-500 Panorama management server, even when you configured the Eth1/1 interface. + +**Workaround:** Update the PAN-DB-URL IP address on the firewall using one of the methods below. + +- Modify the PAN-DB Server IP address on the managed firewall. + 1. On the web interface, delete the **PAN-DB Server** IP address (**Device** > **Setup** > **Content ID** > **URL Filtering** settings). + 2. **Commit** your changes. + 3. Add the new M-500 Eth1/1 IP PAN-DB IP address. + 4. **Commit** your changes. +- Restart the firewall (devsrvr) process. + 1. Log in to the firewall CLI. + 2. Restart the devsrvr process: `debug software restart process device-server` + +## PAN-116017 + +```caveat +Google Cloud Platform (GCP) only +``` + +The firewall does not accept the DNS value from the initial configuration (init-cfg) file when you bootstrap the firewall. + +**Workaround:** Add DNS value as part of the bootstrap.xml in the bootstrap folder and complete the bootstrap process. + +## PAN-115816 + +```caveat +Microsoft Azure only +``` + +There is an intermittent issue where an Ethernet (eth1) interface does not come up when you first boot up the firewall. + +**Workaround:** Reboot the firewall. + +## PAN-114495 + +Alibaba Cloud runs on a KVM hypervisor and supports two Virtio modes: DPDK (default) and MMAP. If you deploy a VM-Series firewall running PAN-OS 9.0 in DPDK packet mode and you then switch to MMAP packet mode, the VM-Series firewall duplicates packets that originate from or terminate on the firewall. As an example, if a load balancer or a server behind the firewall pings the VM-Series firewall after you switch from DPDK packet mode to MMAP packet mode, the firewall duplicates the ping packets. + +Throughput traffic is not duplicated if you deploy the VM-Series firewall using MMAP packet mode. + +## PAN-112694 + +```caveat +Firewalls with multiple virtual systems only +``` + +If you configure dynamic DNS (DDNS) on a new interface (associated with vsys1 or another virtual system) and you then create a **New** Certificate Profile from the drop-down, you must set the location for the Certificate Profile to Shared. If you configure DDNS on an existing interface and then create a new Certificate Profile, we also recommend that you choose the Shared location instead of a specific virtual system. Alternatively, you can select a preexisting certificate profile instead of creating a new one. + +## PAN-112456 + +You can temporarily submit a change request for a URL Category with three suggested categories; however, only two categories are supported. Do not add more than two suggested categories to a change request until we address this issue. If you submit more than two suggested categories, only the first two categories in the change request are evaluated. + +## PAN-112135 + +You cannot unregister tags for a subnet or range in a dynamic address group from the web interface. + +**Workaround:** Use an XML API request to unregister the tags for the subnet or range. + +## PAN-111928 + +Invalid configuration errors are not displayed as expected when you revert a Panorama management server configuration. + +**Workaround:** After you revert the Panorama configuration, **Commit** (**Commit** > **Commit to Panorama**) the reverted configuration to display the invalid configuration errors. + +## PAN-111866 + +The push scope selection on the Panorama web interface displays incorrectly even though the commit scope displays as expected. This issue occurs when one administrator makes configuration changes to separate device groups or templates that affect multiple firewalls and a different administrator attempts to push those changes. + +**Workaround:** Perform one of the following tasks. + +- Initiate a **Commit to Panorama** operation followed by a **Push to Devices** operation for the modified device group and template configurations. +- Manually select the devices that belong to the modified device group and template configurations. + +## PAN-111729 + +If you disable DPDK mode and enable it again, you must immediately reboot the firewall. + +## PAN-111670 + +Tagged VLAN traffic fails when sent through an SR-IOV adapter. + +## PAN-110794 + +DGA-based threats shown in the firewall threat log display the same name for all such instances. + +## PAN-109526 + +The system log does not correctly display the URL for CRL files; instead, the URLs are displayed with encoded characters. + +## PAN-104780 + +If you configure a HIP object to match only when a connecting endpoint is managed (**Objects** > **GlobalProtect** > **HIP Objects** > **** > **General** > **Managed**), iOS and Android endpoints that are managed by AirWatch are unable to successfully match the HIP object and the HIP report incorrectly indicates that these endpoints are not managed. This issue occurs because GlobalProtect gateways cannot correctly identify the managed status of these endpoints. + +Additionally, iOS endpoints that are managed by AirWatch are unable to match HIP objects based on the endpoint serial number because GlobalProtect gateways cannot identify the serial numbers of these endpoints; these serial numbers do not appear in the HIP report. + +## PAN-103276 + +Adding a disk to a virtual appliance running Panorama 8.1 or a later release on VMware ESXi 6.5 update1 causes the Panorama virtual appliance and host web client to become unresponsive. + +**Workaround:** Upgrade the ESXi host to ESXi 6.5 update2 and add the disk again. + +## PAN-101688 + +```caveat +Panorama plugins +``` + +The IP address-to-tag mapping information registered on a firewall or virtual system is not deleted when you remove the firewall or virtual system from a Device Group. + +**Workaround:** Log in to the CLI on the firewall and enter the following command to unregister the IP address-to-tag mappings: `debug object registered-ip clear all`. + +## PAN-101537 + +After you configure and push address and address group objects in Shared and vsys-specific device groups from the Panorama management server to managed firewalls, executing the `show log direction equal | in ` command on a managed firewall only returns address and address group objects pushed form the Shared device group. + +**Workaround:** Specify the vsys in the query string: + +`admin>` `set system target-vsys ` + +`admin>` `show log direction equal query equal ‘vsys eq ’ | in ` + +## PAN-98520 + +When booting or rebooting a PA-7000 Series Firewall with the SMC-B installed, the BIOS console output displays attempts to connect to the card's controller in the System Memory Speed section. The messages can be ignored. + +## PAN-97757 + +GlobalProtect authentication fails with an `Invalid username/password` error (because the user is not found in **Allow List**) after you enable GlobalProtect authentication cookies and add a RADIUS group to the **Allow List** of the authentication profile used to authenticate to GlobalProtect. + +**Workaround:** Disable GlobalProtect authentication cookies. Alternatively, disable (clear) **Retrieve user group from RADIUS** in the authentication profile and configure group mapping from Active Directory (AD) through LDAP. + +## PAN-97524 + +```caveat +Panorama management server only +``` + +The Security Zone and Virtual System columns (**Network** tab) display `None` after a Device Group and Template administrator with read-only privileges performs a context switch. + +## PAN-96446 + +A firewall that is not included in a Collector Group fails to generate a system log if logs are dropped when forwarded to a Panorama management server that is running in Management Only mode. + +## PAN-95773 + +On VM-Series firewalls that have Data Plane Development Kit (DPDK) enabled and that use the i40e network interface card (NIC), the `show session info` CLI command displays an inaccurate throughput and packet rate. + +**Workaround:** Disable DPDK by running the `set system setting dpdk-pkt-io off` CLI command. + +## PAN-95028 + +For administrator accounts that you created in PAN-OS 8.0.8 and earlier releases, the firewall does not apply password profile settings (**Device** > **Password Profiles**) until after you upgrade to PAN-OS 8.0.9 or a later release and then only after you modify the account passwords. (Administrator accounts that you create in PAN-OS 8.0.9 or a later release do not require you to change the passwords to apply password profile settings.) + +## PAN-94846 + +When DPDK is enabled on the VM-Series firewall with i40e virtual function (VF) driver, the VF does not detect the link status of the physical link. The VF link status remains up, regardless of changes to the physical link state. + +## PAN-94093 + +HTTP Header Insertion does not work when jumbo frames are received out of order. + +## PAN-93968 + +The firewall and Panorama web interfaces display vulnerability threat IDs that are not available in PAN-OS 9.0 releases (**Objects** > **Security Profiles** > **Vulnerability Protection** > **** > **Exceptions**). To confirm whether a particular threat ID is available in your release, monitor the release notes for each new Applications and Threats content update or check the Palo Alto Networks [Threat Vault](https://threatvault.paloaltonetworks.com) to see the minimum PAN-OS release version for a threat signature. + +## PAN-93607 + +When you configure a VM-500 firewall with an SCTP Protection profile (**Objects** > **Security Profiles** > **SCTP Protection**) and you try to add the profile to an existing Security Profile Group (**Objects** > **Security Profile Groups**), the Security Profile Group doesn’t list the SCTP Protection profile in its drop-down list of available profiles. + +**Workaround:** Create a new Security Profile Group and select the SCTP Protection profile from there. + +## PAN-93532 + +When you configure a firewall running PAN-OS 9.0 as an nCipher HSM client, the web interface on the firewall displays the nCipher server status as Not Authenticated, even though the HSM state is up (**Device** > **Setup** > **HSM**). + +## PAN-93193 + +The memory-optimized VM-50 Lite intermittently performs slowly and stops processing traffic when memory utilization is critically high. To prevent this issue, make sure that you do not: + +- Switch to the firewall **Context** on the Panorama management server. +- Commit changes when a dynamic update is being installed. +- Generate a custom report when a dynamic update is being installed. +- Generate custom reports during a commit. + +**Workaround:** When the firewall performs slowly, or you see a critical System log for memory utilization, wait for 5 minutes and then manually reboot the firewall. + +Use the Task Manager to verify that you are not performing memory intensive tasks such as installing dynamic updates, committing changes or generating reports, at the same time, on the firewall. + +## PAN-91802 + +On a VM-Series firewall, the **clear session all** CLI command does not clear GTP sessions. + +## PAN-83610 + +In rare cases, a PA-5200 Series firewall (with an FE100 network processor) that has session offload enabled (default) incorrectly resets the UDP checksum of outgoing UDP packets. + +**Workaround:** In PAN-OS 8.0.6 and later releases, you can persistently disable session offload for only UDP traffic using the `set session udp-off load no` CLI command. + +## PAN-83236 + +The VM-Series firewall on Google Cloud Platform does not publish firewall metrics to Google Stack Monitoring when you manually configure a DNS server IP address (**Device** > **Setup** > **Services**). + +**Workaround:** The VM-Series firewall on Google Cloud Platform must use the DNS server that Google provides. + +## PAN-83215 + +SSL decryption based on ECDSA certificates does not work when you import the ECDSA private keys onto an nCipher nShield hardware security module (HSM). + +## PAN-81521 + +Endpoints failed to authenticate to GlobalProtect through Kerberos when you specify an FQDN instead of an IP address in the Kerberos server profile (**Device** > **Server Profiles** > **Kerberos**). + +**Workaround:** Replace the FQDN with the IP address in the Kerberos server profile. + +## PAN-77125 + +PA-7000 Series, PA-5450, PA-5200 Series, and PA-3200 Series firewalls configured in tap mode don’t close offloaded sessions after processing the associated traffic; the sessions remain open until they time out. + +**Workaround:** Configure the firewalls in virtual wire mode instead of tap mode, or disable session offloading by running the `set session off load no` CLI command. + +## PAN-75457 + +In WildFire appliance clusters that have three or more nodes, the Panorama management server does not support changing node roles. In a three-node cluster for example, you cannot use Panorama to configure the worker node as a controller node by adding the HA and cluster controller configurations, configure an existing controller node as a worker node by removing the HA configuration, and then commit and push the configuration. Attempts to change cluster node roles from Panorama results in a validation error—the commit fails and the cluster becomes unresponsive. + +## PAN-73530 + +The firewall does not generate a packet capture (pcap) when a Data Filtering profile blocks files. + +## PAN-73401 + +When you import a two-node WildFire appliance cluster into the Panorama management server, the controller nodes report their state as out-of-sync if either of the following conditions exist: + +- You did not configure a worker list to add at least one worker node to the cluster. (In a two-node cluster, both nodes are controller nodes configured as an HA pair. Adding a worker node would make the cluster a three-node cluster.) +- You did not configure a service advertisement (either by enabling or not enabling advertising DNS service on the controller nodes). + +**Workaround:** There are three possible workarounds to sync the controller nodes: + +- After you import the two-node cluster into Panorama, push the configuration from Panorama to the cluster. After the push succeeds, Panorama reports that the controller nodes are in sync. +- Configure a worker list on the cluster controller: + admin@wf500(active-controller)# `set deviceconfig cluster mode controller worker-list ` + (`` is the IP address of the worker node you are adding to the cluster.) This creates a three-node cluster. After you import the cluster into Panorama, Panorama reports that the controller nodes are in sync. When you want the cluster to have only two nodes, use a different workaround. +- Configure service advertisement on the local CLI of the cluster controller and then import the configuration into Panorama. The service advertisement can advertise that DNS is or is not enabled. + admin@wf500(active-controller)# `set deviceconfig cluster mode controller service-advertisement dns-service enabled yes` + or + admin@wf500(active-controller)# `set deviceconfig cluster mode controller service-advertisement dns-service enabled no` + Both commands result in Panorama reporting that the controller nodes are in sync. + +## PAN-70906 + +If the PAN-OS web interface and the GlobalProtect portal are enabled on the same IP address, then when a user logs out of the GlobalProtect portal, the administrative user is also logged out from the PAN-OS web interface. + +**Workaround:** Use the IP address to access the PAN-OS web interface and an FQDN to access the GlobalProtect portal. + +## PAN-69505 + +When viewing an external dynamic list that requires client authentication and you **Test Source URL**, the firewall fails to indicate whether it can reach the external dynamic list server and returns a URL access error (**Objects** > **External Dynamic Lists**). + +## PAN-40079 + +The VM-Series firewall on KVM, for all supported Linux distributions, does not support the Broadcom network adapters for PCI pass-through functionality. + +## PAN-39636 + +Regardless of the **Time Frame** you specify for a scheduled custom report on a Panorama M-Series appliance, the earliest possible start date for the report data is effectively the date when you configured the report (**Monitor** > **Manage Custom Reports**). For example, if you configure the report on the 15th of the month and set the **Time Frame** to **Last 30 Days**, the report that Panorama generates on the 16th will include only data from the 15th onward. This issue applies only to scheduled reports; on-demand reports include all data within the specified **Time Frame**. + +**Workaround:** To generate an on-demand report, click **Run Now** when you configure the custom report. + +## PAN-38255 + +When you perform a factory reset on a Panorama virtual appliance and configure the serial number, logging does not work until you reboot Panorama or execute the `debug software restart process management-server` CLI command. + +## PAN-31832 + +The following issues apply when configuring a firewall to use a hardware security module (HSM): + +- **nCipher nShield Connect**—The firewall requires at least four minutes to detect that an HSM was disconnected, causing SSL functionality to be unavailable during the delay. +- **SafeNet Network**—When losing connectivity to either or both HSMs in an HA configuration, the display of information from the `show high-availability state` and `show hsm info` commands are blocked for 20 seconds. diff --git a/web/data/issues/PAN-OS/known/10.1.6_2026-03-16.md b/web/data/issues/PAN-OS/known/10.1.6_2026-03-16.md new file mode 100644 index 0000000..597f4cd --- /dev/null +++ b/web/data/issues/PAN-OS/known/10.1.6_2026-03-16.md @@ -0,0 +1,974 @@ +--- +type: Known +product: PAN-OS +version: 10.1.6 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## APL-15000 + +When you move a firewall from one Strata Logging Service instance to another, it can take up to an hour for the firewall to begin sending logs to the new instance. + +## APL-8269 + +For data retrieved from Strata Logging Service, the Threat Name column in **Panorama** > **ACC** > **threat-activity** appears blank. + +## PLUG-380 + +When you rename a device group, template, or template stack in Panorama that is part of a VMware NSX service definition, the new name is not reflected in NSX Manager. Therefore, any ESXi hosts that you add to a vSphere cluster are not added to the correct device group, template, or template stack and your Security policy is not pushed to VM-Series firewalls that you deploy after you rename those objects. There is no impact to existing VM-Series firewalls. + +## WF500-5559 + +An intermittent error while analyzing signed PE samples on the WildFire appliance might cause analysis failures. + +## WF500-5471 + +After using the firewall CLI to add a WildFire appliance with an IPv6 address, the initial connection may fail. + +**Workaround:** Retry connecting after you restart the web server with the following command: `debug software restart process web-server`. + +## PAN-281370 + +The Advanced WildFire Inline ML models **OOXML** and **Mach-O** erroneously display as being available from the CLI; however, they are only available on PAN-OS 11.1.3 and later releases. + +## PAN-260851 + +From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (**Objects** > **Applications**) tag. + +## PAN-228273 + +On the Panorama management server in FIPS-CC mode, the ElasticSearch cluster fails to come up and the `show log-collector-es-cluster health` command displays the `status` is `red`. This results in log ingestion issues for Panorama in Panorama only or Log Collector mode. + +## PAN-227344 + +On the Panorama management server, PDF Summary Reports (**Monitor** > **PDF Reports** > **Manage PDF Summary**) display no data and are blank when predefined reports are included in the summary report. + +## PAN-223488 + +```caveat +This issue is now resolved. See PAN-OS 10.1.12 Addressed Issues. +``` + +On the M-600 appliance, closed ElasticSearch shards are not deleted from the M-600 appliance. This causes the ElasticSearch shard purging to not work as expected, resulting in high disk usage. + +## PAN-223365 + +The Panorama management server is unable to query any logs if the ElasticSearch health status for any Log Collector (**Panorama** > **Managed Collector** is degraded. + +**Workaround:** [Log in to the Log Collector CLI](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli) and restart ElasticSearch. + +`admin``debug elasticsearch es-restart all` + +## PAN-218521 + +The ElasticSearch process on the M-600 appliance in Log Collector mode may enter a continuous reboot cycle. This results in the M-600 appliance becoming unresponsive, consuming logging disk space, and preventing new log ingestion. + +## PAN-217307 + +```caveat +This issue is now resolved. See PAN-OS 10.1.14 Addressed Issues. +``` + +The following Security policy rule (**Policies** > **Security**) filters return no results: + +`log-start eq no` + +`log-end eq no` + +`log-end eq yes` + +## PAN-216214 + +For Panorama-managed firewalls in an Active/Active High Availability (HA) configuration where you configure the firewall HA settings (**Device** > **High Availability**) in a template or template stack (**Panorama** > **Templates**), performing a local commit on one of the HA firewalls triggers an HA config sync on the peer firewall. This causes the HA peer configuration to go `Out of Sync`. + +## PAN-213746 + +On the Panorama management server, the **Hostkey** displayed as `undefined undefined` if you override an SSH Service Profile (**Device** > **Certificate Management** > **SSH Service Profile**) Hostkey configured in a Template from the Template Stack. + +## PAN-212889 + +```caveat +This issue is now resolved. See PAN-OS 10.1.11 Addressed Issues. +``` + +On the Panorama management server, different threat names are used when querying the same threat in the Threat Monitor (**Monitor** > **App Scope** > **Threat Monitor**) and **ACC**. This results in the ACC displaying `no data to display` when you are redirected to the ACC after clicking a threat name in the Threat Monitor and filtering the same threat name in the Global Filters. + +## PAN-208325 + +```caveat +This issue is now resolved. See PAN-OS 10.1.10 Addressed Issues. +``` + +The following NextGen firewalls are unable to automatically renew the device certificate (**Device** > **Setup** > **Management** or **Panorama** > **Setup** > **Management**). + +- PA-410 Firewall +- PA-440, PA-450, and PA-460 Firewalls +- PA-5450 Firewall + +**Workaround:** Log in to the [firewall CLI](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-cli-quick-start/get-started-with-the-cli/access-the-cli) and fetch the device certificate. + +`admin>``request certificate fetch` + +## PAN-206268 + +```caveat +This issue is now resolved. See PAN-OS 10.1.10 