|
+ Issue ID
+ |
+
+ Description
+ |
+
|---|---|
|
+ —
+ |
+
+
+ Fixes were made to address the following CVEs:
+
+
|
+
PAN-334722 |
+
+
+ Fixed an issue where the firewall introduced out-of-order packet
+ delivery for certain data streams, which resulted in clients receiving
+ data in an incorrect sequence.
+
+ |
+
PAN-332247 |
+
+
+ Fixed an issue where the proxy generated HTTP 503 errors for multiple
+ URLs, which prevented users from connecting to servers. With this fix,
+ the proxy now functions as expected.
+
+ |
+
PAN-331856 |
+
+
+ Fixed an issue where the firewall unexpectedly terminated the DNS
+ proxy process when it received TCP/53 DNS queries on an interface
+ configured for DNS proxy, which led to repeated firewall reboots and
+ temporary unavailability of the web interface. With this fix, the
+ firewall processes TCP/53 DNS queries without interruption.
+
+ |
+
PAN-330000 |
+
+
+ Fixed an issue where SNMPv3 communication would fail after an upgrade
+ from PAN-OS 11.1 to PAN-OS 12.1.6 when using SHA-512 authentication
+ and AES-256 privacy. With this fix, SNMPv3 communication functions as
+ expected after the upgrade.
+
+ |
+
PAN-329809 |
+
+
+ Fixed an issue where testing an SCP server connection from the
+ Panorama web interface returned an error instead of prompting to allow
+ the host key, which prevented the successful establishment of the
+ connection. With this fix, the system now correctly prompts to allow
+ the host key.
+
+ |
+
PAN-329793 |
+
+
+ Fixed an issue where the characters in PDF Summary Reports did not
+ display correctly when the Locale was set as Japanese, Korean,
+ Simplified Chinese, or Traditional Chinese.
+
+ |
+
PAN-329637 |
+
+
+ Fixed an issue where the push scope window did not display the target
+ devices when attempting to push configurations from Panorama, which
+ required manual selection of templates or device groups. With this
+ fix, the push scope window now correctly populates with the intended
+ push scope.
+
+ |
+
PAN-329550 |
+
+
+ Fixed an issue where the firewall experienced unexpected process
+ terminations, which resulted in an HA failover and led to the
+ dataplane becoming unresponsive.
+
+ |
+
PAN-329407 |
+
+
+ Fixed an issue where the cellular interface did not come up and
+ entered a Dead Zone state after an
+ upgrade due to the management plane losing communication with the
+ modem hardware. With this fix, the cellular interface came up by
+ having an expected APN name based on the SIM card carrier.
+
+ |
+
PAN-329359 |
+
+
+ Fixed an issue where the Panorama web interface showed blank Host
+ Information Profile (HIP) Match log entries when opened in Detailed
+ Log View. With this fix, the Detailed Log View now displays the
+ expected information for HIP Match logs.
+
+ |
+
PAN-328145 |
+
+
+ Fixed an issue where a firewall functioning as an Area Border Router
+ did not correctly translate NSSA Type-7 LSAs to Type-5 LSAs when OSPF
+ neighbors set the Nt bit in the NSSA Area, and routes were not
+ advertised to upstream OSPF neighbors in the backbone area, which
+ resulted in traffic being silently discarded.
+
+ |
+
|
+ PAN-326424
+ |
+
+
+ Fixed an issue where high memory utilization occurred in the
+ escd process. With this fix, memory
+ utilization for the process remained stable.
+
+ |
+
PAN-325724 |
+
+
+ Fixed an issue where importing PKCS12 certificates failed with the
+ error
+ Import of certificate and private-key failed. Failed to extract
+ certificate.
+
+ |
+
PAN-325151 |
+
+
+ Fixed an issue where a system log was not generated when the proxy
+ reached its session limit.
+
+ |
+
PAN-324652 |
+
+
+ Fixed an issue where selective configuration pushes from Panorama
+ failed after an upgrade, which caused shared policy rules to go out of
+ sync. With this fix, selective configuration pushes complete
+ successfully and policies remain in sync.
+
+ |
+
PAN-322398 |
+
+
+ Fixed an issue where the firewall sent a BFD admin down message during
+ an NGFW cluster failover, which caused BGP sessions to terminate and
+ routes to be lost.
+
+ |
+
PAN-320324 |
+
+
+ Fixed an issue where incorrect source region information appeared in
+ GlobalProtect logs, which occurred because the location service lookup
+ did not consistently return region information for public IP
+ addresses. With this fix, accurate source region information is
+ consistently displayed.
