aaron.axvig/firewallissues
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add PAN-OS 12 reference files
Test and deploy / deploy (push) Successful in 32s
Details

Browse Source
This commit is contained in:
aaron.axvig committed 2026-10-11 19:35:56 -05:00
1 parent 15a105ad16
commit 8559d63f9f
9 files changed
+2062
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

reference/PAN-OS/addressed/12.1.10.html
+408
View File
@@ -0,0 +1,408 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row">
<th class="entry">
<div class="p">Issue ID</div>
</th>
<th class="entry">
<div class="p">Description</div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row rowsep">
<td class="entry">
<div class="p">—</div>
</td>
<td class="entry relcol">
<div class="p">
Fixes were made to address the following CVEs:
<ul id="pan_os_12_1_10_addressed_issues_ul-d2c_441_nkc" class="ul">
<li class="li">
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0310"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0310</a
>
</li>
<li class="li">
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0309"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0309</a
>
</li>
<li class="li">
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0308"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0308</a
>
</li>
</ul>
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-334722</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall introduced out-of-order packet
delivery for certain data streams, which resulted in clients receiving
data in an incorrect sequence.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-332247</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the proxy generated HTTP 503 errors for multiple
URLs, which prevented users from connecting to servers. With this fix,
the proxy now functions as expected.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-331856</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall unexpectedly terminated the DNS
proxy process when it received TCP/53 DNS queries on an interface
configured for DNS proxy, which led to repeated firewall reboots and
temporary unavailability of the web interface. With this fix, the
firewall processes TCP/53 DNS queries without interruption.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-330000</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where SNMPv3 communication would fail after an upgrade
from PAN-OS 11.1 to PAN-OS 12.1.6 when using SHA-512 authentication
and AES-256 privacy. With this fix, SNMPv3 communication functions as
expected after the upgrade.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329809</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where testing an SCP server connection from the
Panorama web interface returned an error instead of prompting to allow
the host key, which prevented the successful establishment of the
connection. With this fix, the system now correctly prompts to allow
the host key.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329793</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the characters in PDF Summary Reports did not
display correctly when the Locale was set as Japanese, Korean,
Simplified Chinese, or Traditional Chinese.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329637</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the push scope window did not display the target
devices when attempting to push configurations from Panorama, which
required manual selection of templates or device groups. With this
fix, the push scope window now correctly populates with the intended
push scope.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329550</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall experienced unexpected process
terminations, which resulted in an HA failover and led to the
dataplane becoming unresponsive.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329407</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the cellular interface did not come up and
entered a <span class="ph uicontrol">Dead Zone</span> state after an
upgrade due to the management plane losing communication with the
modem hardware. With this fix, the cellular interface came up by
having an expected APN name based on the SIM card carrier.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329359</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the Panorama web interface showed blank Host
Information Profile (HIP) Match log entries when opened in Detailed
Log View. With this fix, the Detailed Log View now displays the
expected information for HIP Match logs.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-328145</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a firewall functioning as an Area Border Router
did not correctly translate NSSA Type-7 LSAs to Type-5 LSAs when OSPF
neighbors set the Nt bit in the NSSA Area, and routes were not
advertised to upstream OSPF neighbors in the backbone area, which
resulted in traffic being silently discarded.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry">
<div class="p">PAN-326424</div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where high memory utilization occurred in the
<span class="ph uicontrol">escd</span> process. With this fix, memory
utilization for the process remained stable.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325724</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where importing PKCS12 certificates failed with the
error
<span class="ph systemoutput"
>Import of certificate and private-key failed. Failed to extract
certificate</span
>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325151</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a system log was not generated when the proxy
reached its session limit.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-324652</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where selective configuration pushes from Panorama
failed after an upgrade, which caused shared policy rules to go out of
sync. With this fix, selective configuration pushes complete
successfully and policies remain in sync.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-322398</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall sent a BFD admin down message during
an NGFW cluster failover, which caused BGP sessions to terminate and
routes to be lost.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-320324</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where incorrect source region information appeared in
GlobalProtect logs, which occurred because the location service lookup
did not consistently return region information for public IP
addresses. With this fix, accurate source region information is
consistently displayed.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319352</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall rebooted unexpectedly without any
configuration or power changes.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314826</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the system failed to alert you when indices were
created before their corresponding templates loaded, which could lead
to unexpected data handling. With this fix, the system now proactively
identifies and alerts you to these situations.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314825</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where GlobalProtect user authentication with
certificates from a new Public Key Infrastructure (PKI) would not
succeed when Certificate Revocation List (CRL) checking was enabled.