Addressed Issues. +``` + +On the Panorama management server, the Auth Key field was erroneously displayed when you configure the Panorama Settings (**Device** > **Setup** > **Management**) as part of a template or template stack configuration. + +## PAN-206243 + +The PA-220 firewall reaches the maximum disk usage capacity multiple a day that requires a disk cleanup. A critical system log (**Monitor** > **Logs** > **System**) is generated each time the firewall reaches maximum disk usage capacity. + +## PAN-205187 + +ElasticSearch may not start properly when a newly installed Panorama virtual appliance powers on for the first time, resulting in the Panorama virtual appliance being unable to query logs forwarded from the managed firewall to a Log Collector. + +**Workaround:** [Log in to the Panorama CLI](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli) and start the PAN-OS software. + +`admin>``request restart software` + +## PAN-201855 + +On the Panorama management server, cloning any template (**Panorama** > **Templates**) corrupts certificates (**Device** > **Certificate Management** > **Certificates**) with the **Block Private Key Export** setting enabled across all templates. This results in managed firewalls experiencing issues wherever the corrupted certificate is referenced. + +For example, you have template A, B, and C where templates A and B have certificates with the **Block Private Key Export** setting enabled. Cloning template C corrupts the certificates with **Block Private Key Export** setting enabled in templates A and B. + +**Workaround:** After cloning a template, delete and re-import the corrupted certificates. + +## PAN-201627 + +```caveat +PAN-OS 10.1.6-h4 and later PAN-OS 10.1.6 hotfixes +``` + +For next-generation firewall deployments where SD-WAN is configured, the dataplane could restart if all SD-WAN member links are down due to an out-of-memory condition. This could also happen during a device reboot when all SD-WAN tunnels are down. + +**Workaround:** Downgrade to PAN-OS 10.1.6-h3 or earlier, or upgrade to the latest PAN-OS 10.2 release. + +## PAN-199557 + +On M-600 appliances in an Active/Passive high availability (HA) configuration, the `configd` process restarts due to a memory leak on the `Active` Panorama HA peer. This causes the Panorama web interface and CLI to become unresponsive. + +**Workaround:** Manually reboot the `Active` Panorama HA peer. + +## PAN-198187 + +```caveat +This issue is now resolved. See PAN-OS 10.1.9 Addressed Issues. +``` + +For firewalls managed by a Panorama management server, System logs (**Monitor** > **System**) may not display the `Commit Description` if you push (**Commit** > **Push to Devices**) to multiple device groups from Panorama. + +## PAN-198174 + +When viewing traffic or threat logs from the firewall ACC or Monitor, performing a reverse DNS lookup, for example, when resolving IP addresses to domain names using the **Resolve Hostname** feature, can cause the appliance to crash and restart if DNS server settings have not been configured. + +**Workaround:** Provide a DNS server setting for the firewall (**Device** > **DNS Setup** > **Services**). If you cannot reference a valid DNS server, you can add a dummy address. + +## PAN-197341 + +On the Panorama management server, if you create multiple device group **Objects** with the same name in the Shared device group and any additional device groups (**Panorama** > **Device Groups**) under the same device group hierarchy that are used in one or more **Policies**, renaming the object with a shared name in any device group causes the object name to change in the policies where it is used. This issue applies only to device group objects that can be referenced in a Security policy rule. + +For example: + +1. You create a parent device group `DG-A` and a child device group `DG-B`. +2. You create address objects called `AddressObjA` in the `Shared`, `DG-A` and `DG-B` device groups and add `AddressObjA` to a Security policy rule under `DG-A` and `DG-B`. +3. Later, you change the `AddressObjA` name in the `Shared` device group to `AddressObjB`. + +Changing the name of the address object in the `Shared` device group causes the references in the Policy rule to use the renamed `Shared` object instead of the device group object. + +## PAN-197097 + +```caveat +This issue is now resolved. See PAN-OS 10.1.9 Addressed Issues. +``` + +Large Scale VPN (LSVPN) does not support IPv6 addresses on the satellite firewall. + +## PAN-196758 + +On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you **Preview Changes** (**Commit** > **Push to Devices** > **Edit Selections** or **Commit** > **Commit and Push** > **Edit Selections**). + +## PAN-194519 + +```caveat +PA-5450 firewall only +``` + +Trying to configure a custom payload format under **Device** > **Server Profiles** > **HTTP** yields a Javascript error. + +## PAN-194515 + +```caveat +PA-5450 firewall only +``` + +The Panorama web interface does not display any predefined template stack variables in the dropdown menu under **Device** > **Setup** > **Log Interface** > **IP Address**. + +**Workaround:** Configure the log interface IP address on the individual firewall web interface instead of on Panorama. + +## PAN-194424 + +```caveat +PA-5450 firewall only +``` + +Upgrading to PAN-OS 10.1.6-h2 while having a log interface configured can cause both the log interface and the management interface to remain connected to the log collector. + +**Workaround:** Restart the log receiver service by running the following CLI command: + +`debug software restart process log-receiver` + +## PAN-194202 + +```caveat +PA-5450 firewall only +``` + +If the management interface and logging interface are configured on the same subnetwork, the firewall conducts log forwarding using the management interface instead of the logging interface. + +## PAN-193518 + +All logs (**Monitor** > **Logs**) generated by a firewall running a PAN-OS 10.0 release are not accessible if you downgrade from PAN-OS 10.1 to PAN-OS 10.0, and then upgrade back to PAN-OS 10.1. + +**Workaround:** If you need to downgrade from PAN-OS 10.1 to PAN-OS 10.0 and then back to PAN-OS 10.1, downgrade to PAN-OS 10.0.11 to ensure that all logs ingested while running a PAN-OS 10.0 release remain accessible after upgrade back to PAN-OS 10.1. + +## PAN-192403 + +```caveat +PA-5450 firewall only +``` + +There is no commit warning in the web interface when configuring the management interface and logging interface in the same subnetwork. Having both interfaces in the same subnetwork can cause routing and connectivity issues. + +## PAN-190727 + +```caveat +PA-5450 firewall only +``` + +Documentation for configuring the log interface is unavailable on the web interface and in the PAN-OS Administrator’s Guide. + +## PAN-189057 + +```caveat +HA configuration +``` + +On the Panorama management server, Panorama enters a `non-functional` state due to `php.debug.log` life taking up too much space. + +**Workaround:** Disable the debug flag for Panorama. + +1. [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface). +2. In the same browser you are logged into the Panorama web interface, enter the following URL. + `https:///debug` +3. Uncheck (disable) **Debug** or **Clear Debug**. +4. () Repeat this step on each Panorama high availability (HA) peer if Panorama is in a HA configuration. + +## PAN-188052 + +Devices in FIPS-CC mode are unable to connect to servers utilizing ECDSA-based host keys that impacts exporting logs (**Device** > **Scheduled Log Export**), exporting configurations (**Device** > **Scheduled Config Export**), or the `scp export` command in the CLI. + +**Workaround:** Use RSA-based host keys on the destination server. + +## PAN-187685 + +On the Panorama management server, the Template Status displays no synchronization status (**Panorama** > **Managed Devices** > **Summary**) after a bootstrapped firewall is successfully added to Panorama. + +**Workaround:** After the bootstrapped firewall is successfully added to Panorama, [log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) and select **Commit** > **Push to Devices**. + +## PAN-185286 + +```caveat +PA-5400 Series firewalls only +``` + +On the Panorama management server, the device health resources (**Panorama** > **Managed Devices** > **Health**) do not populate. + +## PAN-178194 + +```caveat +This issue is now resolved. See PAN-OS 10.1.7 Addressed Issues. +``` + +A UI issue in PAN-OS renders the contents of the **Inline ML** tab in the **URL Filtering Profile** inaccessible on firewalls licensed for Advanced URL Filtering. Additionally, a message indicating that a **License required for URL filtering to function** is unavailable displays at the bottom of the UI. These errors do not affect the operation of Advanced URL Filtering or URL Filtering Inline ML. + +**Workaround:** Configuration settings for URL Filtering Inline ML must be applied through the CLI. The following configuration commands are available: + +- Define URL exceptions for specific web sites— + `admin#``set profiles url-filtering mlav-category-exception` + +- Configuration settings for each inline ML model— + `admin#``set profiles url-filtering mlav-engine-urlbased-enabled` + +## PAN-174982 + +In HA active/active configurations where, when interfaces that were associated with a virtual router were deleted, the configuration change did not sync. + +## PAN-172274 + +When you activate the advanced URL filtering license, your license entitlements for PAN-DB and advanced URL filtering might not display correctly on the firewall — this is a display anomaly, not a licensing issue, and does not affect access to the services. + +**Workaround:** Issue the following command to retrieve and update the licenses: `license request fetch`. + +## PAN-172113 + +If you request a User Activity Report on Panorama and the vsys key value in the XML is an unsupported value, the resulting job becomes unresponsive at 10% and does not complete until you manually stop the job in the web interface. + +**Workaround:**Change the vsys key to a valid device group, commit your changes, and run the User Activity Report again. + +## PAN-172067 + +When you configure an HTTP server profile (**Device** > **Server Profiles** > **HTTP** or **Panorama** > **Server Profiles** > **HTTP**), the **Username** and **Password** fields are always required regardless of whether **Tag Registration** is enabled. + +**Workaround:** When you configure an HTTP server profile, always enter a username and password to successfully create the HTTP server profile. + +You must enter a username and password even if the HTTP server does not require it. The HTTP server ignores the username and password if they are not required for the firewall to connect. + +## PAN-172061 + +A process (`all_pktproc`) can cause intermittent crashes on the Passive PA-5450 firewall in an Active/Passive HA pair. This issue may be seen during an upgrade or reload of the firewall with traffic and when clearing sessions. + +## PAN-171938 + +No results are displayed when you **Show Application Filter** for a Security policy rule (**Policies** > **Security** > **Application** > **Value** > **Show Application Filter**). + +## PAN-171723 + +If you use Panorama to push a configuration that uses App-ID Cloud Engine (ACE) App-IDs and then you downgrade the firewall from PAN-OS 10.1 to PAN-OS 10.0, the installation succeeds but after you reboot, the auto-commit fails. + +**Workaround:** Remove all ACE application configurations before downgrading. + +## PAN-171714 + +```caveat +This issue is now resolved. See PAN-OS 10.1.7 Addressed Issues. +``` + +If you use the NetBIOS format (`domain\user`) for the IP address-to-username mapping and the firewall receives the group mapping information from the Cloud Identity Engine, the firewall does not successfully match the user to the correct group. + +## PAN-171706 + +```caveat +This issue is now resolved. See PAN-OS 10.1.11 Addressed Issues. +``` + +If you are using Panorama to manage firewalls with multiple virtual systems and the virtual system that is the User-ID hub uses an alias, the local commit on Panorama is successful but the commit to the firewall fails. + +## PAN-171673 + +On the Panorama management server, the **ACC** returns inaccurate results when you filter for **New App-ID** in the **Application** usage widget. + +## PAN-171635 + +If you have an on-premise Active Directory and there is an existing group mapping configuration on the firewall, if you migrate the group mapping to the Cloud Identity Engine, the firewall does not remove the existing group mapping even if the configuration is disabled and the firewall is rebooted, which may conflict with new mappings from the Cloud Identity Engine. + +**Workaround**: Use the debug user-id clear domain-map command to remove the existing group mappings from the firewall. + +## PAN-171224 + +On the Panorama management server, a custom report (**Monitor** > **Managed Custom Reports**) with a high volume of unique data objects is not generated when you click **Run Now**. + +## PAN-171145 + +If you edit or remove the value for the `mail` attribute in your on-premise Active Directory, the changes may not be immediately reflected on the firewall after it syncs with the Cloud Identity Engine. + +## PAN-170923 + +In **Policies** > **Security** > **Policy Optimizer** > **New App Viewer**, when you select a Security policy rule in the bottom portion of the screen, the application data in the application browser (top portion of screen) does not match the Apps Seen on the selected rule. In addition, filtering in the application browser based on Apps Seen does not work. + +## PAN-170270 + +Using the CLI to power on a PA-5450 Networking Card (NC) in an Active HA firewall can cause its Passive peer to temporarily go down. + +## PAN-169906 + +The CN-Series Firewall as a Kubernetes Service does not support AF_XDP when deployed in CentOS. + +## PAN-168636 + +Connecting to the App-ID Cloud Engine (ACE) cloud using a management port with explicit proxy configured on it is not supported. Instead, use a data plane interface for the service route ([Prepare to Deploy App-ID Cloud Engine](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/app-id/cloud-based-app-id-service/prepare-to-deploy-app-id-cloud-engine.html) describes how to do this.) + +## PAN-168113 + +On the Panorama management server, you are unable to configure a master key (**Device** > **Master Key and Diagnostics**) for a managed firewall if an interface (**Network** > **Interfaces** > **Ethernet**) references a zone pushed from Panorama. + +**Workaround:** Remove the referenced zone from the interface configuration to successfully configure a master key. + +## PAN-167847 + +If you issue the command `opof stats`, then clear the results {opof stats -c}, the Active Sessions value is sometimes invalid. For example, you might see a negative number or an excessively large number. + +**Workaround:** Re-run the `opof stats` command after the offload completes. + +## PAN-167401 + +When a firewall or Panorama appliance configured with a proxy is upgraded to PAN-OS 10.0.3 or a later release, it fails to connect to edge service. + +## PAN-166464 + +```caveat +This issue is now resolved. See PAN-OS 10.1.6-h6 Addressed Issues. +``` + +PAN-OS reports the PA-5450 fan numbers incorrectly by listing them in the opposite order. This does not affect fan operation. For further information, contact Customer Support. + +## PAN-165669 + +If you configure a group that the firewall retrieves from the Cloud Identity Engine as the `user in` value in a filter query, Panorama is unable to retrieve the group membership and as a result, is unable to display this data in logs and custom reports. + +## PAN-164922 + +On the Panorama management server, a context switch to a managed firewall running a PAN-OS 8.1.0 to 8.1.19 release fails. + +## PAN-164885 + +```caveat +This issue is now resolved. See PAN-OS 10.1.14-h6 Addressed Issues +``` + +On the Panorama management server, pushes to managed firewalls (**Commit** > **Push to Devices** or **Commit and Push**) may fail when an EDL (**Objects** > **External Dynamic Lists**) is configured to **Check for updates** every 5 minutes due to the commit and EDL fetch processes overlapping. This is more likely to occur when multiple EDLs are configured to check for updates every 5 minutes. + +## PAN-164841 + +A successful deployment of a Panorama virtual appliance on Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform (GCP) is inaccessible when deploying using the PAN-OS 10.1.0-b6 release. + +## PAN-164647 + +On the Panorama management server, activating a license (**Panorama** > **Device Deployment** > **Licenses**) on managed firewalls in a high availability (HA) configuration causes the Safari web browser to become unresponsive. + +**Workaround:** [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) from a web browser other than Safari to successfully activate a license on managed firewalls in an HA configuration. + +## PAN-164618 + +The VM-Series firewall CLI and system logs display the license name `VM-SERIES-X`, while the user interface displays `VM-FLEX-X` (in both cases `X` is the number of vCPUs). In future releases the user interface will use the `VM-SERIES-X` format. + +## PAN-164586 + +If you use a value other than `mail` for the user or group email attribute in the Cloud Identity Engine, it displays in `user@domain` format in the CLI output. + +## PAN-163966 + +On the Panorama management server, the **ACC** and on demand reports (**Monitor** > **Manage Custom Reports**) are unable to fetch Directory Sync group membership when the Source User Group filter query is applied, resulting in no data being displayed for the filter when Directory Sync is configured as the Source User for a policy rule. + +## PAN-162836 + +On the VM-Series firewall, if you select **Device** > **Licenses** > **Deactivate VM** a popup window opens and you can choose **Subscriptions** or **Support** and press **Continue** to remove licenses and register the changes with the license server. When the license removal is complete the **Deactivate VM** window does not update its text to exclude deactivated licenses or close the window. + +**Workaround**: Wait until the license deactivation is complete, and click **Cancel** to close the window. + +## PAN-162088 + +```caveat +This issue is now resolved. See PAN-OS 10.1.9 Addressed Issues. +``` + +On the Panorama management server in a high availability (HA) configuration, content updates (**Panorama** > **Dynamic Updates**) manually uploaded to the active HA peer are not synchronized to the passive HA peer when you **Install** a content update and enable **Sync to HA Peer**. + +## PAN-161666 + +The firewall includes any users configured in the Cloud Identity Engine in the count of groups. As a result, some CLI command output does not accurately display the number of groups the firewall has retrieved from the Cloud Identity Engine and counts users as groups in the `No. of Groups` in the command output. If the attempt to retrieve the user or group fails, the information for the user or group still displays in the CLI command output. + +## PAN-161451 + +If you issue the command `opof stats`, there are occasional zero packet and byte counts coming from the DPDK counters. This occurs when a session is in the tcp-reuse state, and has no impact on the existing session. + +## PAN-160238 + +If you migrate traffic from a firewall running a PAN-OS version earlier than 9.0 to a firewall running PAN-OS 9.0 or later, you experience intermittent VXLAN packet drops if TCI policy is not configured for inspecting VXLAN traffic flows. + +**Workaround:**On the new firewall, create an app override for VXLAN outer headers as described in [What is an Application Override?](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVLCA0) and the video tutorial [How to Configure an Application Override Policy on the Palo Alto Networks Firewall](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PPDrCAO). + +PAN-OS version 9.0 can inspect both inner and outer VXLAN flows. If you want to inspect inner flows, you must define a tunnel content inspection (TCI) policy. + +## PAN-157444 + +As a result of a telemetry handling update, the Source Zone field in the DNS analytics logs (viewable in the DNS Analytics tab within AutoFocus) might not display correct results. + +## PAN-157327 + +On downgrade to PAN-OS 9.1, Enterprise Data Loss Prevention (DLP) filtering settings (**Device** > **Setup** > **DLP**) are not removed and cause commit errors for the downgraded firewall if you do not uninstall the Enterprise DLP plugin before downgrade. + +**Workaround:** After you successfully downgrade a managed firewall to PAN-OS 9.1, commit and push from Panorama to remove the Enterprise DLP filtering settings and complete the downgrade. + +1. Downgrade your managed firewall to PAN-OS 9.1 +2. Log in to the firewall web interface and view the **Tasks** to verify all auto commits related to the downgrade have completed successfully. +3. Log in to the Panorama web interface and **Commit** > **Commit and Push** to your managed firewall downgraded to PAN-OS 9.1. + +## PAN-157103 + +Multi-channel functionality may not be properly utilized on an VM-Series firewall deployed in VMware NSX-V after the service is first deployed. + +**Workaround**: Execute the command `debug dataplane pow status` to view the number of channels being utilized by the dataplane. + +Per pan-task Netx statisticsCounter Name 1 2 3 4 5 6 Total---------------------------------------------ready_dvf 2 0 0 0 0 0 2 + +If multi-channel functionality is not working, disable your NSX-V security policy and reapply it. Then reboot the VM-Series firewall. When the firewall is back up, verify that multi-channel functionality is working by executing the command `debug dataplane pow status`. It should now show multiple channels being utilized. + +Per pan-task Netx statisticsCounter Name 1 2 3 4 5 6 Total---------------------------------------------ready_dvf 1 1 0 0 0 0 2 + +## PAN-156598 + +```caveat +Panorama only +``` + +If you configure a standard custom vulnerability signature in a custom Vulnerability Protection profile in a shared device group, the shared profile custom signatures do not populate in the other device groups when you configure a combination custom vulnerability signature. + +**Workaround:** Use the CLI to update the combination signature. + +## PAN-154292 + +On the Panorama management server, downgrading from a PAN-OS 10.0 release to a PAN-OS 9.1 release causes Panorama commit (**Commit** > **Commit to