+
+ |
+
PAN-319352 |
+
+
+ Fixed an issue where the firewall rebooted unexpectedly without any
+ configuration or power changes.
+
+ |
+
PAN-314826 |
+
+
+ Fixed an issue where the system failed to alert you when indices were
+ created before their corresponding templates loaded, which could lead
+ to unexpected data handling. With this fix, the system now proactively
+ identifies and alerts you to these situations.
+
+ |
+
PAN-314825 |
+
+
+ Fixed an issue where GlobalProtect user authentication with
+ certificates from a new Public Key Infrastructure (PKI) would not
+ succeed when Certificate Revocation List (CRL) checking was enabled.
+ This occurred because the firewall did not properly retrieve the CRL
+ from the new PKI's Distribution Point URL. With this fix, the firewall
+ now successfully retrieves CRLs, allowing GlobalProtect users to
+ authenticate correctly with certificates from new PKIs.
+
+ |
+
PAN-314104 |
+
+
+ Fixed an issue where running BCM counter commands from the
+ administrative shell did not consistently return output, and commands
+ to modify queue sizes did not take effect.
+
+ |
+
PAN-313393 |
+
+
+ Fixed an issue where, after you configured a proxy server, External
+ Dynamic Lists (EDL) and system software checks did not function
+ concurrently. This occurred when you configured service routes for
+ Palo Alto Networks services, which caused either EDL updates or system
+ software checks to fail, depending on the specific service route
+ configuration. With this fix, both EDL updates and system software
+ checks correctly utilize the configured proxy server.
+
+ |
+
PAN-312157 |
+
+
+ Fixed an issue where, during a commit, the firewall intermittently
+ stopped sending SNMP messages, which caused interface counters to stop
+ updating for brief periods of time.
+
+ |
+
PAN-310627 |
+
+
+ Fixed an issue where Inline Cloud Analyzer (ICA) did not correctly
+ apply custom URL categories configured as exceptions for traffic
+ detection. With this fix, ICA correctly applies the configured custom
+ URL category exceptions.
+
+ |
+
PAN-308812 |
+
+
+ Fixed an issue where firewalls using the Real-Time update setting for
+ WildFire intermittently generated system alerts indicating a failure
+ to connect to the WildFire real-time cloud. With this fix, these
+ alerts are no longer generated.
+
+ |
+
PAN-307590 |
+
+
+ Fixed an issue where some FQDNs could not be resolved by the firewall.
+ This occurred even when your configured Domain Name System (DNS)
+ servers successfully returned valid IP addresses for the FQDNs. With
+ this fix, the firewall correctly processes DNS responses and resolves
+ FQDNs as expected.
+
+ |
+
PAN-286889 |
+
+
+ Fixed an issue where a website would intermittently fail to load in
+ Mozilla Firefox after authentication when AURL inline cloud was
+ active, which was caused by an interaction with the inline cloud
+ analysis process. With this fix, websites now load consistently.
+
+ |
+
PAN-216054 |
+
+
+ Fixed an issue that caused the firewall fan speed to increase while it
+ was idle.
+
+ |
+
|
+ Issue ID
+ |
+
+ Description
+ |
+
|---|---|
|
+ —
+ |
+
+
+ Fixes were made to address the following CVEs:
+
+
|
+
PAN-316721 |
+
+
+ Fixed an issue where multiple EDL fetches were queued and did not
+ complete.
+
+ |
+
|
+ Issue ID
+ |
+
+ Description
+ |
+
|---|---|
|
+ PAN-337297
+ |
+
+
+ Fixed an issue where new GlobalProtect App users could not obtain
+ portal configuration after successful authentication. With this fix,
+ GlobalProtect App users successfully receive portal configurations.
+
+ |
+
|
+ Issue ID
+ |
+
+ Description
+ |
+
|---|---|
|
+ —
+ |
+
+
+ Fixes were made to address the following CVEs:
+
+
|
+
PAN-334722 |
+
+
+ Fixed an issue where the firewall introduced out-of-order packet
+ delivery for certain data streams, which resulted in clients receiving
+ data in an incorrect sequence.
+
+ |
+
PAN-329637 |
+
+
+ Fixed an issue where the push scope window did not display the target
+ devices when attempting to push configurations from Panorama, which
+ required manual selection of templates or device groups. With this
+ fix, the push scope window now correctly populates with the intended
+ push scope.