This occurred because the firewall did not properly retrieve the CRL
from the new PKI's Distribution Point URL. With this fix, the firewall
now successfully retrieves CRLs, allowing GlobalProtect users to
authenticate correctly with certificates from new PKIs.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314104</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where running BCM counter commands from the
administrative shell did not consistently return output, and commands
to modify queue sizes did not take effect.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313393</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, after you configured a proxy server, External
Dynamic Lists (EDL) and system software checks did not function
concurrently. This occurred when you configured service routes for
Palo Alto Networks services, which caused either EDL updates or system
software checks to fail, depending on the specific service route
configuration. With this fix, both EDL updates and system software
checks correctly utilize the configured proxy server.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312157</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, during a commit, the firewall intermittently
stopped sending SNMP messages, which caused interface counters to stop
updating for brief periods of time.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310627</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where Inline Cloud Analyzer (ICA) did not correctly
apply custom URL categories configured as exceptions for traffic
detection. With this fix, ICA correctly applies the configured custom
URL category exceptions.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-308812</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where firewalls using the Real-Time update setting for
WildFire intermittently generated system alerts indicating a failure
to connect to the WildFire real-time cloud. With this fix, these
alerts are no longer generated.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-307590</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where some FQDNs could not be resolved by the firewall.
This occurred even when your configured Domain Name System (DNS)
servers successfully returned valid IP addresses for the FQDNs. With
this fix, the firewall correctly processes DNS responses and resolves
FQDNs as expected.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-286889</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a website would intermittently fail to load in
Mozilla Firefox after authentication when AURL inline cloud was
active, which was caused by an interaction with the inline cloud
analysis process. With this fix, websites now load consistently.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-216054</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue that caused the firewall fan speed to increase while it
was idle.
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/addressed/12.1.4-h10.html
+67
View File
@@ -0,0 +1,67 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row">
<th class="entry">
<div class="p">Issue ID</div>
</th>
<th class="entry">
<div class="p">Description</div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row rowsep">
<td class="entry">
<div class="p">—</div>
</td>
<td class="entry relcol">
<div class="p">
Fixes were made to address the following CVEs:
<ul id="pan_os_12_1_4_h10_addressed_issues_ul-d2c_441_nkc" class="ul">
<li class="li">
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0310"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0310</a
>
</li>
<li class="li">
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0309"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0309</a
>
</li>
</ul>
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316721</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where multiple EDL fetches were queued and did not
complete.
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/addressed/12.1.4-h11.html
+33
View File
@@ -0,0 +1,33 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row">
<th class="entry">
<div class="p">Issue ID</div>
</th>
<th class="entry">
<div class="p">Description</div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row rowsep">
<td class="entry">
<div class="p">PAN-337297</div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where new GlobalProtect App users could not obtain
portal configuration after successful authentication. With this fix,
GlobalProtect App users successfully receive portal configurations.
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/addressed/12.1.7-h5.html
+329
View File
@@ -0,0 +1,329 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row">
<th class="entry">
<div class="p">Issue ID</div>
</th>
<th class="entry">
<div class="p">Description</div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row rowsep">
<td class="entry">
<div class="p">—</div>
</td>
<td class="entry relcol">
<div class="p">
Fixes were made to address the following CVEs:
<ul id="pan_os_12_1_7_h5_addressed_issues_ul-d2c_441_nkc" class="ul">
<li class="li">
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0310"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0310</a
>
</li>
<li class="li">
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0309"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0309</a
>
</li>
</ul>
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-334722</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall introduced out-of-order packet
delivery for certain data streams, which resulted in clients receiving
data in an incorrect sequence.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329637</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the push scope window did not display the target
devices when attempting to push configurations from Panorama, which
required manual selection of templates or device groups. With this
fix, the push scope window now correctly populates with the intended
push scope.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329359</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the Panorama web interface showed blank Host
Information Profile (HIP) Match log entries when opened in Detailed
Log View. With this fix, the Detailed Log View now displays the
expected information for HIP Match logs.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329180</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where Panorama did not automatically resume syslog
forwarding over TCP after the syslog server became unavailable or was
restarted.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-327590</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where BFD sessions did not reestablish on the newly
elected leader after a leader failover event that occurred when the
previous leader node was suspended.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325903</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, after upgrading Panorama, a custom admin role
with Object Level Changes disabled did not automatically populate
out-of-sync firewalls in the push scope.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325724</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where importing PKCS12 certificates failed with the
error
<span class="ph systemoutput"
>Import of certificate and private-key failed. Failed to extract
certificate</span
>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325613</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>PA-7500 firewalls in HA cluster configurations only</tt
>) Fixed an issue where interfaces intermittently remained offline
after a cluster failover.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-324652</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where selective configuration pushes from Panorama