Panorama**) failures if a custom report (**Monitor** > **Manage Custom Reports**) is configured to Group By **Session ID**. + +**Workaround:** After successful downgrade, reconfigure the Group By setting in the custom report. + +## PAN-154034 + +On the Panorama management server, the Type column in the System logs (**Monitor** > **Logs** > **System**) for managed firewalls running a PAN-OS 9.1 release erroneously display `iot` as the type. + +## PAN-154032 + +On the Panorama management server, downgrading to PAN-OS 9.1 with the Panorama plugin for Cisco TrustSec version 1.0.2 installed does not automatically transform the plugin to be compatible with PAN-OS 9.1 + +**Workaround:** After successful downgrade to PAN-OS 9.1, **Remove Config** (**Panorama** > **Plugins**) of the Panorama plugin for Cisco TrustSec and then reconfigure the plugin. + +## PAN-153803 + +On the Panorama management server, scheduled email PDF reports (**Monitor** > **PDF Reports**) fail if a GIF image is used in the header or footer. + +## PAN-153557 + +On the Panorama management server CLI, the overall report status for a report query is marked as `Done` despite reports generated from logs in the Strata Logging Service from the PODamericas Collector Group jobs are still in a `Running` state. + +## PAN-153068 + +The Bonjour Reflector option is supported on up to 16 interfaces. If you enable it on more than 16 interfaces, the commit succeeds and the Bonjour Reflector option is enabled only for the first 16 interfaces and ignored for any additional interfaces. + +## PAN-151238 + +There is a known issue where M-100 appliances are able to download and install a PAN-OS 10.0 release image even though the M-100 appliance is no longer supported after PAN-OS 9.1. (Refer to the [hardware end-of-life dates](https://www.paloaltonetworks.com/services/support/end-of-life-announcements/hardware-end-of-life-dates.html).) + +## PAN-151085 + +On a PA-7000 Series firewall chassis having multiple slots, when HA clustering is enabled on an active/active HA pair, the session table count for one of the peers can show a higher count than the actual number of active sessions on that peer. This behavior can be seen when the session is being set up on a non-cache slot (for example, when a session distribution policy is set to round-robin or session-load); it is caused by the additional cache lookup that happens when HA cluster participation is enabled. + +## PAN-150801 + +Automatic quarantine of a device based on forwarding profile or log setting does not work on the PA-7000 Series firewalls. + +## PAN-150515 + +After you install the device certificate on a new Panorama management server, Panorama is not able to connect to the IoT Security edge service. + +**Workaround:** Restart Panorama to connect to the IoT Security edge service. + +## PAN-150345 + +During updates to the Device Dictionary, the IoT Security service does not push new Device-ID attributes (such as new device profiles) to the firewall until a manual commit occurs. + +**Workaround:** Perform a force commit to push the attributes in the content update to the firewall. + +## PAN-150361 + +In an Active-Passive high availability (HA) configuration, an error displays if you create a device object on the passive device. + +**Workaround:** Load the running configuration and perform a force commit to sync the devices. + +## PAN-148971 + +If you enter a search term for Events that are related to IoT in the System logs and apply the filter, the page displays an `Invalid term` error. + +**Workaround:** Specify `iot` as the **Type Attribute** to filter the logs and use the search term as the **Description Attribute**. For example: `( subtype eq iot ) and ( description contains 'gRPC connection' )`. + +## PAN-148924 + +In an active-passive HA configuration, tags for dynamic user groups are not persistent after rebooting the firewall because the active firewall does not sync the tags to the passive firewall during failover. + +## PAN-146995 + +After downgrading a Panorama management server from PAN-OS 10.0 to PAN-OS 9.1, the `VLD` and `logd` processes may crash when Panorama reboots. + +**Workaround:** Panorama automatically restarts the `VLD` and `logd` processes. + +## PAN-146807 + +Changing the device group configured in a monitoring definition from a child DG to a parent DG, or vice versa, might cause firewalls configured in the child DG to lose IP tag mapping information received from the monitoring definition. Only firewalls assigned to the parent DG receive IP tag mapping updates. + +**Workaround**: Perform a manual config sync on the device group that lost the IP tag mapping information. + +## PAN-146485 + +On the Panorama management server, adding, deleting, or modifying the upstream NAT configuration (**Panorama** > **SD-WAN** > **Devices**) does not display the branch template stack as `out of sync`. + +Additionally, adding, deleting, or modifying the BGP configuration (**Panorama** > **SD-WAN** > **Devices**) does not display the hub and branch template stacks as `out of sync`. For example, modifying the BGP configuration on the branch firewall does not cause the hub template stack to display as `out of sync`, nor does modifying the BGP configuration on the hub firewall cause the branch template stack as `out of sync`. + +**Workaround:** After performing a configuration change, **Commit and Push** the configuration changes to all hub and branch firewalls in the VPN cluster containing the firewall with the modified configuration. + +## PAN-145460 + +CN-MGMT pods fail to connect to the Panorama management server when using the Kubernetes plugin. + +**Workaround:** **Commit** the Panorama configuration after the CN-MGMT pod successfully registers with Panorama. + +## PAN-144889 + +On the Panorama management server, adding, deleting, or modifying the original subnet IP, or adding a new subnet after you successfully configure a tunnel IP subnet, for the SD-WAN 1.0.2 plugin does not display the managed firewall templates (**Panorama** > **Managed Devices** > **Summary**) as `Out of Sync`. + +**Workaround**: When modifying the original subnet IP, or adding a new subnet, push the template configuration changes to your managed firewalls and **Force Template Values** (**Commit** > **Push to Devices** > **Edit Selections**). + +## PAN-143132 + +Fetching the device certificate from the Palo Alto Networks Customer Support Portal (CSP) may fail and displays the following error in the CLI: + +`ERROR Failed to process S1C msg: Error` + +**Workaround:** Retrying fetching the device certificate from the Palo Alto Networks CSP. + +## PAN-141630 + +Current performance limitation: single data plane use only. The PA-5200 Series and PA-7000 Series firewalls that support 5G network slice security, 5G equipment ID security, and 5G subscriber ID security use a single data plane only, which currently limits the firewall performance. + +## PAN-140959 + +The Panorama management server allows you to downgrade Zero Touch Provisioning (ZTP) firewalls to PAN-OS 9.1.2 and earlier releases where ZTP functionality is not supported. + +## PAN-140008 + +ElasticSearch is forced to restart when the `masterd` process misses too many heartbeat messages on the Panorama management server resulting in a delay in a log query and ingestion. + +## PAN-136763 + +On the Panorama management server, managed firewalls display as `disconnected` when installing a PAN-OS software update (**Panorama** > **Device Deployment** > **Software**) but display as `connected` when you view your managed firewalls Summary (**Panorama** > **Managed Devices** > **Summary**) and from the CLI. + +**Workaround:** Log out and log back in to the Panorama web interface. + +## PAN-135742 + +There is an issue in HTTP2 session decryption where the App-ID in the decryption log is the App-ID of the parent session (which is web-browsing). + +## PAN-134053 + +ACC does not filter WildFire logs from Dynamic User Groups. + +## PAN-132598 + +The Panorama management server does not check for duplicate addresses in address groups (**Objects** > **Address Groups**) and duplicate services in service groups (**Objects** > **Service Groups**) when created from the CLI. + +## PAN-130550 + +```caveat +PA-3200 Series, PA-5220, PA-5250, PA-5260, and PA-7000 Series firewalls +``` + +For traffic between virtual systems (inter-vsys traffic), the firewall cannot perform source NAT using dynamic IP (DIP) address translation. + +**Workaround:** Use source NAT with Dynamic IP and Port (DIPP) translation on inter-vsys traffic. + +## PAN-127813 + +In the current release, SD-WAN auto-provisioning configures hubs and branches in a hub and spoke model, where branches don’t communicate with each other. Expected branch routes are for generic prefixes, which can be configured in the hub and advertised to all branches. Branches with unique prefixes are not published up to the hub. + +**Workaround:** Add any specific prefixes for branches to the hub advertise-list configuration. + +## PAN-127206 + +If you use the CLI to enable the cleartext option for the Include Username in HTTP Header Insertion Entries feature, the authentication request to the firewall may become unresponsive or time out. + +## PAN-123277 + +Dynamic tags from other sources are accessible using the CLI but do not display on the Panorama web interface. + +## PAN-123040 + +When you try to view network QoS statistics on an SD-WAN branch or hub, the QoS statistics and the hit count for the QoS rules don’t display. A workaround exists for this issue. Please contact Support for information about the workaround. + +## PAN-120440 + +There is an issue on M-500 Panorama management servers where any ethernet interface with an IPv6 address having Private PAN-DB-URL connectivity only supports the following format: `2001:DB9:85A3:0:0:8A2E:370:2`. + +## PAN-120423 + +PAN-OS 10.0.0 does not support the XML API for GlobalProtect logs. + +## PAN-120303 + +There is an issue where the firewall remains connected to the PAN-DB-URL server through the old management IP address on the M-500 Panorama management server, even when you configured the Eth1/1 interface. + +**Workaround:** Update the PAN-DB-URL IP address on the firewall using one of the methods below. + +- Modify the PAN-DB Server IP address on the managed firewall. + 1. On the web interface, delete the **PAN-DB Server** IP address (**Device** > **Setup** > **Content ID** > **URL Filtering** settings). + 2. **Commit** your changes. + 3. Add the new M-500 Eth1/1 IP PAN-DB IP address. + 4. **Commit** your changes. +- Restart the firewall (devsrvr) process. + 1. Log in to the firewall CLI. + 2. Restart the devsrvr process: `debug software restart process device-server` + +## PAN-116017 + +```caveat +Google Cloud Platform (GCP) only +``` + +The firewall does not accept the DNS value from the initial configuration (init-cfg) file when you bootstrap the firewall. + +**Workaround:** Add DNS value as part of the bootstrap.xml in the bootstrap folder and complete the bootstrap process. + +## PAN-115816 + +```caveat +Microsoft Azure only +``` + +There is an intermittent issue where an Ethernet (eth1) interface does not come up when you first boot up the firewall. + +**Workaround:** Reboot the firewall. + +## PAN-114495 + +Alibaba Cloud runs on a KVM hypervisor and supports two Virtio modes: DPDK (default) and MMAP. If you deploy a VM-Series firewall running PAN-OS 9.0 in DPDK packet mode and you then switch to MMAP packet mode, the VM-Series firewall duplicates packets that originate from or terminate on the firewall. As an example, if a load balancer or a server behind the firewall pings the VM-Series firewall after you switch from DPDK packet mode to MMAP packet mode, the firewall duplicates the ping packets. + +Throughput traffic is not duplicated if you deploy the VM-Series firewall using MMAP packet mode. + +## PAN-112694 + +```caveat +Firewalls with multiple virtual systems only +``` + +If you configure dynamic DNS (DDNS) on a new interface (associated with vsys1 or another virtual system) and you then create a **New** Certificate Profile from the drop-down, you must set the location for the Certificate Profile to Shared. If you configure DDNS on an existing interface and then create a new Certificate Profile, we also recommend that you choose the Shared location instead of a specific virtual system. Alternatively, you can select a preexisting certificate profile instead of creating a new one. + +## PAN-112456 + +You can temporarily submit a change request for a URL Category with three suggested categories; however, only two categories are supported. Do not add more than two suggested categories to a change request until we address this issue. If you submit more than two suggested categories, only the first two categories in the change request are evaluated. + +## PAN-112135 + +You cannot unregister tags for a subnet or range in a dynamic address group from the web interface. + +**Workaround:** Use an XML API request to unregister the tags for the subnet or range. + +## PAN-111928 + +Invalid configuration errors are not displayed as expected when you revert a Panorama management server configuration. + +**Workaround:** After you revert the Panorama configuration, **Commit** (**Commit** > **Commit to Panorama**) the reverted configuration to display the invalid configuration errors. + +## PAN-111866 + +The push scope selection on the Panorama web interface displays incorrectly even though the commit scope displays as expected. This issue occurs when one administrator makes configuration changes to separate device groups or templates that affect multiple firewalls and a different administrator attempts to push those changes. + +**Workaround:** Perform one of the following tasks. + +- Initiate a **Commit to Panorama** operation followed by a **Push to Devices** operation for the modified device group and template configurations. +- Manually select the devices that belong to the modified device group and template configurations. + +## PAN-111729 + +If you disable DPDK mode and enable it again, you must immediately reboot the firewall. + +## PAN-111670 + +Tagged VLAN traffic fails when sent through an SR-IOV adapter. + +## PAN-110794 + +DGA-based threats shown in the firewall threat log display the same name for all such instances. + +## PAN-109526 + +The system log does not correctly display the URL for CRL files; instead, the URLs are displayed with encoded characters. + +## PAN-104780 + +If you configure a HIP object to match only when a connecting endpoint is managed (**Objects** > **GlobalProtect** > **HIP Objects** > **** > **General** > **Managed**), iOS and Android endpoints that are managed by AirWatch are unable to successfully match the HIP object and the HIP report incorrectly indicates that these endpoints are not managed. This issue occurs because GlobalProtect gateways cannot correctly identify the managed status of these endpoints. + +Additionally, iOS endpoints that are managed by AirWatch are unable to match HIP objects based on the endpoint serial number because GlobalProtect gateways cannot identify the serial numbers of these endpoints; these serial numbers do not appear in the HIP report. + +## PAN-103276 + +Adding a disk to a virtual appliance running Panorama 8.1 or a later release on VMware ESXi 6.5 update1 causes the Panorama virtual appliance and host web client to become unresponsive. + +**Workaround:** Upgrade the ESXi host to ESXi 6.5 update2 and add the disk again. + +## PAN-101688 + +```caveat +Panorama plugins +``` + +The IP address-to-tag mapping information registered on a firewall or virtual system is not deleted when you remove the firewall or virtual system from a Device Group. + +**Workaround:** Log in to the CLI on the firewall and enter the following command to unregister the IP address-to-tag mappings: `debug object registered-ip clear all`. + +## PAN-101537 + +After you configure and push address and address group objects in Shared and vsys-specific device groups from the Panorama management server to managed firewalls, executing the `show log direction equal | in ` command on a managed firewall only returns address and address group objects pushed form the Shared device group. + +**Workaround:** Specify the vsys in the query string: + +`admin>` `set system target-vsys ` + +`admin>` `show log direction equal query equal ‘vsys eq ’ | in ` + +## PAN-98520 + +When booting or rebooting a PA-7000 Series Firewall with the SMC-B installed, the BIOS console output displays attempts to connect to the card's controller in the System Memory Speed section. The messages can be ignored. + +## PAN-97757 + +GlobalProtect authentication fails with an `Invalid username/password` error (because the user is not found in **Allow List**) after you enable GlobalProtect authentication cookies and add a RADIUS group to the **Allow List** of the authentication profile used to authenticate to GlobalProtect. + +**Workaround:** Disable GlobalProtect authentication cookies. Alternatively, disable (clear) **Retrieve user group from RADIUS** in the authentication profile and configure group mapping from Active Directory (AD) through LDAP. + +## PAN-97524 + +```caveat +Panorama management server only +``` + +The Security Zone and Virtual System columns (**Network** tab) display `None` after a Device Group and Template administrator with read-only privileges performs a context switch. + +## PAN-96446 + +A firewall that is not included in a Collector Group fails to generate a system log if logs are dropped when forwarded to a Panorama management server that is running in Management Only mode. + +## PAN-95773 + +On VM-Series firewalls that have Data Plane Development Kit (DPDK) enabled and that use the i40e network interface card (NIC), the `show session info` CLI command displays an inaccurate throughput and packet rate. + +**Workaround:** Disable DPDK by running the `set system setting dpdk-pkt-io off` CLI command. + +## PAN-95028 + +For administrator accounts that you created in PAN-OS 8.0.8 and earlier releases, the firewall does not apply password profile settings (**Device** > **Password Profiles**) until after you upgrade to PAN-OS 8.0.9 or a later release and then only after you modify the account passwords. (Administrator accounts that you create in PAN-OS 8.0.9 or a later release do not require you to change the passwords to apply password profile settings.) + +## PAN-94846 + +When DPDK is enabled on the VM-Series firewall with i40e virtual function (VF) driver, the VF does not detect the link status of the physical link. The VF link status remains up, regardless of changes to the physical link state. + +## PAN-94093 + +HTTP Header Insertion does not work when jumbo frames are received out of order. + +## PAN-93968 + +The firewall and Panorama web interfaces display vulnerability threat IDs that are not available in PAN-OS 9.0 releases (**Objects** > **Security Profiles** > **Vulnerability Protection** > **** > **Exceptions**). To confirm whether a particular threat ID is available in your release, monitor the release notes for each new Applications and Threats content update or check the Palo Alto Networks [Threat Vault](https://threatvault.paloaltonetworks.com) to see the minimum PAN-OS release version for a threat signature. + +## PAN-93607 + +When you configure a VM-500 firewall with an SCTP Protection profile (**Objects** > **Security Profiles** > **SCTP Protection**) and you try to add the profile to an existing Security Profile Group (**Objects** > **Security Profile Groups**), the Security Profile Group doesn’t list the SCTP Protection profile in its drop-down list of available profiles. + +**Workaround:** Create a new Security Profile Group and select the SCTP Protection profile from there. + +## PAN-93532 + +When you configure a firewall running PAN-OS 9.0 as an nCipher HSM client, the web interface on the firewall displays the nCipher server status as Not Authenticated, even though the HSM state is up (**Device** > **Setup** > **HSM**). + +## PAN-93193 + +The memory-optimized VM-50 Lite intermittently performs slowly and stops processing traffic when memory utilization is critically high. To prevent this issue, make sure that you do not: + +- Switch to the firewall **Context** on the Panorama management server. +- Commit changes when a dynamic update is being installed. +- Generate a custom report when a dynamic update is being installed. +- Generate custom reports during a commit. + +**Workaround:** When the firewall performs slowly, or you see a critical System log for memory utilization, wait for 5 minutes and then manually reboot the firewall. + +Use the Task Manager to verify that you are not performing memory intensive tasks such as installing dynamic updates, committing changes or generating reports, at the same time, on the firewall. + +## PAN-91802 + +On a VM-Series firewall, the **clear session all** CLI command does not clear GTP sessions. + +## PAN-83610 + +In rare cases, a PA-5200 Series firewall (with an FE100 network processor) that has session offload enabled (default) incorrectly resets the UDP checksum of outgoing UDP packets. + +**Workaround:** In PAN-OS 8.0.6 and later releases, you can persistently disable session offload for only UDP traffic using the `set session udp-off load no` CLI command. + +## PAN-83236 + +The VM-Series firewall on Google Cloud Platform does not publish firewall metrics to Google Stack Monitoring when you manually configure a DNS server IP address (**Device** > **Setup** > **Services**). + +**Workaround:** The VM-Series firewall on Google Cloud Platform must use the DNS server that Google provides. + +## PAN-83215 + +SSL decryption based on ECDSA certificates does not work when you import the ECDSA private keys onto an nCipher nShield hardware security module (HSM). + +## PAN-81521 + +Endpoints failed to authenticate to GlobalProtect through Kerberos when you specify an FQDN instead of an IP address in the Kerberos server profile (**Device** > **Server Profiles** > **Kerberos**). + +**Workaround:** Replace the FQDN with the IP address in the Kerberos server profile. + +## PAN-77125 + +PA-7000 Series, PA-5450, PA-5200 Series, and PA-3200 Series firewalls configured in tap mode don’t close offloaded sessions after processing the associated traffic; the sessions remain open until they time out. + +**Workaround:** Configure the firewalls in virtual wire mode instead of tap mode, or disable session offloading by running the `set session off load no` CLI command. + +## PAN-75457 + +In WildFire appliance clusters that have three or more nodes, the Panorama management server does not