+
+ |
+
PAN-329359 |
+
+
+ Fixed an issue where the Panorama web interface showed blank Host
+ Information Profile (HIP) Match log entries when opened in Detailed
+ Log View. With this fix, the Detailed Log View now displays the
+ expected information for HIP Match logs.
+
+ |
+
PAN-329180 |
+
+
+ Fixed an issue where Panorama did not automatically resume syslog
+ forwarding over TCP after the syslog server became unavailable or was
+ restarted.
+
+ |
+
PAN-327590 |
+
+
+ Fixed an issue where BFD sessions did not reestablish on the newly
+ elected leader after a leader failover event that occurred when the
+ previous leader node was suspended.
+
+ |
+
PAN-325903 |
+
+
+ Fixed an issue where, after upgrading Panorama, a custom admin role
+ with Object Level Changes disabled did not automatically populate
+ out-of-sync firewalls in the push scope.
+
+ |
+
PAN-325724 |
+
+
+ Fixed an issue where importing PKCS12 certificates failed with the
+ error
+ Import of certificate and private-key failed. Failed to extract
+ certificate.
+
+ |
+
PAN-325613 |
+
+
+ (PA-7500 firewalls in HA cluster configurations only) Fixed an issue where interfaces intermittently remained offline
+ after a cluster failover.
+
+ |
+
PAN-324652 |
+
+
+ Fixed an issue where selective configuration pushes from Panorama
+ failed after an upgrade, which caused shared policy rules to go out of
+ sync. With this fix, selective configuration pushes complete
+ successfully and policies remain in sync.
+
+ |
+
PAN-323249 |
+
+
+ (M-700 appliances only) Fixed an issue where
+ the Elasticsearch processes repeatedly restarted and log collectors
+ showed the Elasticsearch health status as red.
+
+ |
+
PAN-322398 |
+
+
+ Fixed an issue where the firewall sent a BFD admin down message during
+ an NGFW cluster failover, which caused BGP sessions to terminate and
+ routes to be lost.
+
+ |
+
PAN-321699 |
+
+
+ Fixed an issue where device telemetry intermittently failed to send
+ files, which resulted in critical alerts in system files.
+
+ |
+
PAN-319838 |
+
+
+ Fixed an issue where SFP ports did not establish a link with a
+ third-party peer device when forced speed was configured on the
+ firewall and the peer device was set to
+ nonegotiate.
+
+ |
+
PAN-318120 |
+
+
+ Fixed an issue where SSL traffic was silently dropped when traffic was
+ processed by a Security policy with an Anti-Spyware profile that had
+ Inline cloud Analysis enabled for SSL C2 Detector with an action other
+ than allow or alert.
+
+ |
+
PAN-318106 |
+
+
+ Fixed an issue where SCM did not update device telemetry for the
+ firewall after upgrading to an affected release.
+
+ |
+
PAN-316721 |
+
+
+ Fixed an issue where multiple EDL fetches were queued and did not
+ complete.
+
+ |
+
PAN-314776 |
+
+
+ Fixed an issue where the
+ configd
+ process stopped responding after pushing configuration changes from
+ Panorama to the firewall.
+
+ |
+
PAN-314630 |
+
+
+ Fixed an issue where the firewall repeatedly rebooted and entered
+ maintenance mode, and a factory reset was required.
+
+ |
+
PAN-312685 |
+
+
+ Fixed an issue where committing a scheduled configuration push on
+ Panorama caused the
+ configd
+ process to stop responding unexpectedly.
+
+ |
+
PAN-309676 |
+
+
+ Fixed an issue on Panorama where a database component unexpectedly
+ stopped when Panorama was deployed using an .ova file or
+ upgraded/downgraded to an affected PAN-OS version. This occurred due
+ to a required directory not being created during the initial
+ provisioning workflow. With this fix, the necessary directory is
+ created automatically during deployment.
+
+ |
+
PAN-308775 |
+
+
+ (Firewalls in active/passive configurations only) Fixed an issue where NTP status intermittently showed as rejected
+ on the active firewall, which prevented the firewalls from
+ synchronizing time.
+
+ |
+
PAN-308444 |
+
+
+ Fixed an issue where pushing multiple policy rules failed when the
+ policy rules contained a large number of dynamic address object groups
+ or user groups.
+
+ |
+
|
+ Issue ID
+ |
+
+ Description
+ |
+
|---|---|
|
+ PAN-337297
+ |
+
+
+ Fixed an issue where new GlobalProtect App users could not obtain
+ portal configuration after successful authentication. With this fix,
+ GlobalProtect App users successfully receive portal configurations.