failed after an upgrade, which caused shared policy rules to go out of
sync. With this fix, selective configuration pushes complete
successfully and policies remain in sync.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-323249</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">M-700 appliances only</tt>) Fixed an issue where
the Elasticsearch processes repeatedly restarted and log collectors
showed the Elasticsearch health status as red.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-322398</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall sent a BFD admin down message during
an NGFW cluster failover, which caused BGP sessions to terminate and
routes to be lost.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-321699</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where device telemetry intermittently failed to send
files, which resulted in critical alerts in system files.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319838</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where SFP ports did not establish a link with a
third-party peer device when forced speed was configured on the
firewall and the peer device was set to
<span class="ph systemoutput">nonegotiate</span>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-318120</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where SSL traffic was silently dropped when traffic was
processed by a Security policy with an Anti-Spyware profile that had
Inline cloud Analysis enabled for SSL C2 Detector with an action other
than allow or alert.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-318106</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where SCM did not update device telemetry for the
firewall after upgrading to an affected release.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316721</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where multiple EDL fetches were queued and did not
complete.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314776</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>configd</a
>
process stopped responding after pushing configuration changes from
Panorama to the firewall.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314630</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall repeatedly rebooted and entered
maintenance mode, and a factory reset was required.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312685</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where committing a scheduled configuration push on
Panorama caused the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>configd</a
>
process to stop responding unexpectedly.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-309676</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on Panorama where a database component unexpectedly
stopped when Panorama was deployed using an .ova file or
upgraded/downgraded to an affected PAN-OS version. This occurred due
to a required directory not being created during the initial
provisioning workflow. With this fix, the necessary directory is
created automatically during deployment.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-308775</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Firewalls in active/passive configurations only</tt
>) Fixed an issue where NTP status intermittently showed as rejected
on the active firewall, which prevented the firewalls from
synchronizing time.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-308444</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where pushing multiple policy rules failed when the
policy rules contained a large number of dynamic address object groups
or user groups.
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/addressed/12.1.7-h6.html
+45
View File
@@ -0,0 +1,45 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row">
<th class="entry">
<div class="p">Issue ID</div>
</th>
<th class="entry">
<div class="p">Description</div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row rowsep">
<td class="entry">
<div class="p"><b class="ph b">PAN-337297</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where new GlobalProtect App users could not obtain
portal configuration after successful authentication. With this fix,
GlobalProtect App users successfully receive portal configurations.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-334871</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where DHCPv6 relay failed on sub-interfaces when the
Advanced Routing Engine was in use with DHCP IPv4 and IPv6 enabled.
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/addressed/12.1.9.html
+500
View File
@@ -0,0 +1,500 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row">
<th class="entry">
<div class="p">Issue ID</div>
</th>
<th class="entry">
<div class="p">Description</div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row">
<td class="entry">
<div class="p">PAN-331636</div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the web server failed to start after an upgrade,
which caused the management interface to become inaccessible.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329834</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a memory leak associated with some display CLI
commands caused instability.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329180</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where Panorama did not automatically resume syslog
forwarding over TCP after the syslog server became unavailable or was
restarted.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-328742</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the dataplane silently dropped HTTP POST
payloads, which disrupted application integrations. This occurred due
to an internal error when processing XFF headers within the CTD
engine.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-327590</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where BFD sessions did not reestablish on the newly
elected leader after a leader failover event that occurred when the
previous leader node was suspended.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-327460</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a
<span class="ph uicontrol">Commit and Push</span> operation on
Panorama did not successfully push configuration changes to Prisma
Access endpoints. This occurred when the system reported that not all
commit jobs were triggered. With this fix,
<span class="ph uicontrol">Commit and Push</span> operations now
correctly apply configurations to Prisma Access.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-326354</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>sslmgr</a
>
process stopped responding when attempting to display the OSCP host
cache.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325613</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>PA-7500 firewalls in HA cluster configurations only</tt
>) Fixed an issue where interfaces intermittently remained offline
after a cluster failover.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325002</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Google Cloud NGFW Enterprise VM-Series firewalls only</tt
>) Fixed an issue where the HTTP2 threat logs did not include VPC ID,
Security_key, and Endpoint ID.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-324902</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where exporting Custom Reports to CSV failed with a
<span class="ph systemoutput">UnicodeEncodeError</span> message when
report entries contained multibyte characters.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-323249</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">M-700 appliances only</tt>) Fixed an issue where