support changing node roles. In a three-node cluster for example, you cannot use Panorama to configure the worker node as a controller node by adding the HA and cluster controller configurations, configure an existing controller node as a worker node by removing the HA configuration, and then commit and push the configuration. Attempts to change cluster node roles from Panorama results in a validation error—the commit fails and the cluster becomes unresponsive. + +## PAN-73530 + +The firewall does not generate a packet capture (pcap) when a Data Filtering profile blocks files. + +## PAN-73401 + +When you import a two-node WildFire appliance cluster into the Panorama management server, the controller nodes report their state as out-of-sync if either of the following conditions exist: + +- You did not configure a worker list to add at least one worker node to the cluster. (In a two-node cluster, both nodes are controller nodes configured as an HA pair. Adding a worker node would make the cluster a three-node cluster.) +- You did not configure a service advertisement (either by enabling or not enabling advertising DNS service on the controller nodes). + +**Workaround:** There are three possible workarounds to sync the controller nodes: + +- After you import the two-node cluster into Panorama, push the configuration from Panorama to the cluster. After the push succeeds, Panorama reports that the controller nodes are in sync. +- Configure a worker list on the cluster controller: + admin@wf500(active-controller)# `set deviceconfig cluster mode controller worker-list ` + (`` is the IP address of the worker node you are adding to the cluster.) This creates a three-node cluster. After you import the cluster into Panorama, Panorama reports that the controller nodes are in sync. When you want the cluster to have only two nodes, use a different workaround. +- Configure service advertisement on the local CLI of the cluster controller and then import the configuration into Panorama. The service advertisement can advertise that DNS is or is not enabled. + admin@wf500(active-controller)# `set deviceconfig cluster mode controller service-advertisement dns-service enabled yes` + or + admin@wf500(active-controller)# `set deviceconfig cluster mode controller service-advertisement dns-service enabled no` + Both commands result in Panorama reporting that the controller nodes are in sync. + +## PAN-70906 + +If the PAN-OS web interface and the GlobalProtect portal are enabled on the same IP address, then when a user logs out of the GlobalProtect portal, the administrative user is also logged out from the PAN-OS web interface. + +**Workaround:** Use the IP address to access the PAN-OS web interface and an FQDN to access the GlobalProtect portal. + +## PAN-69505 + +When viewing an external dynamic list that requires client authentication and you **Test Source URL**, the firewall fails to indicate whether it can reach the external dynamic list server and returns a URL access error (**Objects** > **External Dynamic Lists**). + +## PAN-40079 + +The VM-Series firewall on KVM, for all supported Linux distributions, does not support the Broadcom network adapters for PCI pass-through functionality. + +## PAN-39636 + +Regardless of the **Time Frame** you specify for a scheduled custom report on a Panorama M-Series appliance, the earliest possible start date for the report data is effectively the date when you configured the report (**Monitor** > **Manage Custom Reports**). For example, if you configure the report on the 15th of the month and set the **Time Frame** to **Last 30 Days**, the report that Panorama generates on the 16th will include only data from the 15th onward. This issue applies only to scheduled reports; on-demand reports include all data within the specified **Time Frame**. + +**Workaround:** To generate an on-demand report, click **Run Now** when you configure the custom report. + +## PAN-38255 + +When you perform a factory reset on a Panorama virtual appliance and configure the serial number, logging does not work until you reboot Panorama or execute the `debug software restart process management-server` CLI command. + +## PAN-31832 + +The following issues apply when configuring a firewall to use a hardware security module (HSM): + +- **nCipher nShield Connect**—The firewall requires at least four minutes to detect that an HSM was disconnected, causing SSL functionality to be unavailable during the delay. +- **SafeNet Network**—When losing connectivity to either or both HSMs in an HA configuration, the display of information from the `show high-availability state` and `show hsm info` commands are blocked for 20 seconds. diff --git a/web/data/issues/PAN-OS/known/10.1.7_2026-03-16.md b/web/data/issues/PAN-OS/known/10.1.7_2026-03-16.md new file mode 100644 index 0000000..3c14a63 --- /dev/null +++ b/web/data/issues/PAN-OS/known/10.1.7_2026-03-16.md @@ -0,0 +1,930 @@ +--- +type: Known +product: PAN-OS +version: 10.1.7 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## APL-15000 + +When you move a firewall from one Strata Logging Service instance to another, it can take up to an hour for the firewall to begin sending logs to the new instance. + +## APL-8269 + +For data retrieved from Strata Logging Service, the Threat Name column in **Panorama** > **ACC** > **threat-activity** appears blank. + +## PLUG-380 + +When you rename a device group, template, or template stack in Panorama that is part of a VMware NSX service definition, the new name is not reflected in NSX Manager. Therefore, any ESXi hosts that you add to a vSphere cluster are not added to the correct device group, template, or template stack and your Security policy is not pushed to VM-Series firewalls that you deploy after you rename those objects. There is no impact to existing VM-Series firewalls. + +## WF500-5559 + +An intermittent error while analyzing signed PE samples on the WildFire appliance might cause analysis failures. + +## WF500-5471 + +After using the firewall CLI to add a WildFire appliance with an IPv6 address, the initial connection may fail. + +**Workaround:** Retry connecting after you restart the web server with the following command: `debug software restart process web-server`. + +## PAN-281370 + +The Advanced WildFire Inline ML models **OOXML** and **Mach-O** erroneously display as being available from the CLI; however, they are only available on PAN-OS 11.1.3 and later releases. + +## PAN-260851 + +From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (**Objects** > **Applications**) tag. + +## PAN-228273 + +On the Panorama management server in FIPS-CC mode, the ElasticSearch cluster fails to come up and the `show log-collector-es-cluster health` command displays the `status` is `red`. This results in log ingestion issues for Panorama in Panorama only or Log Collector mode. + +## PAN-227344 + +On the Panorama management server, PDF Summary Reports (**Monitor** > **PDF Reports** > **Manage PDF Summary**) display no data and are blank when predefined reports are included in the summary report. + +## PAN-223488 + +```caveat +This issue is now resolved. See PAN-OS 10.1.12 Addressed Issues. +``` + +Closed ElasticSearch shards are not deleted from the Panorama M-Series and virtual appliance. This causes the ElasticSearch shard purging to not work as expected, resulting in high disk usage. + +## PAN-223365 + +The Panorama management server is unable to query any logs if the ElasticSearch health status for any Log Collector (**Panorama** > **Managed Collector** is degraded. + +**Workaround:** [Log in to the Log Collector CLI](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli) and restart ElasticSearch. + +`admin``debug elasticsearch es-restart all` + +## PAN-218521 + +The ElasticSearch process on the M-600 appliance in Log Collector mode may enter a continuous reboot cycle. This results in the M-600 appliance becoming unresponsive, consuming logging disk space, and preventing new log ingestion. + +## PAN-217307 + +```caveat +This issue is now resolved. See PAN-OS 10.1.14 Addressed Issues. +``` + +The following Security policy rule (**Policies** > **Security**) filters return no results: + +`log-start eq no` + +`log-end eq no` + +`log-end eq yes` + +## PAN-216214 + +For Panorama-managed firewalls in an Active/Active High Availability (HA) configuration where you configure the firewall HA settings (**Device** > **High Availability**) in a template or template stack (**Panorama** > **Templates**), performing a local commit on one of the HA firewalls triggers an HA config sync on the peer firewall. This causes the HA peer configuration to go `Out of Sync`. + +## PAN-213746 + +On the Panorama management server, the **Hostkey** displayed as `undefined undefined` if you override an SSH Service Profile (**Device** > **Certificate Management** > **SSH Service Profile**) Hostkey configured in a Template from the Template Stack. + +## PAN-212889 + +```caveat +This issue is now resolved. See PAN-OS 10.1.11 Addressed Issues. +``` + +On the Panorama management server, different threat names are used when querying the same threat in the Threat Monitor (**Monitor** > **App Scope** > **Threat Monitor**) and **ACC**. This results in the ACC displaying `no data to display` when you are redirected to the ACC after clicking a threat name in the Threat Monitor and filtering the same threat name in the Global Filters. + +## PAN-208325 + +```caveat +This issue is now resolved. See PAN-OS 10.1.10 Addressed Issues. +``` + +The following NextGen firewalls are unable to automatically renew the device certificate (**Device** > **Setup** > **Management** or **Panorama** > **Setup** > **Management**). + +- PA-410 Firewall +- PA-440, PA-450, and PA-460 Firewalls +- PA-5450 Firewall + +**Workaround:** Log in to the [firewall CLI](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-cli-quick-start/get-started-with-the-cli/access-the-cli) and fetch the device certificate. + +`admin>``request certificate fetch` + +## PAN-208189 + +```caveat +This issue is now resolved. See PAN-OS 10.1.9-h3 Addressed Issuesand PAN-OS 10.1.10 Addressed Issues. +``` + +Traffic fails to match and reach all destinations if a Security policy rule includes FQDN objects that resolve to two or more IP addresses. + +## PAN-206268 + +```caveat +This issue is now resolved. See PAN-OS 10.1.10 Addressed Issues. +``` + +On the Panorama management server, the Auth Key field was erroneously displayed when you configure the Panorama Settings (**Device** > **Setup** > **Management**) as part of a template or template stack configuration. + +## PAN-206243 + +The PA-220 firewall reaches the maximum disk usage capacity multiple a day that requires a disk cleanup. A critical system log (**Monitor** > **Logs** > **System**) is generated each time the firewall reaches maximum disk usage capacity. + +## PAN-205187 + +ElasticSearch may not start properly when a newly installed Panorama virtual appliance powers on for the first time, resulting in the Panorama virtual appliance being unable to query logs forwarded from the managed firewall to a Log Collector. + +**Workaround:** [Log in to the Panorama CLI](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli) and start the PAN-OS software. + +`admin>``request restart software` + +## PAN-201855 + +On the Panorama management server, cloning any template (**Panorama** > **Templates**) corrupts certificates (**Device** > **Certificate Management** > **Certificates**) with the **Block Private Key Export** setting enabled across all templates. This results in managed firewalls experiencing issues wherever the corrupted certificate is referenced. + +For example, you have template A, B, and C where templates A and B have certificates with the **Block Private Key Export** setting enabled. Cloning template C corrupts the certificates with **Block Private Key Export** setting enabled in templates A and B. + +**Workaround:** After cloning a template, delete and re-import the corrupted certificates. + +## PAN-201627 + +```caveat +This issue is now resolved. See PAN-OS 10.1.8 Addressed Issues. +``` + +For next-generation firewall deployments where SD-WAN is configured, the dataplane could restart if all SD-WAN member links are down due to an out-of-memory condition. This could also happen during a device reboot when all SD-WAN tunnels are down. + +**Workaround:** Downgrade to PAN-OS 10.1.6-h3 or earlier, or upgrade to the latest PAN-OS 10.2 release. + +## PAN-199099 + +```caveat +This issue is now resolved. See PAN-OS 10.1.8 Addressed Issues. +``` + +When decryption is enabled, Safari and Google Chrome browsers on Mac computers running macOS Monterey or later reject the server certificates firewalls present. The browsers cannot validate the chain of trust for the certificates because the Authority Key Identifier (AKID) of the server certificates and the Subject Key Identifier (SKID) of the forward trust certificate do not match. + +**Workaround:** Use a forward trust certificate that does not contain AKID or SKID extensions. + +## PAN-198174 + +When viewing traffic or threat logs from the firewall ACC or Monitor, performing a reverse DNS lookup, for example, when resolving IP addresses to domain names using the **Resolve Hostname** feature, can cause the appliance to crash and restart if DNS server settings have not been configured. + +**Workaround:** Provide a DNS server setting for the firewall (**Device** > **DNS Setup** > **Services**). If you cannot reference a valid DNS server, you can add a dummy address. + +## PAN-197341 + +On the Panorama management server, if you create multiple device group **Objects** with the same name in the Shared device group and any additional device groups (**Panorama** > **Device Groups**) under the same device group hierarchy that are used in one or more **Policies**, renaming the object with a shared name in any device group causes the object name to change in the policies where it is used. This issue applies only to device group objects that can be referenced in a Security policy rule. + +For example: + +1. You create a parent device group `DG-A` and a child device group `DG-B`. +2. You create address objects called `AddressObjA` in the `Shared`, `DG-A` and `DG-B` device groups and add `AddressObjA` to a Security policy rule under `DG-A` and `DG-B`. +3. Later, you change the `AddressObjA` name in the `Shared` device group to `AddressObjB`. + +Changing the name of the address object in the `Shared` device group causes the references in the Policy rule to use the renamed `Shared` object instead of the device group object. + +## PAN-197097 + +```caveat +This issue is now resolved. See PAN-OS 10.1.9 Addressed Issues. +``` + +Large Scale VPN (LSVPN) does not support IPv6 addresses on the satellite firewall. + +## PAN-196758 + +On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you **Preview Changes** (**Commit** > **Push to Devices** > **Edit Selections** or **Commit** > **Commit and Push** > **Edit Selections**). + +## PAN-194519 + +```caveat +PA-5450 firewall only +``` + +Trying to configure a custom payload format under **Device** > **Server Profiles** > **HTTP** yields a Javascript error. + +## PAN-194515 + +```caveat +PA-5450 firewall only +``` + +The Panorama web interface does not display any predefined template stack variables in the dropdown menu under **Device** > **Setup** > **Log Interface** > **IP Address**. + +**Workaround:** Configure the log interface IP address on the individual firewall web interface instead of on Panorama. + +## PAN-194424 + +```caveat +PA-5450 firewall only +``` + +Upgrading to PAN-OS 10.1.6-h2 while having a log interface configured can cause both the log interface and the management interface to remain connected to the log collector. + +**Workaround:** Restart the log receiver service by running the following CLI command: + +`debug software restart process log-receiver` + +## PAN-194202 + +```caveat +PA-5450 firewall only +``` + +If the management interface and logging interface are configured on the same subnetwork, the firewall conducts log forwarding using the management interface instead of the logging interface. + +## PAN-193518 + +All logs (**Monitor** > **Logs**) generated by a firewall running a PAN-OS 10.0 release are not accessible if you downgrade from PAN-OS 10.1 to PAN-OS 10.0, and then upgrade back to PAN-OS 10.1. + +**Workaround:** If you need to downgrade from PAN-OS 10.1 to PAN-OS 10.0 and then back to PAN-OS 10.1, downgrade to PAN-OS 10.0.11 to ensure that all logs ingested while running a PAN-OS 10.0 release remain accessible after upgrade back to PAN-OS 10.1. + +## PAN-190727 + +```caveat +PA-5450 firewall only +``` + +Documentation for configuring the log interface is unavailable on the web interface and in the PAN-OS Administrator’s Guide. + +## PAN-189057 + +```caveat +HA configuration +``` + +On the Panorama management server, Panorama enters a `non-functional` state due to `php.debug.log` life taking up too much space. + +**Workaround:** Disable the debug flag for Panorama. + +1. [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface). +2. In the same browser you are logged into the Panorama web interface, enter the following URL. + `https:///debug` +3. Uncheck (disable) **Debug** or **Clear Debug**. +4. () Repeat this step on each Panorama high availability (HA) peer if Panorama is in a HA configuration. + +## PAN-188052 + +Devices in FIPS-CC mode are unable to connect to servers utilizing ECDSA-based host keys that impacts exporting logs (**Device** > **Scheduled Log Export**), exporting configurations (**Device** > **Scheduled Config Export**), or the `scp export` command in the CLI. + +**Workaround:** Use RSA-based host keys on the destination server. + +## PAN-187685 + +On the Panorama management server, the Template Status displays no synchronization status (**Panorama** > **Managed Devices** > **Summary**) after a bootstrapped firewall is successfully added to Panorama. + +**Workaround:** After the bootstrapped firewall is successfully added to Panorama, [log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) and select **Commit** > **Push to Devices**. + +## PAN-174982 + +In HA active/active configurations where, when interfaces that were associated with a virtual router were deleted, the configuration change did not sync. + +## PAN-172274 + +When you activate the advanced URL filtering license, your license entitlements for PAN-DB and advanced URL filtering might not display correctly on the firewall — this is a display anomaly, not a licensing issue, and does not affect access to the services. + +**Workaround:** Issue the following command to retrieve and update the licenses: `license request fetch`. + +## PAN-172113 + +If you request a User Activity Report on Panorama and the vsys key value in the XML is an unsupported value, the resulting job becomes unresponsive at 10% and does not complete until you manually stop the job in the web interface. + +**Workaround:**Change the vsys key to a valid device group, commit your changes, and run the User Activity Report again. + +## PAN-172067 + +When you configure an HTTP server profile (**Device** > **Server Profiles** > **HTTP** or **Panorama** > **Server Profiles** > **HTTP**), the **Username** and **Password** fields are always required regardless of whether **Tag Registration** is enabled. + +**Workaround:** When you configure an HTTP server profile, always enter a username and password to successfully create the HTTP server profile. + +You must enter a username and password even if the HTTP server does not require it. The HTTP server ignores the username and password if they are not required for the firewall to connect. + +## PAN-172061 + +A process (`all_pktproc`) can cause intermittent crashes on the Passive PA-5450 firewall in an Active/Passive HA pair. This issue may be seen during an upgrade or reload of the firewall with traffic and when clearing sessions. + +## PAN-171938 + +No results are displayed when you **Show Application Filter** for a Security policy rule (**Policies** > **Security** > **Application** > **Value** > **Show Application Filter**). + +## PAN-171723 + +If you use Panorama to push a configuration that uses App-ID Cloud Engine (ACE) App-IDs and then you downgrade the firewall from PAN-OS 10.1 to PAN-OS 10.0, the installation succeeds but after you reboot, the auto-commit fails. + +**Workaround:** Remove all ACE application configurations before downgrading. + +## PAN-171706 + +```caveat +This issue is now resolved. See PAN-OS 10.1.11 Addressed Issues. +``` + +If you are using Panorama to manage firewalls with multiple virtual systems and the virtual system that is the User-ID hub uses an alias, the local commit on Panorama is successful but the commit to the firewall fails. + +## PAN-171673 + +On the Panorama management server, the **ACC** returns inaccurate results when you filter for **New App-ID** in the **Application** usage widget. + +## PAN-171635 + +If you have an on-premise Active Directory and there is an existing group mapping configuration on the firewall, if you migrate the group mapping to the Cloud Identity Engine, the firewall does not remove the existing group mapping even if the configuration is disabled and the firewall is rebooted, which may conflict with new mappings from the Cloud Identity Engine. + +**Workaround**: Use the debug user-id clear domain-map command to remove the existing group mappings from the firewall. + +## PAN-171224 + +On the Panorama management server, a custom report (**Monitor** > **Managed Custom Reports**) with a high volume of unique data objects is not generated when you click **Run Now**. + +## PAN-171145 + +If you edit or remove the value for the `mail` attribute in your on-premise Active Directory, the changes may not be immediately reflected on the firewall after it syncs with the Cloud Identity Engine. + +## PAN-170923 + +In **Policies** > **Security** > **Policy Optimizer** > **New App Viewer**, when you select a Security policy rule in the bottom portion of the screen, the application data in the application browser (top portion of screen) does not match the Apps Seen on the selected rule. In addition, filtering in the application browser based on Apps Seen does not work. + +## PAN-170270 + +Using the CLI to power on a PA-5450 Networking Card (NC) in an Active HA firewall can cause its Passive peer to temporarily go down. + +## PAN-169906 + +The CN-Series Firewall as a Kubernetes Service does not support AF_XDP when deployed in CentOS. + +## PAN-168636 + +Connecting to the App-ID Cloud Engine (ACE) cloud using a management port with explicit proxy configured on it is not