+
+ |
+
|
+ PAN-334871
+ |
+
+
+ Fixed an issue where DHCPv6 relay failed on sub-interfaces when the
+ Advanced Routing Engine was in use with DHCP IPv4 and IPv6 enabled.
+
+ |
+
|
+ Issue ID
+ |
+
+ Description
+ |
+
|---|---|
|
+ PAN-331636
+ |
+
+
+ Fixed an issue where the web server failed to start after an upgrade,
+ which caused the management interface to become inaccessible.
+
+ |
+
PAN-329834 |
+
+
+ Fixed an issue where a memory leak associated with some display CLI
+ commands caused instability.
+
+ |
+
PAN-329180 |
+
+
+ Fixed an issue where Panorama did not automatically resume syslog
+ forwarding over TCP after the syslog server became unavailable or was
+ restarted.
+
+ |
+
PAN-328742 |
+
+
+ Fixed an issue where the dataplane silently dropped HTTP POST
+ payloads, which disrupted application integrations. This occurred due
+ to an internal error when processing XFF headers within the CTD
+ engine.
+
+ |
+
PAN-327590 |
+
+
+ Fixed an issue where BFD sessions did not reestablish on the newly
+ elected leader after a leader failover event that occurred when the
+ previous leader node was suspended.
+
+ |
+
PAN-327460 |
+
+
+ Fixed an issue where a
+ Commit and Push operation on
+ Panorama did not successfully push configuration changes to Prisma
+ Access endpoints. This occurred when the system reported that not all
+ commit jobs were triggered. With this fix,
+ Commit and Push operations now
+ correctly apply configurations to Prisma Access.
+
+ |
+
PAN-326354 |
+
+
+ Fixed an issue where the
+ sslmgr
+ process stopped responding when attempting to display the OSCP host
+ cache.
+
+ |
+
PAN-325613 |
+
+
+ (PA-7500 firewalls in HA cluster configurations only) Fixed an issue where interfaces intermittently remained offline
+ after a cluster failover.
+
+ |
+
PAN-325002 |
+
+
+ (Google Cloud NGFW Enterprise VM-Series firewalls only) Fixed an issue where the HTTP2 threat logs did not include VPC ID,
+ Security_key, and Endpoint ID.
+
+ |
+
PAN-324902 |
+
+
+ Fixed an issue where exporting Custom Reports to CSV failed with a
+ UnicodeEncodeError message when
+ report entries contained multibyte characters.
+
+ |
+
PAN-323249 |
+
+
+ (M-700 appliances only) Fixed an issue where
+ the Elasticsearch processes repeatedly restarted and log collectors
+ showed the Elasticsearch health status as red.
+
+ |
+
PAN-320345 |
+
+
+ Fixed an issue where the firewall repeatedly restarted when the
+ monitored User-ID server became unreachable during Kerberos
+ authentication connection attempts, which caused the authentication
+ process to stop responding. On firewalls in HA configurations, both
+ peer firewalls entered maintenance mode.
+
+ |
+
PAN-319838 |
+
+
+ Fixed an issue where SFP ports did not establish a link with a
+ third-party peer device when forced speed was configured on the
+ firewall and the peer device was set to
+ nonegotiate.
+
+ |
+
PAN-319504 |
+
+
+ Fixed an issue where telemetry data was not sent to the cloud due to
+ the firewall being unable to resolve the destination server's FQDN
+ even when a proxy server was configured. With this fix, the firewall
+ properly sends telemetry data through the configured proxy server
+ without requiring direct public DNS resolution for the telemetry
+ server's FQDN.
+
+ |
+
PAN-318580 |
+
+
+ Fixed an issue where processes restarted and the firewall unexpectedly
+ rebooted when you configured a Security policy rule with
+ Source Device > quarantine.
+
+ |
+
PAN-318382 |
+
+
+ (Firewalls in HA configurations only) Fixed an
+ issue where the secondary firewall remained at an
+ Initial state after an upgrade.
+
+ |
+
PAN-317598 |
+
+
+ (Firewalls in active/active HA configurations only) Fixed an issue where NAT failures occurred due to the IP pool not
+ releasing unused resources in the Active Secondary firewall. This
+ occurred because the secondary firewall attempts to release a
+ Persistent DIPP NATed port that was originally allocated by the NAT
+ policy from first firewall, leading to a ownership mismatch during the
+ session teardown process.
+
+ |
+
PAN-317214 |
+
+
+ Fixed an issue where SNMP queries for TCP connections per second (CPS)
+ metrics on single vsys firewalls returned inconsistent values.