supported. Instead, use a data plane interface for the service route ([Prepare to Deploy App-ID Cloud Engine](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/app-id/cloud-based-app-id-service/prepare-to-deploy-app-id-cloud-engine.html) describes how to do this.) + +## PAN-168113 + +On the Panorama management server, you are unable to configure a master key (**Device** > **Master Key and Diagnostics**) for a managed firewall if an interface (**Network** > **Interfaces** > **Ethernet**) references a zone pushed from Panorama. + +**Workaround:** Remove the referenced zone from the interface configuration to successfully configure a master key. + +## PAN-167847 + +If you issue the command `opof stats`, then clear the results {opof stats -c}, the Active Sessions value is sometimes invalid. For example, you might see a negative number or an excessively large number. + +**Workaround:** Re-run the `opof stats` command after the offload completes. + +## PAN-167401 + +When a firewall or Panorama appliance configured with a proxy is upgraded to PAN-OS 10.0.3 or a later release, it fails to connect to edge service. + +## PAN-165669 + +If you configure a group that the firewall retrieves from the Cloud Identity Engine as the `user in` value in a filter query, Panorama is unable to retrieve the group membership and as a result, is unable to display this data in logs and custom reports. + +## PAN-164922 + +On the Panorama management server, a context switch to a managed firewall running a PAN-OS 8.1.0 to 8.1.19 release fails. + +## PAN-164885 + +```caveat +This issue is now resolved. See PAN-OS 10.1.14-h6 Addressed Issues +``` + +On the Panorama management server, pushes to managed firewalls (**Commit** > **Push to Devices** or **Commit and Push**) may fail when an EDL (**Objects** > **External Dynamic Lists**) is configured to **Check for updates** every 5 minutes due to the commit and EDL fetch processes overlapping. This is more likely to occur when multiple EDLs are configured to check for updates every 5 minutes. + +## PAN-164841 + +A successful deployment of a Panorama virtual appliance on Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform (GCP) is inaccessible when deploying using the PAN-OS 10.1.0-b6 release. + +## PAN-164647 + +On the Panorama management server, activating a license (**Panorama** > **Device Deployment** > **Licenses**) on managed firewalls in a high availability (HA) configuration causes the Safari web browser to become unresponsive. + +**Workaround:** [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) from a web browser other than Safari to successfully activate a license on managed firewalls in an HA configuration. + +## PAN-164618 + +The VM-Series firewall CLI and system logs display the license name `VM-SERIES-X`, while the user interface displays `VM-FLEX-X` (in both cases `X` is the number of vCPUs). In future releases the user interface will use the `VM-SERIES-X` format. + +## PAN-164586 + +If you use a value other than `mail` for the user or group email attribute in the Cloud Identity Engine, it displays in `user@domain` format in the CLI output. + +## PAN-163966 + +On the Panorama management server, the **ACC** and on demand reports (**Monitor** > **Manage Custom Reports**) are unable to fetch Directory Sync group membership when the Source User Group filter query is applied, resulting in no data being displayed for the filter when Directory Sync is configured as the Source User for a policy rule. + +## PAN-162836 + +On the VM-Series firewall, if you select **Device** > **Licenses** > **Deactivate VM** a popup window opens and you can choose **Subscriptions** or **Support** and press **Continue** to remove licenses and register the changes with the license server. When the license removal is complete the **Deactivate VM** window does not update its text to exclude deactivated licenses or close the window. + +**Workaround**: Wait until the license deactivation is complete, and click **Cancel** to close the window. + +## PAN-162088 + +```caveat +This issue is now resolved. See PAN-OS 10.1.9 Addressed Issues. +``` + +On the Panorama management server in a high availability (HA) configuration, content updates (**Panorama** > **Dynamic Updates**) manually uploaded to the active HA peer are not synchronized to the passive HA peer when you **Install** a content update and enable **Sync to HA Peer**. + +## PAN-161666 + +The firewall includes any users configured in the Cloud Identity Engine in the count of groups. As a result, some CLI command output does not accurately display the number of groups the firewall has retrieved from the Cloud Identity Engine and counts users as groups in the `No. of Groups` in the command output. If the attempt to retrieve the user or group fails, the information for the user or group still displays in the CLI command output. + +## PAN-161451 + +If you issue the command `opof stats`, there are occasional zero packet and byte counts coming from the DPDK counters. This occurs when a session is in the tcp-reuse state, and has no impact on the existing session. + +## PAN-160238 + +If you migrate traffic from a firewall running a PAN-OS version earlier than 9.0 to a firewall running PAN-OS 9.0 or later, you experience intermittent VXLAN packet drops if TCI policy is not configured for inspecting VXLAN traffic flows. + +**Workaround:**On the new firewall, create an app override for VXLAN outer headers as described in [What is an Application Override?](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVLCA0) and the video tutorial [How to Configure an Application Override Policy on the Palo Alto Networks Firewall](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PPDrCAO). + +PAN-OS version 9.0 can inspect both inner and outer VXLAN flows. If you want to inspect inner flows, you must define a tunnel content inspection (TCI) policy. + +## PAN-157444 + +As a result of a telemetry handling update, the Source Zone field in the DNS analytics logs (viewable in the DNS Analytics tab within AutoFocus) might not display correct results. + +## PAN-157327 + +On downgrade to PAN-OS 9.1, Enterprise Data Loss Prevention (DLP) filtering settings (**Device** > **Setup** > **DLP**) are not removed and cause commit errors for the downgraded firewall if you do not uninstall the Enterprise DLP plugin before downgrade. + +**Workaround:** After you successfully downgrade a managed firewall to PAN-OS 9.1, commit and push from Panorama to remove the Enterprise DLP filtering settings and complete the downgrade. + +1. Downgrade your managed firewall to PAN-OS 9.1 +2. Log in to the firewall web interface and view the **Tasks** to verify all auto commits related to the downgrade have completed successfully. +3. Log in to the Panorama web interface and **Commit** > **Commit and Push** to your managed firewall downgraded to PAN-OS 9.1. + +## PAN-157103 + +Multi-channel functionality may not be properly utilized on an VM-Series firewall deployed in VMware NSX-V after the service is first deployed. + +**Workaround**: Execute the command `debug dataplane pow status` to view the number of channels being utilized by the dataplane. + +Per pan-task Netx statisticsCounter Name 1 2 3 4 5 6 Total---------------------------------------------ready_dvf 2 0 0 0 0 0 2 + +If multi-channel functionality is not working, disable your NSX-V security policy and reapply it. Then reboot the VM-Series firewall. When the firewall is back up, verify that multi-channel functionality is working by executing the command `debug dataplane pow status`. It should now show multiple channels being utilized. + +Per pan-task Netx statisticsCounter Name 1 2 3 4 5 6 Total---------------------------------------------ready_dvf 1 1 0 0 0 0 2 + +## PAN-156598 + +```caveat +Panorama only +``` + +If you configure a standard custom vulnerability signature in a custom Vulnerability Protection profile in a shared device group, the shared profile custom signatures do not populate in the other device groups when you configure a combination custom vulnerability signature. + +**Workaround:** Use the CLI to update the combination signature. + +## PAN-154292 + +On the Panorama management server, downgrading from a PAN-OS 10.0 release to a PAN-OS 9.1 release causes Panorama commit (**Commit** > **Commit to Panorama**) failures if a custom report (**Monitor** > **Manage Custom Reports**) is configured to Group By **Session ID**. + +**Workaround:** After successful downgrade, reconfigure the Group By setting in the custom report. + +## PAN-154034 + +On the Panorama management server, the Type column in the System logs (**Monitor** > **Logs** > **System**) for managed firewalls running a PAN-OS 9.1 release erroneously display `iot` as the type. + +## PAN-154032 + +On the Panorama management server, downgrading to PAN-OS 9.1 with the Panorama plugin for Cisco TrustSec version 1.0.2 installed does not automatically transform the plugin to be compatible with PAN-OS 9.1 + +**Workaround:** After successful downgrade to PAN-OS 9.1, **Remove Config** (**Panorama** > **Plugins**) of the Panorama plugin for Cisco TrustSec and then reconfigure the plugin. + +## PAN-153803 + +On the Panorama management server, scheduled email PDF reports (**Monitor** > **PDF Reports**) fail if a GIF image is used in the header or footer. + +## PAN-153557 + +On the Panorama management server CLI, the overall report status for a report query is marked as `Done` despite reports generated from logs in the Strata Logging Service from the PODamericas Collector Group jobs are still in a `Running` state. + +## PAN-153068 + +The Bonjour Reflector option is supported on up to 16 interfaces. If you enable it on more than 16 interfaces, the commit succeeds and the Bonjour Reflector option is enabled only for the first 16 interfaces and ignored for any additional interfaces. + +## PAN-151238 + +There is a known issue where M-100 appliances are able to download and install a PAN-OS 10.0 release image even though the M-100 appliance is no longer supported after PAN-OS 9.1. (Refer to the [hardware end-of-life dates](https://www.paloaltonetworks.com/services/support/end-of-life-announcements/hardware-end-of-life-dates.html).) + +## PAN-151085 + +On a PA-7000 Series firewall chassis having multiple slots, when HA clustering is enabled on an active/active HA pair, the session table count for one of the peers can show a higher count than the actual number of active sessions on that peer. This behavior can be seen when the session is being set up on a non-cache slot (for example, when a session distribution policy is set to round-robin or session-load); it is caused by the additional cache lookup that happens when HA cluster participation is enabled. + +## PAN-150801 + +Automatic quarantine of a device based on forwarding profile or log setting does not work on the PA-7000 Series firewalls. + +## PAN-150515 + +After you install the device certificate on a new Panorama management server, Panorama is not able to connect to the IoT Security edge service. + +**Workaround:** Restart Panorama to connect to the IoT Security edge service. + +## PAN-150345 + +During updates to the Device Dictionary, the IoT Security service does not push new Device-ID attributes (such as new device profiles) to the firewall until a manual commit occurs. + +**Workaround:** Perform a force commit to push the attributes in the content update to the firewall. + +## PAN-150361 + +In an Active-Passive high availability (HA) configuration, an error displays if you create a device object on the passive device. + +**Workaround:** Load the running configuration and perform a force commit to sync the devices. + +## PAN-148971 + +If you enter a search term for Events that are related to IoT in the System logs and apply the filter, the page displays an `Invalid term` error. + +**Workaround:** Specify `iot` as the **Type Attribute** to filter the logs and use the search term as the **Description Attribute**. For example: `( subtype eq iot ) and ( description contains 'gRPC connection' )`. + +## PAN-148924 + +In an active-passive HA configuration, tags for dynamic user groups are not persistent after rebooting the firewall because the active firewall does not sync the tags to the passive firewall during failover. + +## PAN-146995 + +After downgrading a Panorama management server from PAN-OS 10.0 to PAN-OS 9.1, the `VLD` and `logd` processes may crash when Panorama reboots. + +**Workaround:** Panorama automatically restarts the `VLD` and `logd` processes. + +## PAN-146807 + +Changing the device group configured in a monitoring definition from a child DG to a parent DG, or vice versa, might cause firewalls configured in the child DG to lose IP tag mapping information received from the monitoring definition. Only firewalls assigned to the parent DG receive IP tag mapping updates. + +**Workaround**: Perform a manual config sync on the device group that lost the IP tag mapping information. + +## PAN-146485 + +On the Panorama management server, adding, deleting, or modifying the upstream NAT configuration (**Panorama** > **SD-WAN** > **Devices**) does not display the branch template stack as `out of sync`. + +Additionally, adding, deleting, or modifying the BGP configuration (**Panorama** > **SD-WAN** > **Devices**) does not display the hub and branch template stacks as `out of sync`. For example, modifying the BGP configuration on the branch firewall does not cause the hub template stack to display as `out of sync`, nor does modifying the BGP configuration on the hub firewall cause the branch template stack as `out of sync`. + +**Workaround:** After performing a configuration change, **Commit and Push** the configuration changes to all hub and branch firewalls in the VPN cluster containing the firewall with the modified configuration. + +## PAN-145460 + +CN-MGMT pods fail to connect to the Panorama management server when using the Kubernetes plugin. + +**Workaround:** **Commit** the Panorama configuration after the CN-MGMT pod successfully registers with Panorama. + +## PAN-144889 + +On the Panorama management server, adding, deleting, or modifying the original subnet IP, or adding a new subnet after you successfully configure a tunnel IP subnet, for the SD-WAN 1.0.2 plugin does not display the managed firewall templates (**Panorama** > **Managed Devices** > **Summary**) as `Out of Sync`. + +**Workaround**: When modifying the original subnet IP, or adding a new subnet, push the template configuration changes to your managed firewalls and **Force Template Values** (**Commit** > **Push to Devices** > **Edit Selections**). + +## PAN-143132 + +Fetching the device certificate from the Palo Alto Networks Customer Support Portal (CSP) may fail and displays the following error in the CLI: + +`ERROR Failed to process S1C msg: Error` + +**Workaround:** Retrying fetching the device certificate from the Palo Alto Networks CSP. + +## PAN-141630 + +Current performance limitation: single data plane use only. The PA-5200 Series and PA-7000 Series firewalls that support 5G network slice security, 5G equipment ID security, and 5G subscriber ID security use a single data plane only, which currently limits the firewall performance. + +## PAN-140959 + +The Panorama management server allows you to downgrade Zero Touch Provisioning (ZTP) firewalls to PAN-OS 9.1.2 and earlier releases where ZTP functionality is not supported. + +## PAN-140008 + +ElasticSearch is forced to restart when the `masterd` process misses too many heartbeat messages on the Panorama management server resulting in a delay in a log query and ingestion. + +## PAN-136763 + +On the Panorama management server, managed firewalls display as `disconnected` when installing a PAN-OS software update (**Panorama** > **Device Deployment** > **Software**) but display as `connected` when you view your managed firewalls Summary (**Panorama** > **Managed Devices** > **Summary**) and from the CLI. + +**Workaround:** Log out and log back in to the Panorama web interface. + +## PAN-135742 + +There is an issue in HTTP2 session decryption where the App-ID in the decryption log is the App-ID of the parent session (which is web-browsing). + +## PAN-134053 + +ACC does not filter WildFire logs from Dynamic User Groups. + +## PAN-132598 + +The Panorama management server does not check for duplicate addresses in address groups (**Objects** > **Address Groups**) and duplicate services in service groups (**Objects** > **Service Groups**) when created from the CLI. + +## PAN-130550 + +```caveat +PA-3200 Series, PA-5220, PA-5250, PA-5260, and PA-7000 Series firewalls +``` + +For traffic between virtual systems (inter-vsys traffic), the firewall cannot perform source NAT using dynamic IP (DIP) address translation. + +**Workaround:** Use source NAT with Dynamic IP and Port (DIPP) translation on inter-vsys traffic. + +## PAN-127813 + +In the current release, SD-WAN auto-provisioning configures hubs and branches in a hub and spoke model, where branches don’t communicate with each other. Expected branch routes are for generic prefixes, which can be configured in the hub and advertised to all branches. Branches with unique prefixes are not published up to the hub. + +**Workaround:** Add any specific prefixes for branches to the hub advertise-list configuration. + +## PAN-127206 + +If you use the CLI to enable the cleartext option for the Include Username in HTTP Header Insertion Entries feature, the authentication request to the firewall may become unresponsive or time out. + +## PAN-123277 + +Dynamic tags from other sources are accessible using the CLI but do not display on the Panorama web interface. + +## PAN-123040 + +When you try to view network QoS statistics on an SD-WAN branch or hub, the QoS statistics and the hit count for the QoS rules don’t display. A workaround exists for this issue. Please contact Support for information about the workaround. + +## PAN-120440 + +There is an issue on M-500 Panorama management servers where any ethernet interface with an IPv6 address having Private PAN-DB-URL connectivity only supports the following format: `2001:DB9:85A3:0:0:8A2E:370:2`. + +## PAN-120423 + +PAN-OS 10.0.0 does not support the XML API for GlobalProtect logs. + +## PAN-120303 + +There is an issue where the firewall remains connected to the PAN-DB-URL server through the old management IP address on the M-500 Panorama management server, even when you configured the Eth1/1 interface. + +**Workaround:** Update the PAN-DB-URL IP address on the firewall using one of the methods below. + +- Modify the PAN-DB Server IP address on the managed firewall. + 1. On the web interface, delete the **PAN-DB Server** IP address (**Device** > **Setup** > **Content ID** > **URL Filtering** settings). + 2. **Commit** your changes. + 3. Add the new M-500 Eth1/1 IP PAN-DB IP address. + 4. **Commit** your changes. +- Restart the firewall (devsrvr) process. + 1. Log in to the firewall CLI. + 2. Restart the devsrvr process: `debug software restart process device-server` + +## PAN-116017 + +```caveat +Google Cloud Platform (GCP) only +``` + +The firewall does not accept the DNS value from the initial configuration (init-cfg) file when you bootstrap the firewall. + +**Workaround:** Add DNS value as part of the bootstrap.xml in the bootstrap folder and complete the bootstrap process. + +## PAN-115816 + +```caveat +Microsoft Azure only +``` + +There is an intermittent issue where an Ethernet (eth1) interface does not come up when you first boot up the firewall. + +**Workaround:** Reboot the firewall. + +## PAN-114495 + +Alibaba Cloud runs on a KVM hypervisor and supports two Virtio modes: DPDK (default) and MMAP. If you deploy a VM-Series firewall running PAN-OS 9.0 in DPDK packet mode and you then switch to MMAP packet mode, the VM-Series firewall duplicates packets that originate from or terminate on the firewall. As an example, if a load balancer or a server behind the firewall pings the VM-Series firewall after you switch from DPDK packet mode to MMAP packet mode, the firewall duplicates the ping packets. + +Throughput traffic is not duplicated if you deploy the VM-Series firewall using MMAP packet mode. + +## PAN-112694 + +```caveat +Firewalls with multiple virtual systems only +``` + +If you configure dynamic DNS (DDNS) on a new interface (associated with vsys1 or another virtual system) and you then create a **New** Certificate Profile from the drop-down, you must set the location for the Certificate Profile to Shared. If you configure DDNS on an existing interface and then create a new Certificate Profile, we also recommend that you choose the Shared location instead of a specific virtual system. Alternatively, you can select a preexisting certificate profile instead of creating a new one. + +## PAN-112456 + +You can temporarily submit a change request for a URL Category with three suggested categories; however, only two categories are supported. Do not add more than two suggested categories to a change request until we address this issue. If you submit more than two suggested categories, only the first two categories in the change request are evaluated. + +## PAN-112135 + +You cannot unregister tags for a subnet or range in a dynamic address group from the web interface. + +**Workaround:** Use an XML API request to unregister the tags for the subnet or range. + +## PAN-111928 + +Invalid configuration errors are not displayed as expected when you revert a Panorama management server configuration. + +**Workaround:** After you revert the Panorama configuration, **Commit** (**Commit** > **Commit to Panorama**) the reverted configuration to display the invalid configuration errors. + +## PAN-111866 + +The push scope selection on the Panorama web interface displays incorrectly even though the commit scope displays as expected. This issue occurs when one administrator makes configuration changes to separate device groups or templates that affect multiple firewalls and a different administrator attempts to push those changes. + +**Workaround:** Perform one of the following tasks. + +- Initiate a **Commit to Panorama** operation followed by a **Push to Devices** operation for the modified device group and template configurations. +- Manually select the devices that belong to the modified device group and template configurations. + +## PAN-111729 + +If you disable DPDK mode and enable it again, you must immediately reboot the firewall. + +## PAN-111670 + +Tagged VLAN traffic fails when sent through an SR-IOV adapter. + +## PAN-110794 + +DGA-based threats shown in the firewall threat log display the same name for all such instances. + +## PAN-109526 + +The system log does not correctly display the URL for CRL files; instead, the URLs are displayed with encoded characters. + +## PAN-104780 + +If you configure a HIP object to match only when a connecting endpoint is managed (**Objects** > **GlobalProtect** > **HIP Objects** > **** > **General** > **Managed**), iOS and Android endpoints that are managed by AirWatch are unable to successfully match the HIP object and the HIP report incorrectly indicates that these endpoints are not managed. This issue occurs because GlobalProtect gateways cannot correctly identify the managed status of these endpoints. + +Additionally, iOS endpoints that are managed by AirWatch are unable to match HIP objects based on the endpoint serial number because GlobalProtect gateways cannot identify the serial numbers of these endpoints; these serial numbers do not appear in the HIP report. + +## PAN-103276 + +Adding a disk to a virtual appliance running Panorama 8.1 or a later release on VMware ESXi 6.5 update1 causes the Panorama virtual appliance and host web client to become unresponsive. + +**Workaround:** Upgrade the ESXi host to ESXi 6.5 update2 and add the disk again. + +## PAN-101688 + +```caveat +Panorama plugins +``` + +The IP address-to-tag mapping information registered on a firewall or virtual system is not deleted when you remove the firewall or virtual system from a Device Group. + +**Workaround:** Log in to the CLI on the firewall and enter the following command to unregister the IP address-to-tag mappings: `debug object registered-ip clear all`. + +## PAN-101537 + +After you configure and push address and address group objects in Shared and vsys-specific device groups from the Panorama management server to managed firewalls, executing the `show log direction equal | in ` command on a managed firewall only returns address and address group objects pushed form the Shared device group. + +**Workaround:** Specify the vsys in the query string: + +`admin>` `set system target-vsys ` + +`admin>` `show log direction equal query equal ‘vsys eq ’ | in ` + +## PAN-98520 + +When booting or rebooting a PA-7000 Series Firewall with the SMC-B installed, the BIOS console output displays attempts to connect to the card's controller in the System Memory Speed section. The messages can be ignored. + +## PAN-97757 + +GlobalProtect authentication fails with an `Invalid username/password` error (because the user is not found in **Allow List**) after you enable GlobalProtect authentication cookies and add a RADIUS group to the **Allow List** of the authentication profile used to authenticate to GlobalProtect. + +**Workaround:** Disable GlobalProtect authentication cookies. Alternatively, disable (clear) **Retrieve user group from RADIUS** in the authentication profile and configure group mapping from Active Directory (AD) through LDAP. + +## PAN-97524 + +```caveat +Panorama management server only +``` + +The Security Zone and Virtual System columns (**Network** tab) display `None` after a Device Group and Template administrator with read-only privileges performs a context switch. + +## PAN-96446 + +A firewall that is not included in a Collector Group fails to generate a system log if logs are dropped when forwarded to a Panorama management server that is running in Management Only mode. + +## PAN-95773 + +On VM-Series firewalls that have Data Plane Development Kit (DPDK) enabled and that use the i40e network interface card (NIC), the `show session info` CLI command displays an inaccurate throughput and packet rate. + +**Workaround:** Disable DPDK by running the `set system setting dpdk-pkt-io off` CLI command. + +## PAN-95028 + +For administrator accounts that you created in PAN-OS 8.0.8 and earlier releases, the firewall does not apply password profile settings (**Device** > **Password Profiles**) until after you upgrade to PAN-OS 8.0.9 or a later release and then only after you modify the account passwords. (Administrator accounts that you create in PAN-OS 8.0.9 or a later release do not require you to change the passwords to apply password profile settings.) + +## PAN-94846 + +When DPDK is enabled on the VM-Series firewall with i40e virtual function (VF) driver, the VF does not detect the link status of the physical link. The VF link status remains up, regardless of changes to the physical link state. + +## PAN-94093 + +HTTP Header Insertion does not work when jumbo frames are received out of order. + +## PAN-93968 + +The firewall and Panorama web interfaces display vulnerability threat IDs that are not available in PAN-OS 9.0 releases (**Objects** > **Security Profiles** > **Vulnerability Protection** > **** > **Exceptions**). To confirm whether a particular threat ID is available in your release, monitor the release notes for each new Applications and Threats content update or check the Palo Alto Networks [Threat Vault](https://threatvault.paloaltonetworks.com) to see the minimum PAN-OS release version for a threat signature. + +## PAN-93607 + +When you configure a VM-500 firewall with an SCTP Protection profile (**Objects** > **Security Profiles** > **SCTP Protection**) and you try to add the profile to an existing Security Profile Group (**Objects** > **Security Profile Groups**), the Security Profile Group doesn’t list the SCTP Protection profile in its drop-down list of available profiles. + +**Workaround:** Create a new Security Profile Group and select the SCTP Protection profile from there. + +## PAN-93532 + +When you configure a firewall running PAN-OS 9.0 as an nCipher HSM client, the web interface on the firewall displays the nCipher server status as Not Authenticated, even though the HSM state is up (**Device** > **Setup** > **HSM**). + +## PAN-93193 + +The memory-optimized VM-50 Lite intermittently performs slowly and stops processing traffic when memory utilization is critically high. To prevent this issue, make sure that you do not: + +- Switch to the firewall **Context** on the Panorama management server. +- Commit changes when a dynamic update is being installed. +- Generate a custom report when a dynamic update is being installed. +- Generate custom reports during a commit. + +**Workaround:** When the firewall performs slowly, or you see a critical System log for memory utilization, wait for 5 minutes and then manually reboot the firewall. + +Use the Task Manager to verify that you are not performing memory intensive tasks such as installing dynamic updates, committing changes or generating reports, at the same time, on the firewall. + +## PAN-91802 + +On a VM-Series firewall, the **clear session all** CLI command does not clear GTP sessions. + +## PAN-83610 + +In rare cases, a PA-5200 Series firewall (with an FE100 network processor) that has session offload enabled (default) incorrectly resets the UDP checksum of outgoing UDP packets. + +**Workaround:** In PAN-OS 8.0.6 and later releases, you can persistently disable session offload for only UDP traffic using the `set session udp-off load no` CLI command. + +## PAN-83236 + +The VM-Series firewall on Google Cloud Platform does not publish firewall metrics to Google Stack Monitoring when you manually configure a DNS server IP address (**Device** > **Setup** > **Services**). + +**Workaround:** The VM-Series firewall on Google Cloud Platform must use the DNS server that Google provides. + +## PAN-83215 + +SSL decryption based on ECDSA certificates does not work when you import the ECDSA private keys onto an nCipher nShield hardware security module (HSM). + +## PAN-81521 + +Endpoints failed to authenticate to GlobalProtect through Kerberos when you specify an FQDN instead of an IP address in the Kerberos server profile (**Device** > **Server Profiles** > **Kerberos**). + +**Workaround:** Replace the FQDN with the IP address in the Kerberos server profile. + +## PAN-77125 + +PA-7000 Series, PA-5450, PA-5200 Series, and PA-3200 Series firewalls configured in tap mode don’t close offloaded sessions after processing the associated traffic; the sessions remain open until they time out. + +**Workaround:** Configure the firewalls in virtual wire mode instead of tap mode, or disable session offloading by running the `set session off load no` CLI command. + +## PAN-75457 + +In WildFire appliance clusters that have three or more nodes, the Panorama management server does not support changing node roles. In a three-node cluster for example, you cannot use Panorama to configure the worker node as a controller node by adding the HA and cluster controller configurations, configure an existing controller node as a worker node by removing the HA configuration, and then commit and push the configuration. Attempts to change cluster node roles from Panorama results in a validation error—the commit fails and the cluster becomes unresponsive. + +## PAN-73530 + +The firewall does not generate a packet capture (pcap) when a Data Filtering profile blocks files. + +## PAN-73401 + +When you import a two-node WildFire appliance cluster into the Panorama management server, the controller nodes report their state as out-of-sync if either of the following conditions exist: + +- You did not configure a worker list to add at least one worker node to the cluster. (In a two-node cluster, both nodes are controller nodes configured as an HA pair. Adding a worker node would make the cluster a three-node cluster.) +- You did not configure a service advertisement (either by enabling or not enabling advertising DNS service on the controller nodes). + +**Workaround:** There are three possible workarounds to sync the controller nodes: + +- After you import the two-node cluster into Panorama, push the configuration from Panorama to the cluster. After the push succeeds, Panorama reports that the controller nodes are in sync. +- Configure a worker list on the cluster controller: + admin@wf500(active-controller)# `set deviceconfig cluster mode controller worker-list ` + (`` is the IP address of the worker node you are adding to the cluster.) This creates a three-node cluster. After you import the cluster into Panorama, Panorama reports that the controller nodes are in sync. When you want the cluster to have only two nodes, use a different workaround. +- Configure service advertisement on the local CLI of the cluster controller and then import the configuration into Panorama. The service advertisement can advertise that DNS is or is not enabled. + admin@wf500(active-controller)# `set deviceconfig cluster mode controller service-advertisement dns-service enabled yes` + or + admin@wf500(active-controller)# `set deviceconfig cluster mode controller service-advertisement dns-service enabled no` + Both commands result in Panorama reporting that the controller nodes are in sync. + +## PAN-70906 + +If the PAN-OS web interface and the GlobalProtect portal are enabled on the same IP address, then when a user logs out of the GlobalProtect portal, the administrative user is also logged out from the PAN-OS web interface. + +**Workaround:** Use the IP address to access the PAN-OS web interface and an FQDN to access the GlobalProtect portal. + +## PAN-69505 + +When viewing an external dynamic list that requires client authentication and you **Test Source URL**, the firewall fails to indicate whether it can reach the external dynamic list server and returns a URL access error (**Objects** > **External Dynamic Lists**). + +## PAN-40079 + +The VM-Series firewall on KVM, for all supported Linux distributions, does not support the Broadcom network adapters for PCI pass-through functionality. + +## PAN-39636 + +Regardless of the **Time Frame** you specify for a scheduled custom report on a Panorama M-Series appliance, the earliest possible start date for the report data is effectively the date when you configured the report (**Monitor** > **Manage Custom Reports**). For example, if you configure the report on the 15th of the month and set the **Time Frame** to **Last 30 Days**, the report that Panorama generates on the 16th will include only data from the 15th onward. This issue applies only to scheduled reports; on-demand reports include all data within the specified **Time Frame**. + +**Workaround:** To generate an on-demand report, click **Run Now** when you configure the custom report. + +## PAN-38255 + +When you perform a factory reset on a Panorama virtual appliance and configure the serial number, logging does not work until you reboot Panorama or execute the `debug software restart process management-server` CLI command. + +## PAN-31832 + +The following issues apply when configuring a firewall to use a hardware security module (HSM): + +- **nCipher nShield Connect**—The firewall requires at least four minutes to detect that an HSM was disconnected, causing SSL functionality to be unavailable during the delay. +- **SafeNet Network**—When losing connectivity to either or both HSMs in an HA configuration, the display of information from the `show high-availability state` and `show hsm info` commands are blocked for 20 seconds. diff --git a/web/data/issues/PAN-OS/known/10.1.8_2026-03-16.md b/web/data/issues/PAN-OS/known/10.1.8_2026-03-16.md new file mode 100644 index 0000000..3c3134d --- /dev/null +++ b/web/data/issues/PAN-OS/known/10.1.8_2026-03-16.md @@ -0,0 +1,932 @@ +--- +type: Known +product: PAN-OS +version: 10.1.8 +source: common-crawl +crawl: CC-MAIN-2026-12 +--- + +## APL-15000 + +When you move a firewall from one Strata Logging Service instance to another, it can take up to an hour for the firewall to begin sending logs to the new instance. + +## APL-8269 + +For data retrieved from Strata Logging Service, the Threat Name column in **Panorama** > **ACC** > **threat-activity** appears blank. + +## PLUG-380 + +When you rename a device group, template, or template stack in Panorama that is part of a VMware NSX service definition, the new name is not reflected in NSX Manager. Therefore, any ESXi hosts that you add to a vSphere cluster are not added to the correct device group, template, or template stack and your Security policy is not pushed to VM-Series firewalls that you deploy after you rename those objects. There is no impact to existing VM-Series firewalls. + +## WF500-5559 + +An intermittent error while analyzing signed PE samples on the WildFire appliance might cause analysis failures. + +## WF500-5471 + +After using the firewall CLI to add a WildFire appliance with an IPv6 address, the initial connection may fail. + +**Workaround:** Retry connecting after you restart the web server with the following command: `debug software restart process web-server`. + +## PAN-281370 + +The Advanced WildFire Inline ML models **OOXML** and **Mach-O** erroneously display as being available from the CLI; however, they are only available on PAN-OS 11.1.3 and later releases. + +## PAN-260851 + +From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (**Objects** > **Applications**) tag. + +## PAN-228273 + +On the Panorama management server in FIPS-CC mode, the ElasticSearch cluster fails to come up and the `show log-collector-es-cluster health` command displays the `status` is `red`. This results in log ingestion issues for Panorama in Panorama only or Log Collector mode. + +## PAN-227344 + +On the Panorama management server, PDF Summary Reports (**Monitor** > **PDF Reports** > **Manage PDF Summary**) display no data and are blank when predefined reports are included in the summary report. + +## PAN-223488 + +```caveat +This issue is now resolved. See PAN-OS 10.1.12 Addressed Issues. +``` + +Closed ElasticSearch shards are not deleted from a Panorama M-Series or virtual appliance. This causes the ElasticSearch shard purging to not work as expected, resulting in high disk usage. + +## PAN-223365 + +The Panorama management server is unable to query any logs if the ElasticSearch health status for any Log Collector (**Panorama** > **Managed Collector** is degraded. + +**Workaround:** [Log in to the Log Collector CLI](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli) and restart ElasticSearch. + +`admin``debug elasticsearch es-restart all` + +## PAN-219644 + +```caveat +This issue is now resolved. See PAN-OS 10.1.12 Addressed Issues. +``` + +Firewalls forwarding logs to a syslog server over TLS (**Objects** > **Log Forwarding**) use the default Palo Alto Networks certificate instead of the custom certificate configured on the firewall. + +## PAN-218521 + +The ElasticSearch process on the M-600 appliance in Log Collector mode may enter a continuous reboot cycle. This results in the M-600 appliance becoming unresponsive, consuming logging disk space, and preventing new log ingestion. + +## PAN-217307 + +```caveat +This issue is now resolved. See PAN-OS 10.1.14 Addressed Issues. +``` + +The following Security policy rule (**Policies** > **Security**) filters return no results: + +`log-start eq no` + +`log-end eq no` + +`log-end eq yes` + +## PAN-216214 + +For Panorama-managed firewalls in an Active/Active High Availability (HA) configuration where you configure the firewall HA settings (**Device** > **High Availability**) in a template or template stack (**Panorama** > **Templates**), performing a local commit on one of the HA firewalls triggers an HA config sync on the peer firewall. This causes the HA peer configuration to go `Out of Sync`. + +## PAN-213746 + +On the Panorama management server, the **Hostkey** displayed as `undefined undefined` if you override an SSH Service Profile (**Device** > **Certificate Management** > **SSH Service Profile**) Hostkey configured in a Template from the Template Stack. + +## PAN-212889 + +```caveat +This issue is now resolved. See PAN-OS 10.1.11 Addressed Issues. +``` + +On the Panorama management server, different threat names are used when querying the same threat in the Threat Monitor (**Monitor** > **App Scope** > **Threat Monitor**) and **ACC**. This results in the ACC displaying `no data to display` when you are redirected to the ACC after clicking a threat name in the Threat Monitor and filtering the same threat name in the Global Filters. + +## PAN-208325 + +```caveat +This issue is now resolved. See PAN-OS 10.1.10 Addressed Issues. +``` + +The following NextGen firewalls are unable to automatically renew the device certificate (**Device** > **Setup** > **Management** or **Panorama** > **Setup** > **Management**). + +- PA-410 Firewall +- PA-440, PA-450, and PA-460 Firewalls +- PA-5450 Firewall + +**Workaround:** Log in to the [firewall CLI](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-cli-quick-start/get-started-with-the-cli/access-the-cli) and fetch the device certificate. + +`admin>``request certificate fetch` + +## PAN-208189 + +```caveat +This issue is now resolved. See PAN-OS 10.1.9-h3 Addressed Issuesand PAN-OS 10.1.10 Addressed Issues. +``` + +Traffic fails to match and reach all destinations if a Security policy rule includes FQDN objects that resolve to two or more IP addresses. + +## PAN-206268 + +```caveat +This issue is now resolved. See PAN-OS 10.1.10 Addressed Issues. +``` + +On the Panorama management server, the Auth Key field was erroneously displayed when you configure the Panorama Settings (**Device** > **Setup** > **Management**) as part of a template or template stack configuration. + +## PAN-206243 + +```caveat +This issue is now resolved. See PAN-OS 10.1.9 Addressed Issues. +``` + +The PA-220 firewall reaches the maximum disk usage capacity multiple a day that requires a disk cleanup. A critical system log (**Monitor** > **Logs** > **System**) is generated each time the firewall reaches maximum disk usage capacity. + +## PAN-205187 + +ElasticSearch may not start properly when a newly installed Panorama virtual appliance powers on for the first time, resulting in the Panorama virtual appliance being unable to query logs forwarded from the managed firewall to a Log Collector. + +**Workaround:** [Log in to the Panorama CLI](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli) and start the PAN-OS software. + +`admin>``request restart software` + +## PAN-202339 + +```caveat +This issue is now resolved. See PAN-OS 10.1.9 Addressed Issues. +``` + +The VM-Series firewall on AWS might display reduced throughput of SSL traffic. + +## PAN-201855 + +On the Panorama management server, cloning any template (**Panorama** > **Templates**) corrupts certificates (**Device** > **Certificate Management** > **Certificates**) with the **Block Private Key Export** setting enabled across all templates. This results in managed firewalls experiencing issues wherever the corrupted certificate is referenced. + +For example, you have template A, B, and C where templates A and B have certificates with the **Block Private Key Export** setting enabled. Cloning template C corrupts the certificates with **Block Private Key Export** setting enabled in templates A and B. + +**Workaround:** After cloning a template, delete and re-import the corrupted certificates. + +## PAN-199557 + +On M-600 appliances in an Active/Passive high availability (HA) configuration, the `configd` process restarts due to a memory leak on the `Active` Panorama HA peer. This causes the Panorama web interface and CLI to become unresponsive. + +**Workaround:** Manually reboot the `Active` Panorama HA peer. + +## PAN-198174 + +When viewing traffic or threat logs from the firewall ACC or Monitor, performing a reverse DNS lookup, for example, when resolving IP addresses to domain names using the **Resolve Hostname** feature, can cause the appliance to crash and restart if DNS server settings have not been configured. + +**Workaround:** Provide a DNS server setting for the firewall (**Device** > **DNS Setup** > **Services**). If you cannot reference a valid DNS server, you can add a dummy address. + +## PAN-197341 + +On the Panorama management server, if you create multiple device group **Objects** with the same name in the Shared device group and any additional device groups (**Panorama** > **Device Groups**) under the same device group hierarchy that are used in one or more **Policies**, renaming the object with a shared name in any device group causes the object name to change in the policies where it is used. This issue applies only to device group objects that can be referenced in a Security policy rule. + +For example: + +1. You create a parent device group `DG-A` and a child device group `DG-B`. +2. You create address objects called `AddressObjA` in the `Shared`, `DG-A` and `DG-B` device groups and add `AddressObjA` to a Security policy rule under `DG-A` and `DG-B`. +3. Later, you change the `AddressObjA` name in the `Shared` device group to `AddressObjB`. + +Changing the name of the address object in the `Shared` device group causes the references in the Policy rule