+
+ |
+
PAN-316720 |
+
+
+ Fixed an issue on log collectors where
+ Verify Update Server Identity was
+ not consistently enabled and visible in the XML configuration after a
+ configuration push from Panorama.
+
+ |
+
|
+ PAN-315959
+ |
+
+
+ (M-700 appliances only) Fixed an issue where
+ Panorama displayed an incorrect maximum recommended configuration size
+ when performing a commit.
+
+ |
+
PAN-314776 |
+
+
+ Fixed an issue where the
+ configd
+ process stopped responding after pushing configuration changes from
+ Panorama to the firewall.
+
+ |
+
PAN-314061 |
+
+
+ Fixed an issue where traffic was disrupted during IPSec rekey
+ operations due to a 2 second delay in sending the DELETE message for
+ the previous Security Association (SA) to the peer gateway after a new
+ SA was negotiated.
+
+ |
+
PAN-313850 |
+
+
+ (PA-1400 Series firewalls in HA configurations only) Fixed an issue where a split-brain condition occurred and HA1/HA2
+ links went down while upgrading when the HA configuration used
+ dataplane interfaces for HA1 and a combination of HSCI and Ethernet
+ interfaces for HA2.
+
+ |
+
PAN-313218 |
+
+
+ Added the following CLI commands to address QoS packet drops due to
+ bursty traffic:
+
+
+ To utilize this fix, change the parameters, disable QoS, commit
+ changes, enable QOS, and then re-commit changes.
+
+ |
+
PAN-313190 |
+
+
+ (VM-Series firewalls only) Fixed an issue where
+ content updates and configuration commits failed with the error
+ message
+ client device phase 1 failure error.
+
+ |
+
PAN-312685 |
+
+
+ Fixed an issue where committing a scheduled configuration push on
+ Panorama caused the
+ configd
+ process to stop responding unexpectedly.
+
+ |
+
PAN-312330 |
+
+
+ (Firewalls in active/passive HA configurations only) Fixed an issue where the Clientless VPN applications failed to load
+ due to the firewall dataplane incorrectly processing session
+ information.
+
+ |
+
PAN-311988 |
+
+
+ (Firewalls in FIPS mode only) Fixed decryption
+ issues that occurred after an upgrade to an affected release.
+
+
+ To enable this fix, run the CLI command
+ debug dataplane set ssl-decrypt low-memory-throttle enable.
+
+ |
+
PAN-311624 |
+
+
+ Fixed an issue on Panorama where, when an Aggregate Ethernet interface
+ was configured in override mode within a template stack, changing its
+ management profile unexpectedly overrode other interface-specific
+ variables.
+
+ |
+
PAN-310699 |
+
+
+ Fixed an issue where the firewall stripped the Authentication Key
+ Identifier (AKID) from certificates using SSL decryption, which
+ prevented clients from authenticating server certificates and resulted
+ in decryption failures.
+
+ |
+
PAN-309306 |
+
+
+ Fixed a rare issue on Octeon Dataplane platforms where the firewall
+ experienced an unexpected dataplane restart due to a race condition
+ that occurred during session teardown for traffic undergoing
+ software-based Content Threat detection.
+
+ |
+
PAN-308614 |
+
+
+ Fixed an issue where the
+ mgmt
+ process stopped responding after an upgrade during SSH Key Exchange
+ verification.
+
+ |
+
PAN-302175 |
+
+
+ Fixed an issue where, after upgrading an LSVPN portal/gateway to an
+ affected release, the portal was unable to issue and transfer
+ certificates to the satellite firewalls, which led to repeated
+ certificate requests and prevented the satellite firewalls from
+ authenticating to the gateway.
+
+ |
+
PAN-297818 |
+
+
+ Fixed an issue on Panorama where exporting managed device information
+ that included a PA-450R-5G appliance resulted in the
+ Cellular Firmware field being
+ exported into multiple cells.
+
+ |
+
PAN-252699 |
+
+
+ Fixed an issue where frequent session failures occurred due to CTD
+ resource exhaustion.
+
+ |
+
|
+ Issue ID
+ |
+
+ Description
+ |
+
|---|---|
|
+ —
+ |
+
+
+ Fixes were made to address the following CVEs:
+
+
|
+
|
+ PAN-334992
+ |
+
+
+ Fixed an issue where a PA-455 firewall in FIPS-CC mode did not start
+ correctly after upgrading from PAN-OS 12.1.8 to 12.2.2.
+
+ |
+
|
+ PAN-334724
+ |
+
+
+ Fixed an issue where installing WildFire® content updates disabled
+ PAN-OS Shield.