to use the renamed `Shared` object instead of the device group object. + +## PAN-197097 + +```caveat +This issue is now resolved. See PAN-OS 10.1.9 Addressed Issues. +``` + +Large Scale VPN (LSVPN) does not support IPv6 addresses on the satellite firewall. + +## PAN-196758 + +On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you **Preview Changes** (**Commit** > **Push to Devices** > **Edit Selections** or **Commit** > **Commit and Push** > **Edit Selections**). + +## PAN-194519 + +```caveat +PA-5450 firewall only +``` + +Trying to configure a custom payload format under **Device** > **Server Profiles** > **HTTP** yields a Javascript error. + +## PAN-194515 + +```caveat +PA-5450 firewall only +``` + +The Panorama web interface does not display any predefined template stack variables in the dropdown menu under **Device** > **Setup** > **Log Interface** > **IP Address**. + +**Workaround:** Configure the log interface IP address on the individual firewall web interface instead of on Panorama. + +## PAN-194424 + +```caveat +PA-5450 firewall only +``` + +Upgrading to PAN-OS 10.1.6-h2 while having a log interface configured can cause both the log interface and the management interface to remain connected to the log collector. + +**Workaround:** Restart the log receiver service by running the following CLI command: + +`debug software restart process log-receiver` + +## PAN-194202 + +```caveat +PA-5450 firewall only +``` + +If the management interface and Log Collector are configured on the same subnetwork, the firewall conducts log forwarding using the management interface instead of the logging interface. + +## PAN-193518 + +All logs (**Monitor** > **Logs**) generated by a firewall running a PAN-OS 10.0 release are not accessible if you downgrade from PAN-OS 10.1 to PAN-OS 10.0, and then upgrade back to PAN-OS 10.1. + +**Workaround:** If you need to downgrade from PAN-OS 10.1 to PAN-OS 10.0 and then back to PAN-OS 10.1, downgrade to PAN-OS 10.0.11 to ensure that all logs ingested while running a PAN-OS 10.0 release remain accessible after upgrade back to PAN-OS 10.1. + +## PAN-189057 + +```caveat +HA configuration +``` + +On the Panorama management server, Panorama enters a `non-functional` state due to `php.debug.log` life taking up too much space. + +**Workaround:** Disable the debug flag for Panorama. + +1. [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface). +2. In the same browser you are logged into the Panorama web interface, enter the following URL. + `https:///debug` +3. Uncheck (disable) **Debug** or **Clear Debug**. +4. () Repeat this step on each Panorama high availability (HA) peer if Panorama is in a HA configuration. + +## PAN-188052 + +Devices in FIPS-CC mode are unable to connect to servers utilizing ECDSA-based host keys that impacts exporting logs (**Device** > **Scheduled Log Export**), exporting configurations (**Device** > **Scheduled Config Export**), or the `scp export` command in the CLI. + +**Workaround:** Use RSA-based host keys on the destination server. + +## PAN-187685 + +On the Panorama management server, the Template Status displays no synchronization status (**Panorama** > **Managed Devices** > **Summary**) after a bootstrapped firewall is successfully added to Panorama. + +**Workaround:** After the bootstrapped firewall is successfully added to Panorama, [log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) and select **Commit** > **Push to Devices**. + +## PAN-179888 + +On the Panorama management server, the number of managed firewall (**Panorama** > **Managed Devices** > **Health**) `Power Supplies` displays an incorrect count of power supplies. + +## PAN-174982 + +In HA active/active configurations where, when interfaces that were associated with a virtual router were deleted, the configuration change did not sync. + +## PAN-172274 + +When you activate the advanced URL filtering license, your license entitlements for PAN-DB and advanced URL filtering might not display correctly on the firewall — this is a display anomaly, not a licensing issue, and does not affect access to the services. + +**Workaround:** Issue the following command to retrieve and update the licenses: `license request fetch`. + +## PAN-172113 + +If you request a User Activity Report on Panorama and the vsys key value in the XML is an unsupported value, the resulting job becomes unresponsive at 10% and does not complete until you manually stop the job in the web interface. + +**Workaround:**Change the vsys key to a valid device group, commit your changes, and run the User Activity Report again. + +## PAN-172067 + +When you configure an HTTP server profile (**Device** > **Server Profiles** > **HTTP** or **Panorama** > **Server Profiles** > **HTTP**), the **Username** and **Password** fields are always required regardless of whether **Tag Registration** is enabled. + +**Workaround:** When you configure an HTTP server profile, always enter a username and password to successfully create the HTTP server profile. + +You must enter a username and password even if the HTTP server does not require it. The HTTP server ignores the username and password if they are not required for the firewall to connect. + +## PAN-172061 + +A process (`all_pktproc`) can cause intermittent crashes on the Passive PA-5450 firewall in an Active/Passive HA pair. This issue may be seen during an upgrade or reload of the firewall with traffic and when clearing sessions. + +## PAN-171938 + +No results are displayed when you **Show Application Filter** for a Security policy rule (**Policies** > **Security** > **Application** > **Value** > **Show Application Filter**). + +## PAN-171723 + +If you use Panorama to push a configuration that uses App-ID Cloud Engine (ACE) App-IDs and then you downgrade the firewall from PAN-OS 10.1 to PAN-OS 10.0, the installation succeeds but after you reboot, the auto-commit fails. + +**Workaround:** Remove all ACE application configurations before downgrading. + +## PAN-171706 + +```caveat +This issue is now resolved. See PAN-OS 10.1.11 Addressed Issues. +``` + +If you are using Panorama to manage firewalls with multiple virtual systems and the virtual system that is the User-ID hub uses an alias, the local commit on Panorama is successful but the commit to the firewall fails. + +## PAN-171673 + +On the Panorama management server, the **ACC** returns inaccurate results when you filter for **New App-ID** in the **Application** usage widget. + +## PAN-171635 + +If you have an on-premise Active Directory and there is an existing group mapping configuration on the firewall, if you migrate the group mapping to the Cloud Identity Engine, the firewall does not remove the existing group mapping even if the configuration is disabled and the firewall is rebooted, which may conflict with new mappings from the Cloud Identity Engine. + +**Workaround**: Use the debug user-id clear domain-map command to remove the existing group mappings from the firewall. + +## PAN-171224 + +On the Panorama management server, a custom report (**Monitor** > **Managed Custom Reports**) with a high volume of unique data objects is not generated when you click **Run Now**. + +## PAN-171145 + +If you edit or remove the value for the `mail` attribute in your on-premise Active Directory, the changes may not be immediately reflected on the firewall after it syncs with the Cloud Identity Engine. + +## PAN-170923 + +In **Policies** > **Security** > **Policy Optimizer** > **New App Viewer**, when you select a Security policy rule in the bottom portion of the screen, the application data in the application browser (top portion of screen) does not match the Apps Seen on the selected rule. In addition, filtering in the application browser based on Apps Seen does not work. + +## PAN-170270 + +Using the CLI to power on a PA-5450 Networking Card (NC) in an Active HA firewall can cause its Passive peer to temporarily go down. + +## PAN-169906 + +The CN-Series Firewall as a Kubernetes Service does not support AF_XDP when deployed in CentOS. + +## PAN-168636 + +Connecting to the App-ID Cloud Engine (ACE) cloud using a management port with explicit proxy configured on it is not supported. Instead, use a data plane interface for the service route ([Prepare to Deploy App-ID Cloud Engine](https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/app-id/cloud-based-app-id-service/prepare-to-deploy-app-id-cloud-engine.html) describes how to do this.) + +## PAN-168113 + +On the Panorama management server, you are unable to configure a master key (**Device** > **Master Key and Diagnostics**) for a managed firewall if an interface (**Network** > **Interfaces** > **Ethernet**) references a zone pushed from Panorama. + +**Workaround:** Remove the referenced zone from the interface configuration to successfully configure a master key. + +## PAN-167847 + +If you issue the command `opof stats`, then clear the results {opof stats -c}, the Active Sessions value is sometimes invalid. For example, you might see a negative number or an excessively large number. + +**Workaround:** Re-run the `opof stats` command after the offload completes. + +## PAN-167401 + +When a firewall or Panorama appliance configured with a proxy is upgraded to PAN-OS 10.0.3 or a later release, it fails to connect to edge service. + +## PAN-165669 + +If you configure a group that the firewall retrieves from the Cloud Identity Engine as the `user in` value in a filter query, Panorama is unable to retrieve the group membership and as a result, is unable to display this data in logs and custom reports. + +## PAN-164922 + +On the Panorama management server, a context switch to a managed firewall running a PAN-OS 8.1.0 to 8.1.19 release fails. + +## PAN-164885 + +```caveat +This issue is now resolved. See PAN-OS 10.1.14-h6 Addressed Issues +``` + +On the Panorama management server, pushes to managed firewalls (**Commit** > **Push to Devices** or **Commit and Push**) may fail when an EDL (**Objects** > **External Dynamic Lists**) is configured to **Check for updates** every 5 minutes due to the commit and EDL fetch processes overlapping. This is more likely to occur when multiple EDLs are configured to check for updates every 5 minutes. + +## PAN-164841 + +A successful deployment of a Panorama virtual appliance on Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform (GCP) is inaccessible when deploying using the PAN-OS 10.1.0-b6 release. + +## PAN-164647 + +On the Panorama management server, activating a license (**Panorama** > **Device Deployment** > **Licenses**) on managed firewalls in a high availability (HA) configuration causes the Safari web browser to become unresponsive. + +**Workaround:** [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) from a web browser other than Safari to successfully activate a license on managed firewalls in an HA configuration. + +## PAN-164618 + +The VM-Series firewall CLI and system logs display the license name `VM-SERIES-X`, while the user interface displays `VM-FLEX-X` (in both cases `X` is the number of vCPUs). In future releases the user interface will use the `VM-SERIES-X` format. + +## PAN-164586 + +If you use a value other than `mail` for the user or group email attribute in the Cloud Identity Engine, it displays in `user@domain` format in the CLI output. + +## PAN-163966 + +On the Panorama management server, the **ACC** and on demand reports (**Monitor** > **Manage Custom Reports**) are unable to fetch Directory Sync group membership when the Source User Group filter query is applied, resulting in no data being displayed for the filter when Directory Sync is configured as the Source User for a policy rule. + +## PAN-162836 + +On the VM-Series firewall, if you select **Device** > **Licenses** > **Deactivate VM** a popup window opens and you can choose **Subscriptions** or **Support** and press **Continue** to remove licenses and register the changes with the license server. When the license removal is complete the **Deactivate VM** window does not update its text to exclude deactivated licenses or close the window. + +**Workaround**: Wait until the license deactivation is complete, and click **Cancel** to close the window. + +## PAN-162088 + +```caveat +This issue is now resolved. See PAN-OS 10.1.9 Addressed Issues. +``` + +On the Panorama management server in a high availability (HA) configuration, content updates (**Panorama** > **Dynamic Updates**) manually uploaded to the active HA peer are not synchronized to the passive HA peer when you **Install** a content update and enable **Sync to HA Peer**. + +## PAN-161666 + +The firewall includes any users configured in the Cloud Identity Engine in the count of groups. As a result, some CLI command output does not accurately display the number of groups the firewall has retrieved from the Cloud Identity Engine and counts users as groups in the `No. of Groups` in the command output. If the attempt to retrieve the user or group fails, the information for the user or group still displays in the CLI command output. + +## PAN-161451 + +If you issue the command `opof stats`, there are occasional zero packet and byte counts coming from the DPDK counters. This occurs when a session is in the tcp-reuse state, and has no impact on the existing session. + +## PAN-160238 + +If you migrate traffic from a firewall running a PAN-OS version earlier than 9.0 to a firewall running PAN-OS 9.0 or later, you experience intermittent VXLAN packet drops if TCI policy is not configured for inspecting VXLAN traffic flows. + +**Workaround:**On the new firewall, create an app override for VXLAN outer headers as described in [What is an Application Override?](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVLCA0) and the video tutorial [How to Configure an Application Override Policy on the Palo Alto Networks Firewall](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PPDrCAO). + +PAN-OS version 9.0 can inspect both inner and outer VXLAN flows. If you want to inspect inner flows, you must define a tunnel content inspection (TCI) policy. + +## PAN-157444 + +As a result of a telemetry handling update, the Source Zone field in the DNS analytics logs (viewable in the DNS Analytics tab within AutoFocus) might not display correct results. + +## PAN-157327 + +On downgrade to PAN-OS 9.1, Enterprise Data Loss Prevention (DLP) filtering settings (**Device** > **Setup** > **DLP**) are not removed and cause commit errors for the downgraded firewall if you do not uninstall the Enterprise DLP plugin before downgrade. + +**Workaround:** After you successfully downgrade a managed firewall to PAN-OS 9.1, commit and push from Panorama to remove the Enterprise DLP filtering settings and complete the downgrade. + +1. Downgrade your managed firewall to PAN-OS 9.1 +2. Log in to the firewall web interface and view the **Tasks** to verify all auto commits related to the downgrade have completed successfully. +3. Log in to the Panorama web interface and **Commit** > **Commit and Push** to your managed firewall downgraded to PAN-OS 9.1. + +## PAN-157103 + +Multi-channel functionality may not be properly utilized on an VM-Series firewall deployed in VMware NSX-V after the service is first deployed. + +**Workaround**: Execute the command `debug dataplane pow status` to view the number of channels being utilized by the dataplane. + +Per pan-task Netx statisticsCounter Name 1 2 3 4 5 6 Total---------------------------------------------ready_dvf 2 0 0 0 0 0 2 + +If multi-channel functionality is not working, disable your NSX-V security policy and reapply it. Then reboot the VM-Series firewall. When the firewall is back up, verify that multi-channel functionality is working by executing the command `debug dataplane pow status`. It should now show multiple channels being utilized. + +Per pan-task Netx statisticsCounter Name 1 2 3 4 5 6 Total---------------------------------------------ready_dvf 1 1 0 0 0 0 2 + +## PAN-156598 + +```caveat +Panorama only +``` + +If you configure a standard custom vulnerability signature in a custom Vulnerability Protection profile in a shared device group, the shared profile custom signatures do not populate in the other device groups when you configure a combination custom vulnerability signature. + +**Workaround:** Use the CLI to update the combination signature. + +## PAN-154292 + +On the Panorama management server, downgrading from a PAN-OS 10.0 release to a PAN-OS 9.1 release causes Panorama commit (**Commit** > **Commit to Panorama**) failures if a custom report (**Monitor** > **Manage Custom Reports**) is configured to Group By **Session ID**. + +**Workaround:** After successful downgrade, reconfigure the Group By setting in the custom report. + +## PAN-154034 + +On the Panorama management server, the Type column in the System logs (**Monitor** > **Logs** > **System**) for managed firewalls running a PAN-OS 9.1 release erroneously display `iot` as the type. + +## PAN-154032 + +On the Panorama management server, downgrading to PAN-OS 9.1 with the Panorama plugin for Cisco TrustSec version 1.0.2 installed does not automatically transform the plugin to be compatible with PAN-OS 9.1 + +**Workaround:** After successful downgrade to PAN-OS 9.1, **Remove Config** (**Panorama** > **Plugins**) of the Panorama plugin for Cisco TrustSec and then reconfigure the plugin. + +## PAN-153803 + +On the Panorama management server, scheduled email PDF reports (**Monitor** > **PDF Reports**) fail if a GIF image is used in the header or footer. + +## PAN-153557 + +On the Panorama management server CLI, the overall report status for a report query is marked as `Done` despite reports generated from logs in the Strata Logging Service from the PODamericas Collector Group jobs are still in a `Running` state. + +## PAN-153068 + +The Bonjour Reflector option is supported on up to 16 interfaces. If you enable it on more than 16 interfaces, the commit succeeds and the Bonjour Reflector option is enabled only for the first 16 interfaces and ignored for any additional interfaces. + +## PAN-151238 + +There is a known issue where M-100 appliances are able to download and install a PAN-OS 10.0 release image even though the M-100 appliance is no longer supported after PAN-OS 9.1. (Refer to the [hardware end-of-life dates](https://www.paloaltonetworks.com/services/support/end-of-life-announcements/hardware-end-of-life-dates.html).) + +## PAN-151085 + +On a PA-7000 Series firewall chassis having multiple slots, when HA clustering is enabled on an active/active HA pair, the session table count for one of the peers can show a higher count than the actual number of active sessions on that peer. This behavior can be seen when the session is being set up on a non-cache slot (for example, when a session distribution policy is set to round-robin or session-load); it is caused by the additional cache lookup that happens when HA cluster participation is enabled. + +## PAN-150801 + +Automatic quarantine of a device based on forwarding profile or log setting does not work on the PA-7000 Series firewalls. + +## PAN-150515 + +After you install the device certificate on a new Panorama management server, Panorama is not able to connect to the IoT Security edge service. + +**Workaround:** Restart Panorama to connect to the IoT Security edge service. + +## PAN-150345 + +During updates to the Device Dictionary, the IoT Security service does not push new Device-ID attributes (such as new device profiles) to the firewall until a manual commit occurs. + +**Workaround:** Perform a force commit to push the attributes in the content update to the firewall. + +## PAN-150361 + +In an Active-Passive high availability (HA) configuration, an error displays if you create a device object on the passive device. + +**Workaround:** Load the running configuration and perform a force commit to sync the devices. + +## PAN-148971 + +If you enter a search term for Events that are related to IoT in the System logs and apply the filter, the page displays an `Invalid term` error. + +**Workaround:** Specify `iot` as the **Type Attribute** to filter the logs and use the search term as the **Description Attribute**. For example: `( subtype eq iot ) and ( description contains 'gRPC connection' )`. + +## PAN-148924 + +In an active-passive HA configuration, tags for dynamic user groups are not persistent after rebooting the firewall because the active firewall does not sync the tags to the passive firewall during failover. + +## PAN-146995 + +After downgrading a Panorama management server from PAN-OS 10.0 to PAN-OS 9.1, the `VLD` and `logd` processes may crash when Panorama reboots. + +**Workaround:** Panorama automatically restarts the `VLD` and `logd` processes. + +## PAN-146807 + +Changing the device group configured in a monitoring definition from a child DG to a parent DG, or vice versa, might cause firewalls configured in the child DG to lose IP tag mapping information received from the monitoring definition. Only firewalls assigned to the parent DG receive IP tag mapping updates. + +**Workaround**: Perform a manual config sync on the device group that lost the IP tag mapping information. + +## PAN-146485 + +On the Panorama management server, adding, deleting, or modifying the upstream NAT configuration (**Panorama** > **SD-WAN** > **Devices**) does not display the branch template stack as `out of sync`. + +Additionally, adding, deleting, or modifying the BGP configuration (**Panorama** > **SD-WAN** > **Devices**) does not display the hub and branch template stacks as `out of sync`. For example, modifying the BGP configuration on the branch firewall does not cause the hub template stack to display as `out of sync`, nor does modifying the BGP configuration on the hub firewall cause the branch template stack as `out of sync`. + +**Workaround:** After performing a configuration change, **Commit and Push** the configuration changes to all hub and branch firewalls in the VPN cluster containing the firewall with the modified configuration. + +## PAN-145460 + +CN-MGMT pods fail to connect to the Panorama management server when using the Kubernetes plugin. + +**Workaround:** **Commit** the Panorama configuration after the CN-MGMT pod successfully registers with Panorama. + +## PAN-144889 + +On the Panorama management server, adding, deleting, or modifying the original subnet IP, or adding a new subnet after you successfully configure a tunnel IP subnet, for the SD-WAN 1.0.2 plugin does not display the managed firewall templates (**Panorama** > **Managed Devices** > **Summary**) as `Out of Sync`. + +**Workaround**: When modifying the original subnet IP, or adding a new subnet, push the template configuration changes to your managed