+
+ |
+
|
+ PAN-334338
+ |
+
+
+ Fixed an issue where a PA-450 firewall restarted with the error
+ general system-shutdown 1: The system is shutting down due to md
+ initiated dataplane restarts exhausted.
+
+ |
+
|
+ PAN-331856
+ |
+
+
+ Fixed an issue where the dnsproxyd process became unresponsive on
+ TCP/53 connections on VM-Series firewalls.
+
+ |
+
|
+ PAN-329550
+ |
+
+
+ Fixed an issue where PA-5280 firewalls experienced multiple
+ all_pktproc process restarts, resulting in the dataplane going down
+ and an HA failover.
+
+ |
+
|
+ PAN-329407
+ |
+
+
+ Fixed an issue where, after upgrading a PA-450R-5G firewall, the
+ cellular interface did not come up and entered a Dead Zone state.
+
+ |
+
|
+ PAN-326056
+ |
+
+
+ Fixed an issue where some ACE applications did not match the correct
+ security policy when the service was set to Application Default on
+ PA-5450 firewalls.
+
+ |
+
|
+ PAN-325724
+ |
+
+
+ Fixed an issue where importing a PKCS12 certificate on Panorama®
+ failed with the error
+ Import of certificate and private-key failed. Failed to extract
+ certificate.
+
+ |
+
|
+ PAN-319343
+ |
+
+
+ Fixed an issue where management plane resource exhaustion caused
+ commit latency across Prisma® Access gateways.
+
+ |
+
|
+ PAN-315630
+ |
+
+
+ Fixed an issue where a PA-450 firewall dropped new connections with
+ the error
+ Packet dropped, session allocation failure.
+
+ |
+
|
+ PAN-310218
+ |
+
+
+ Fixed an issue where hidden NFS files under
+ /opt/var/s7/lp/log/pan filled up disk
+ space on PA-7080 firewalls.
+
+ |
+
|
+ PAN-295806
+ |
+
+
+ Fixed a memory leak in the connection handling process.
+
+ |
+
|
+ Issue ID
+ |
+
+ Description
+ |
+
|---|---|
PAN-329665 |
+
+
+ After an Internet of Things (IoT) update, the
+ TLSv1.3_Default SSL TLS profiles
+ and their associated certificates disappear from Panorama appliances.
+
+ |
+
PAN-313669 |
+
+
+ (PA-5500 Series firewalls in cluster configurations only) When a
+ firewall node is removed from a PA-5500 Series cluster, after the
+ cluster commit and reboot, the node starts in standalone mode with a
+ default virtual wire (vwire) configuration loaded. This default
+ configuration is missing zone assignments for ports eth1/1 and eth1/2,
+ which causes commit operations to fail. Even if zones are manually
+ assigned to these ports, subsequent commit attempts will fail with a
+ "no UUId for rule1" error.
+
+
+ Workaround: To resolve this, either:
+
+
|
+
PAN-312143 |
+
+
+ (Firewalls in active/passive high availability (HA) configurations
+ only) When attempting to synchronize the running configuration with an
+ HA peer, particularly during script runs involving different topology
+ builds (e.g., during a smoke runlist), the synchronization process
+ fails. This results in an error indicating that the running
+ configuration could not be synchronized with the HA peer.
+
+ |
+
PAN-311601 |
+
+
+ If the node is seen stuck with fault "session clearing fault". Node
+ reboot is the workaround to get the node back in online state after
+ all other fault conditions are removed.
+
+ |
+
PAN-300230 |
+
+
+ (NGFW Cluster) In an NGFW cluster, your pings to the HSCI-B link might
+ fail, even when the link indicates it is up. In the event that the
+ HSCI-A link is brought down or unplugged, the cluster node will
+ transition to failed state, avoiding split brain as both HSCI links
+ are down in this case. Workaround: Reboot the cluster node to resolve
+ the HSCI-B ping issue.
+
+ |
+
PAN-299562 |
+
+
+ When a client sends a Client Hello with Transport Layer Security (TLS)
+ 1.3 or TLS 1.2, using only the p-192 elliptic curve and some
+ non-perfect forward secrecy (PFS) ciphers, the firewall discards the
+ Client Hello. The firewall should allow the connection to proceed
+ using TLS 1.2, maintaining backward compatibility with previous
+ releases.
+
+ |
+
PAN-298083 |
+
+
+ Draft for review: After you change the system mode on an M-700
+ appliance from Panorama mode to PAN-DB private cloud mode, the snmpd
+ process fails to work.
+
+ |
+
PAN-297114 |
+
+
+ After successfully generating a health check report for managed
+ firewalls from Panorama, the progress bar does not appear and the
+ latest health check reports are not displayed (Panorama > Device Deployment > Upgrade Check).
+
+
+ Workaround: Manually refresh the
+ page to see the latest reports.
+
+ |
+
PAN-295946 |
+
+
+ When a Panorama appliance (running PAN-OS 12.1.2 or higher) manages
+ firewalls running PAN-OS versions lower than 12.1.2, and an NTP server
+ configuration template includes SHA256 or SHA512 as the authentication
+ mechanism, pushing this template to the firewalls running PAN-OS
+ versions lower than 12.1.2 will cause the commit operation to fail.
+ Workaround: Create two separate templates: one for firewalls running
+ PAN-OS 12.1.2 or higher (which can include SHA256/SHA512
+ authentication) and another for firewalls running PAN-OS versions
+ lower than 12.1.2 (which should use other authentication algorithms
+ such as SHA1, MD5, or Autokey). Then, push the appropriate template to
+ the corresponding devices from Panorama.
+
+ |
+
PAN-294752 |
+
+
+ In any 15-second interval, if connectivity (CI or management) on a
+ GW-Node (not P-Node) changes more than once, with each change
+ occurring on a different node and affecting a different link, the
+ cluster loses its leader, all routing protocols fail, and traffic is
+ blackholed if route changes occur in the network.
+
+
+ Workaround: Reboot nodes that are in a FAILED state or suspend and
+ unsuspend any online GW-Node (not P-Node).
+
+ |
+
PAN-293718 |
+
+
+ Draft for review: When high speed logging is enabled on a PA-5560
+ device, the expected warning message is not displayed on the web
+ interface. This prevents administrators from being notified that logs
+ can only be viewed from Panorama.
+
+ |
+
PAN-292601 |
+
+
+ PAN-OS 12.1.2 and later 12.1 releases support a Load Balanced DNS
+ configuration for an address object. If there are two address objects
+ with same FQDN, but one object has Load Balanced DNS enabled and other
+ object has Load Balanced DNS disabled, then the policy match for the
+ removed IP addresses doesn't work as expected. Workaround: Enable (or
+ disable) Load Balanced DNS consistently for an FQDN that is used with
+ multiple address objects.
+
+ |
+
PAN-289524 |
+
+
+ In PAN-OS 12.1.2 and later and PAN-OS 12.2.2 and later releases,
+ PAN-OS can obtain resolved IP addresses from a load-balanced DNS
+ server and use them in a policy match. However, this functionality
+ does not work as intended when the DNS cache reuse flag is enabled.
+ When the DNS cache reuse flag is enabled, the DNS resolution works as
+ if the load-balanced DNS flag (for an address object) is disabled.
+
+ |
+
PAN-283028 |
+
+
+ The following error is thrown when an existing template overrides the
+ SD-WAN configuration followed by the commit and push from Panorama to
+ the firewall.
+
+
+ BGP is invalid. AS number does not fit in 2 byte AS format
+
+
+ This issue occurs because different AS formats are present on the
+ Panorama and the firewall (the firewall configuration is generated by
+ the SD-WAN plugin). That is, both the hub and branch firewall must
+ have the same AS format in hub-and-spoke topology. In full mesh
+ topology, all the firewalls must have the same AS format.
+
+ |
+
|
+ Issue ID
+ |
+
+ Description
+ |
+
|---|---|
PAN-313669 |
+
+
+ (PA-5500 Series firewalls in cluster configurations only) When a
+ firewall node is removed from a PA-5500 Series cluster, after the
+ cluster commit and reboot, the node starts in standalone mode with a
+ default virtual wire (vwire) configuration loaded. This default
+ configuration is missing zone assignments for ports eth1/1 and eth1/2,
+ which causes commit operations to fail. Even if zones are manually
+ assigned to these ports, subsequent commit attempts will fail with a
+ "no UUId for rule1" error.
+
+
+ Workaround: To resolve this, either:
+
+
|
+
PAN-312143 |
+
+
+ (Firewalls in active/passive high availability (HA) configurations
+ only) When attempting to synchronize the running configuration with an
+ HA peer, particularly during script runs involving different topology
+ builds (e.g., during a smoke runlist), the synchronization process
+ fails. This results in an error indicating that the running
+ configuration could not be synchronized with the HA peer.