firewalls and **Force Template Values** (**Commit** > **Push to Devices** > **Edit Selections**). + +## PAN-143132 + +Fetching the device certificate from the Palo Alto Networks Customer Support Portal (CSP) may fail and displays the following error in the CLI: + +`ERROR Failed to process S1C msg: Error` + +**Workaround:** Retrying fetching the device certificate from the Palo Alto Networks CSP. + +## PAN-141630 + +Current performance limitation: single data plane use only. The PA-5200 Series and PA-7000 Series firewalls that support 5G network slice security, 5G equipment ID security, and 5G subscriber ID security use a single data plane only, which currently limits the firewall performance. + +## PAN-140959 + +The Panorama management server allows you to downgrade Zero Touch Provisioning (ZTP) firewalls to PAN-OS 9.1.2 and earlier releases where ZTP functionality is not supported. + +## PAN-140008 + +ElasticSearch is forced to restart when the `masterd` process misses too many heartbeat messages on the Panorama management server resulting in a delay in a log query and ingestion. + +## PAN-136763 + +On the Panorama management server, managed firewalls display as `disconnected` when installing a PAN-OS software update (**Panorama** > **Device Deployment** > **Software**) but display as `connected` when you view your managed firewalls Summary (**Panorama** > **Managed Devices** > **Summary**) and from the CLI. + +**Workaround:** Log out and log back in to the Panorama web interface. + +## PAN-135742 + +There is an issue in HTTP2 session decryption where the App-ID in the decryption log is the App-ID of the parent session (which is web-browsing). + +## PAN-134053 + +ACC does not filter WildFire logs from Dynamic User Groups. + +## PAN-132598 + +The Panorama management server does not check for duplicate addresses in address groups (**Objects** > **Address Groups**) and duplicate services in service groups (**Objects** > **Service Groups**) when created from the CLI. + +## PAN-130550 + +```caveat +PA-3200 Series, PA-5220, PA-5250, PA-5260, and PA-7000 Series firewalls +``` + +For traffic between virtual systems (inter-vsys traffic), the firewall cannot perform source NAT using dynamic IP (DIP) address translation. + +**Workaround:** Use source NAT with Dynamic IP and Port (DIPP) translation on inter-vsys traffic. + +## PAN-127813 + +In the current release, SD-WAN auto-provisioning configures hubs and branches in a hub and spoke model, where branches don’t communicate with each other. Expected branch routes are for generic prefixes, which can be configured in the hub and advertised to all branches. Branches with unique prefixes are not published up to the hub. + +**Workaround:** Add any specific prefixes for branches to the hub advertise-list configuration. + +## PAN-127206 + +If you use the CLI to enable the cleartext option for the Include Username in HTTP Header Insertion Entries feature, the authentication request to the firewall may become unresponsive or time out. + +## PAN-123277 + +Dynamic tags from other sources are accessible using the CLI but do not display on the Panorama web interface. + +## PAN-123040 + +When you try to view network QoS statistics on an SD-WAN branch or hub, the QoS statistics and the hit count for the QoS rules don’t display. A workaround exists for this issue. Please contact Support for information about the workaround. + +## PAN-120440 + +There is an issue on M-500 Panorama management servers where any ethernet interface with an IPv6 address having Private PAN-DB-URL connectivity only supports the following format: `2001:DB9:85A3:0:0:8A2E:370:2`. + +## PAN-120423 + +PAN-OS 10.0.0 does not support the XML API for GlobalProtect logs. + +## PAN-120303 + +There is an issue where the firewall remains connected to the PAN-DB-URL server through the old management IP address on the M-500 Panorama management server, even when you configured the Eth1/1 interface. + +**Workaround:** Update the PAN-DB-URL IP address on the firewall using one of the methods below. + +- Modify the PAN-DB Server IP address on the managed firewall. + 1. On the web interface, delete the **PAN-DB Server** IP address (**Device** > **Setup** > **Content ID** > **URL Filtering** settings). + 2. **Commit** your changes. + 3. Add the new M-500 Eth1/1 IP PAN-DB IP address. + 4. **Commit** your changes. +- Restart the firewall (devsrvr) process. + 1. Log in to the firewall CLI. + 2. Restart the devsrvr process: `debug software restart process device-server` + +## PAN-116017 + +```caveat +Google Cloud Platform (GCP) only +``` + +The firewall does not accept the DNS value from the initial configuration (init-cfg) file when you bootstrap the firewall. + +**Workaround:** Add DNS value as part of the bootstrap.xml in the bootstrap folder and complete the bootstrap process. + +## PAN-115816 + +```caveat +Microsoft Azure only +``` + +There is an intermittent issue where an Ethernet (eth1) interface does not come up when you first boot up the firewall. + +**Workaround:** Reboot the firewall. + +## PAN-114495 + +Alibaba Cloud runs on a KVM hypervisor and supports two Virtio modes: DPDK (default) and MMAP. If you deploy a VM-Series firewall running PAN-OS 9.0 in DPDK packet mode and you then switch to MMAP packet mode, the VM-Series firewall duplicates packets that originate from or terminate on the firewall. As an example, if a load balancer or a server behind the firewall pings the VM-Series firewall after you switch from DPDK packet mode to MMAP packet mode, the firewall duplicates the ping packets. + +Throughput traffic is not duplicated if you deploy the VM-Series firewall using MMAP packet mode. + +## PAN-112694 + +```caveat +Firewalls with multiple virtual systems only +``` + +If you configure dynamic DNS (DDNS) on a new interface (associated with vsys1 or another virtual system) and you then create a **New** Certificate Profile from the drop-down, you must set the location for the Certificate Profile to Shared. If you configure DDNS on an existing interface and then create a new Certificate Profile, we also recommend that you choose the Shared location instead of a specific virtual system. Alternatively, you can select a preexisting certificate profile instead of creating a new one. + +## PAN-112456 + +You can temporarily submit a change request for a URL Category with three suggested categories; however, only two categories are supported. Do not add more than two suggested categories to a change request until we address this issue. If you submit more than two suggested categories, only the first two categories in the change request are evaluated. + +## PAN-112135 + +You cannot unregister tags for a subnet or range in a dynamic address group from the web interface. + +**Workaround:** Use an XML API request to unregister the tags for the subnet or range. + +## PAN-111928 + +Invalid configuration errors are not displayed as expected when you revert a Panorama management server configuration. + +**Workaround:** After you revert the Panorama configuration, **Commit** (**Commit** > **Commit to Panorama**) the reverted configuration to display the invalid configuration errors. + +## PAN-111866 + +The push scope selection on the Panorama web interface displays incorrectly even though the commit scope displays as expected. This issue occurs when one administrator makes configuration changes to separate device groups or templates that affect multiple firewalls and a different administrator attempts to push those changes. + +**Workaround:** Perform one of the following tasks. + +- Initiate a **Commit to Panorama** operation followed by a **Push to Devices** operation for the modified device group and template configurations. +- Manually select the devices that belong to the modified device group and template configurations. + +## PAN-111729 + +If you disable DPDK mode and enable it again, you must immediately reboot the firewall. + +## PAN-111670 + +Tagged VLAN traffic fails when sent through an SR-IOV adapter. + +## PAN-110794 + +DGA-based threats shown in the firewall threat log display the same name for all such instances. + +## PAN-109526 + +The system log does not correctly display the URL for CRL files; instead, the URLs are displayed with encoded characters. + +## PAN-104780 + +If you configure a HIP object to match only when a connecting endpoint is managed (**Objects** > **GlobalProtect** > **HIP Objects** > **** > **General** > **Managed**), iOS and Android endpoints that are managed by AirWatch are unable to successfully match the HIP object and the HIP report incorrectly indicates that these endpoints are not managed. This issue occurs because GlobalProtect gateways cannot correctly identify the managed status of these endpoints. + +Additionally, iOS endpoints that are managed by AirWatch are unable to match HIP objects based on the endpoint serial number because GlobalProtect gateways cannot identify the serial numbers of these endpoints; these serial numbers do not appear in the HIP report. + +## PAN-103276 + +Adding a disk to a virtual appliance running Panorama 8.1 or a later release on VMware ESXi 6.5 update1 causes the Panorama virtual appliance and host web client to become unresponsive. + +**Workaround:** Upgrade the ESXi host to ESXi 6.5 update2 and add the disk again. + +## PAN-101688 + +```caveat +Panorama plugins +``` + +The IP address-to-tag mapping information registered on a firewall or virtual system is not deleted when you remove the firewall or virtual system from a Device Group. + +**Workaround:** Log in to the CLI on the firewall and enter the following command to unregister the IP address-to-tag mappings: `debug object registered-ip clear all`. + +## PAN-101537 + +After you configure and push address and address group objects in Shared and vsys-specific device groups from the Panorama management server to managed firewalls, executing the `show log direction equal | in ` command on a managed firewall only returns address and address group objects pushed form the Shared device group. + +**Workaround:** Specify the vsys in the query string: + +`admin>` `set system target-vsys ` + +`admin>` `show log direction equal query equal ‘vsys eq ’ | in ` + +## PAN-98520 + +When booting or rebooting a PA-7000 Series Firewall with the SMC-B installed, the BIOS console output displays attempts to connect to the card's controller in the System Memory Speed section. The messages can be ignored. + +## PAN-97757 + +GlobalProtect authentication fails with an `Invalid username/password` error (because the user is not found in **Allow List**) after you enable GlobalProtect authentication cookies and add a RADIUS group to the **Allow List** of the authentication profile used to authenticate to GlobalProtect. + +**Workaround:** Disable GlobalProtect authentication cookies. Alternatively, disable (clear) **Retrieve user group from RADIUS** in the authentication profile and configure group mapping from Active Directory (AD) through LDAP. + +## PAN-97524 + +```caveat +Panorama management server only +``` + +The Security Zone and Virtual System columns (**Network** tab) display `None` after a Device Group and Template administrator with read-only privileges performs a context switch. + +## PAN-96446 + +A firewall that is not included in a Collector Group fails to generate a system log if logs are dropped when forwarded to a Panorama management server that is running in Management Only mode. + +## PAN-95773 + +On VM-Series firewalls that have Data Plane Development Kit (DPDK) enabled and that use the i40e network interface card (NIC), the `show session info` CLI command displays an inaccurate throughput and packet rate. + +**Workaround:** Disable DPDK by running the `set system setting dpdk-pkt-io off` CLI command. + +## PAN-95028 + +For administrator accounts that you created in PAN-OS 8.0.8 and earlier releases, the firewall does not apply password profile settings (**Device** > **Password Profiles**) until after you upgrade to PAN-OS 8.0.9 or a later release and then only after you modify the account passwords. (Administrator accounts that you create in PAN-OS 8.0.9 or a later release do not require you to change the passwords to apply password profile settings.) + +## PAN-94846 + +When DPDK is enabled on the VM-Series firewall with i40e virtual function (VF) driver, the VF does not detect the link status of the physical link. The VF link status remains up, regardless of changes to the physical link state. + +## PAN-94093 + +HTTP Header Insertion does not work when jumbo frames are received out of order. + +## PAN-93968 + +The firewall and Panorama web interfaces display vulnerability threat IDs that are not available in PAN-OS 9.0 releases (**Objects** > **Security Profiles** > **Vulnerability Protection** > **** > **Exceptions**). To confirm whether a particular threat ID is available in your release, monitor the release notes for each new Applications and Threats content update or check the Palo Alto Networks [Threat Vault](https://threatvault.paloaltonetworks.com) to see the minimum PAN-OS release version for a threat signature. + +## PAN-93607 + +When you configure a VM-500 firewall with an SCTP Protection profile (**Objects** > **Security Profiles** > **SCTP Protection**) and you try to add the profile to an existing Security Profile Group (**Objects** > **Security Profile Groups**), the Security Profile Group doesn’t list the SCTP Protection profile in its drop-down list of available profiles. + +**Workaround:** Create a new Security Profile Group and select the SCTP Protection profile from there. + +## PAN-93532 + +When you configure a firewall running PAN-OS 9.0 as an nCipher HSM client, the web interface on the firewall displays the nCipher server status as Not Authenticated, even though the HSM state is up (**Device** > **Setup** > **HSM**). + +## PAN-93193 + +The memory-optimized VM-50 Lite intermittently performs slowly and stops processing traffic when memory utilization is critically high. To prevent this issue, make sure that you do not: + +- Switch to the firewall **Context** on the Panorama management server. +- Commit changes when a dynamic update is being installed. +- Generate a custom report when a dynamic update is being installed. +- Generate custom reports during a commit. + +**Workaround:** When the firewall performs slowly, or you see a critical System log for memory utilization, wait for 5 minutes and then manually reboot the firewall. + +Use the Task Manager to verify that you are not performing memory intensive tasks such as installing dynamic updates, committing changes or generating reports, at the same time, on the firewall. + +## PAN-91802 + +On a VM-Series firewall, the **clear session all** CLI command does not clear GTP sessions. + +## PAN-83610 + +In rare cases, a PA-5200 Series firewall (with an FE100 network processor) that has session offload enabled (default) incorrectly resets the UDP checksum of outgoing UDP packets. + +**Workaround:** In PAN-OS 8.0.6 and later releases, you can persistently disable session offload for only UDP traffic using the `set session udp-off load no` CLI command. + +## PAN-83236 + +The VM-Series firewall on Google Cloud Platform does not publish firewall metrics to Google Stack Monitoring when you manually configure a DNS server IP address (**Device** > **Setup** > **Services**). + +**Workaround:** The VM-Series firewall on Google Cloud Platform must use the DNS server that Google provides. + +## PAN-83215 + +SSL decryption based on ECDSA certificates does not work when you import the ECDSA private keys onto an nCipher nShield hardware security module (HSM). + +## PAN-81521 + +Endpoints failed to authenticate to GlobalProtect through Kerberos when you specify an FQDN instead of an IP address in the Kerberos server profile (**Device** > **Server Profiles** > **Kerberos**). + +**Workaround:** Replace the FQDN with the IP address in the Kerberos server profile. + +## PAN-77125 + +PA-7000 Series, PA-5450, PA-5200 Series, and PA-3200 Series firewalls configured in tap mode don’t close offloaded sessions after processing the associated traffic; the sessions remain open until they time out. + +**Workaround:** Configure the firewalls in virtual wire mode instead of tap mode, or disable session offloading by running the `set session off load no` CLI command. + +## PAN-75457 + +In WildFire appliance clusters that have three or more nodes, the Panorama management server does not support changing node roles. In a three-node cluster for example, you cannot use Panorama to configure the worker node as a controller node by adding the HA and cluster controller configurations, configure an existing controller node as a worker node by removing the HA configuration, and then commit and push the configuration. Attempts to change cluster node roles from Panorama results in a validation error—the commit fails and the cluster becomes unresponsive. + +## PAN-73530 + +The firewall does not generate a packet capture (pcap) when a Data Filtering profile blocks files. + +## PAN-73401 + +When you import a two-node WildFire appliance cluster into the Panorama management server, the controller nodes report their state as out-of-sync if either of the following conditions exist: + +- You did not configure a worker list to add at least one worker node to the cluster. (In a two-node cluster, both nodes are controller nodes configured as an HA pair. Adding a worker node would make the cluster a three-node cluster.) +- You did not configure a service advertisement (either by enabling or not enabling advertising DNS service on the controller nodes). + +**Workaround:** There are three possible workarounds to sync the controller nodes: + +- After you import the two-node cluster into Panorama, push the configuration from Panorama to the cluster. After the push succeeds, Panorama reports that the controller nodes are in sync. +- Configure a worker list on the cluster controller: + admin@wf500(active-controller)# `set deviceconfig cluster mode controller worker-list ` + (`` is the IP address of the worker node you are adding to the cluster.) This creates a three-node cluster. After you import the cluster into Panorama, Panorama reports that the controller nodes are in sync. When you want the cluster to have only two nodes, use a different workaround. +- Configure service advertisement on the local CLI of the cluster controller and then import the configuration into Panorama. The service advertisement can advertise that DNS is or is not enabled. + admin@wf500(active-controller)# `set deviceconfig cluster mode controller service-advertisement dns-service enabled yes` + or + admin@wf500(active-controller)# `set deviceconfig cluster mode controller service-advertisement dns-service enabled no` + Both commands result in Panorama reporting that the controller nodes are in sync. + +## PAN-70906 + +If the PAN-OS web interface and the GlobalProtect portal are enabled on the same IP address, then when a user logs out of the GlobalProtect portal, the administrative user is also logged out from the PAN-OS web interface. + +**Workaround:** Use the IP address to access the PAN-OS web interface and an FQDN to access the GlobalProtect portal. + +## PAN-69505 + +When viewing an external dynamic list that requires client authentication and you **Test Source URL**, the firewall fails to indicate whether it can reach the external dynamic list server and returns a URL access error (**Objects** > **External Dynamic Lists**). + +## PAN-40079 + +The VM-Series firewall on KVM, for all supported Linux distributions, does not support the Broadcom network adapters for PCI pass-through functionality. + +## PAN-39636 + +Regardless of the **Time Frame** you specify for a scheduled custom report on a Panorama M-Series appliance, the earliest possible start date for the report data is effectively the date when you configured the report (**Monitor** > **Manage Custom Reports**). For example, if you configure the report on the 15th of the month and set the **Time Frame** to **Last 30 Days**, the report that Panorama generates on the 16th will include only data from the 15th onward. This issue applies only to scheduled reports; on-demand reports include all data within the specified **Time Frame**. + +**Workaround:** To generate an on-demand report, click **Run Now** when you configure the custom report. + +## PAN-38255 + +When you perform a factory reset on a Panorama virtual appliance and configure the serial number, logging does not work until you reboot Panorama or execute the `debug software restart process management-server` CLI command. + +## PAN-31832 + +The following issues apply when configuring a firewall to use a hardware security module (HSM): + +- **nCipher nShield Connect**—The firewall requires at least four minutes to detect that an HSM was disconnected, causing SSL functionality to be unavailable during the delay. +- **SafeNet Network**—When losing connectivity to either or both HSMs in an HA configuration, the display of information from the `show high-availability state` and `show hsm info` commands are blocked for 20 seconds. diff --git a/web/data/products.json b/web/data/products.json index 8f26249..64bcf46 100644 --- a/web/data/products.json +++ b/web/data/products.json @@ -317,8 +317,55 @@ ] }, "10.1": { - "addressed": [], - "known": [] + "addressed": [ + "10.1.2_2026-03-16.md", + "10.1.3-h1_2026-03-16.md", + "10.1.4-h6_2026-03-16.md", + "10.1.5_2026-03-16.md", + "10.1.5-h3_2026-03-16.md", + "10.1.5-h4_2026-03-16.md", + "10.1.6-h3_2026-03-16.md", + "10.1.6-h6_2026-03-16.md", + "10.1.6-h7_2026-03-16.md", + "10.1.6-h9_2026-03-16.md", + "10.1.7_2026-03-16.md", + "10.1.7-h1_2026-03-16.md", + "10.1.8_2026-03-16.md", + "10.1.8-h2_2026-03-16.md", + "10.1.8-h7_2026-03-16.md", + "10.1.8-h8_2026-03-16.md", + "10.1.9-h6_2026-03-16.md", + "10.1.10_2026-03-16.md", + "10.1.10-h1_2026-03-16.md", + "10.1.10-h2_2026-03-16.md", + "10.1.11-h5_2026-03-16.md", + "10.1.11-h10_2026-03-16.md", + "10.1.12-h3_2026-03-16.md", + "10.1.13-h1_2026-03-16.md", + "10.1.13-h5_2026-03-16.md", + "10.1.14_2026-03-16.md", + "10.1.14-h2_2026-03-16.md", + "10.1.14-h6_2026-03-16.md", + "10.1.14-h8_2026-03-16.md", + "10.1.14-h10_2026-03-16.md", + "10.1.14-h11_2026-03-16.md", + "10.1.14-h13_2026-03-16.md", + "10.1.14-h14_2026-03-16.md", + "10.1.14-h16_2026-03-16.md", + "10.1.14-h19_2026-03-16.md", + "10.1.14-h20_2026-03-16.md" + ], + "known": [ + "10.1.0_2026-03-16.md", + "10.1.2_2026-03-16.md", + "10.1.5_2026-03-16.md", + "10.1.6_2026-03-16.md", + "10.1.7_2026-03-16.md", + "10.1.8_2026-03-16.md", + "10.1.11_2026-03-16.md", + "10.1.13_2026-03-16.md", + "10.1.14_2026-03-16.md" + ] } } },