+
+ |
+
PAN-311601 |
+
+
+ If the node is seen stuck with fault "session clearing fault". Node
+ reboot is the workaround to get the node back in online state after
+ all other fault conditions are removed.
+
+ |
+
PAN-300667 |
+
+
+ Panorama cannot display Threat log entries (Monitor > Logs >
+ Threat) when the managed log collector is running a lower PAN-OS
+ release than Panorama. Workaround: Upgrade the log collectors to the
+ same version as Panorama.
+
+ |
+
PAN-300230 |
+
+
+ (NGFW Cluster) In an NGFW cluster, your pings to the HSCI-B link might
+ fail, even when the link indicates it is up. In the event that the
+ HSCI-A link is brought down or unplugged, the cluster node will
+ transition to failed state, avoiding split brain as both HSCI links
+ are down in this case. Workaround: Reboot the cluster node to resolve
+ the HSCI-B ping issue.
+
+ |
+
PAN-299562 |
+
+
+ When a client sends a Client Hello with Transport Layer Security (TLS)
+ 1.3 or TLS 1.2, using only the p-192 elliptic curve and some
+ non-perfect forward secrecy (PFS) ciphers, the firewall discards the
+ Client Hello. The firewall should allow the connection to proceed
+ using TLS 1.2, maintaining backward compatibility with previous
+ releases.
+
+ |
+
PAN-298083 |
+
+
+ Draft for review: After you change the system mode on an M-700
+ appliance from Panorama mode to PAN-DB private cloud mode, the snmpd
+ process fails to work.
+
+ |
+
PAN-295946 |
+
+
+ When a Panorama appliance (running PAN-OS 12.1.2 or higher) manages
+ firewalls running PAN-OS versions lower than 12.1.2, and an NTP server
+ configuration template includes SHA256 or SHA512 as the authentication
+ mechanism, pushing this template to the firewalls running PAN-OS
+ versions lower than 12.1.2 will cause the commit operation to fail.
+ Workaround: Create two separate templates: one for firewalls running
+ PAN-OS 12.1.2 or higher (which can include SHA256/SHA512
+ authentication) and another for firewalls running PAN-OS versions
+ lower than 12.1.2 (which should use other authentication algorithms
+ such as SHA1, MD5, or Autokey). Then, push the appropriate template to
+ the corresponding devices from Panorama.
+
+ |
+
PAN-294752 |
+
+
+ In any 15-second interval, if connectivity (CI or management) on a
+ GW-Node (not P-Node) changes more than once, with each change
+ occurring on a different node and affecting a different link, the
+ cluster loses its leader, all routing protocols fail, and traffic is
+ blackholed if route changes occur in the network.
+
+
+ Workaround: Reboot nodes that are in a FAILED state or suspend and
+ unsuspend any online GW-Node (not P-Node).
+
+ |
+
PAN-293718 |
+
+
+ Draft for review: When high speed logging is enabled on a PA-5560
+ device, the expected warning message is not displayed on the web
+ interface. This prevents administrators from being notified that logs
+ can only be viewed from Panorama.
+
+ |
+
PAN-292601 |
+
+
+ PAN-OS 12.1.2 and later 12.1 releases support a Load Balanced DNS
+ configuration for an address object. If there are two address objects
+ with same FQDN, but one object has Load Balanced DNS enabled and other
+ object has Load Balanced DNS disabled, then the policy match for the
+ removed IP addresses doesn't work as expected. Workaround: Enable (or
+ disable) Load Balanced DNS consistently for an FQDN that is used with
+ multiple address objects.
+
+ |
+
PAN-289524 |
+
+
+ In PAN-OS 12.1.2 and later and PAN-OS 12.2.2 and later releases,
+ PAN-OS can obtain resolved IP addresses from a load-balanced DNS
+ server and use them in a policy match. However, this functionality
+ does not work as intended when the DNS cache reuse flag is enabled.
+ When the DNS cache reuse flag is enabled, the DNS resolution works as
+ if the load-balanced DNS flag (for an address object) is disabled.
+
+ |
+
PAN-283028 |
+
+
+ The following error is thrown when an existing template overrides the
+ SD-WAN configuration followed by the commit and push from Panorama to
+ the firewall.
+
+
+ BGP is invalid. AS number does not fit in 2 byte AS format
+
+
+ This issue occurs because different AS formats are present on the
+ Panorama and the firewall (the firewall configuration is generated by
+ the SD-WAN plugin). That is, both the hub and branch firewall must
+ have the same AS format in hub-and-spoke topology. In full mesh
+ topology, all the firewalls must have the same AS format.
+
+ |
+