the Elasticsearch processes repeatedly restarted and log collectors
showed the Elasticsearch health status as red.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-320345</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall repeatedly restarted when the
monitored User-ID server became unreachable during Kerberos
authentication connection attempts, which caused the authentication
process to stop responding. On firewalls in HA configurations, both
peer firewalls entered maintenance mode.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319838</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where SFP ports did not establish a link with a
third-party peer device when forced speed was configured on the
firewall and the peer device was set to
<span class="ph systemoutput">nonegotiate</span>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319504</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where telemetry data was not sent to the cloud due to
the firewall being unable to resolve the destination server's FQDN
even when a proxy server was configured. With this fix, the firewall
properly sends telemetry data through the configured proxy server
without requiring direct public DNS resolution for the telemetry
server's FQDN.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-318580</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where processes restarted and the firewall unexpectedly
rebooted when you configured a Security policy rule with
<span class="ph uicontrol">Source Device &gt; quarantine</span>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-318382</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Firewalls in HA configurations only</tt>) Fixed an
issue where the secondary firewall remained at an
<span class="ph uicontrol">Initial</span> state after an upgrade.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-317598</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Firewalls in active/active HA configurations only</tt
>) Fixed an issue where NAT failures occurred due to the IP pool not
releasing unused resources in the Active Secondary firewall. This
occurred because the secondary firewall attempts to release a
Persistent DIPP NATed port that was originally allocated by the NAT
policy from first firewall, leading to a ownership mismatch during the
session teardown process.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-317214</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where SNMP queries for TCP connections per second (CPS)
metrics on single vsys firewalls returned inconsistent values.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316720</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on log collectors where
<span class="ph uicontrol">Verify Update Server Identity</span> was
not consistently enabled and visible in the XML configuration after a
configuration push from Panorama.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p">PAN-315959</div>
</td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">M-700 appliances only</tt>) Fixed an issue where
Panorama displayed an incorrect maximum recommended configuration size
when performing a commit.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314776</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>configd</a
>
process stopped responding after pushing configuration changes from
Panorama to the firewall.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314061</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where traffic was disrupted during IPSec rekey
operations due to a 2 second delay in sending the DELETE message for
the previous Security Association (SA) to the peer gateway after a new
SA was negotiated.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313850</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>PA-1400 Series firewalls in HA configurations only</tt
>) Fixed an issue where a split-brain condition occurred and HA1/HA2
links went down while upgrading when the HA configuration used
dataplane interfaces for HA1 and a combination of HSCI and Ethernet
interfaces for HA2.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313218</div></td>
<td class="entry relcol">
<div class="p">
Added the following CLI commands to address QoS packet drops due to
bursty traffic:
</div>
<ul class="ul">
<li class="li">
<span class="ph systemoutput"
>debug dataplane set qos-setting qos-param qlimit 300</span
>
</li>
<li class="li">
<span class="ph systemoutput"
>debug dataplane set qos-setting qos-param red low 50 high
90</span
>
</li>
</ul>
<div class="p">
To utilize this fix, change the parameters, disable QoS, commit
changes, enable QOS, and then re-commit changes.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313190</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">VM-Series firewalls only</tt>) Fixed an issue where
content updates and configuration commits failed with the error
message
<span class="ph systemoutput"
>client device phase 1 failure error</span
>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312685</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where committing a scheduled configuration push on
Panorama caused the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>configd</a
>
process to stop responding unexpectedly.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312330</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Firewalls in active/passive HA configurations only</tt
>) Fixed an issue where the Clientless VPN applications failed to load
due to the firewall dataplane incorrectly processing session
information.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311988</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Firewalls in FIPS mode only</tt>) Fixed decryption
issues that occurred after an upgrade to an affected release.
</div>
<div class="p">
To enable this fix, run the CLI command
<span class="ph systemoutput"
>debug dataplane set ssl-decrypt low-memory-throttle enable</span
>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311624</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on Panorama where, when an Aggregate Ethernet interface
was configured in override mode within a template stack, changing its
management profile unexpectedly overrode other interface-specific
variables.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310699</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall stripped the Authentication Key
Identifier (AKID) from certificates using SSL decryption, which
prevented clients from authenticating server certificates and resulted
in decryption failures.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-309306</div></td>
<td class="entry relcol">
<div class="p">
Fixed a rare issue on Octeon Dataplane platforms where the firewall
experienced an unexpected dataplane restart due to a race condition
that occurred during session teardown for traffic undergoing
software-based Content Threat detection.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-308614</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>mgmt</a
>
process stopped responding after an upgrade during SSH Key Exchange
verification.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-302175</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, after upgrading an LSVPN portal/gateway to an
affected release, the portal was unable to issue and transfer
certificates to the satellite firewalls, which led to repeated
certificate requests and prevented the satellite firewalls from
authenticating to the gateway.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-297818</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on Panorama where exporting managed device information
that included a PA-450R-5G appliance resulted in the
<span class="ph uicontrol">Cellular Firmware</span> field being
exported into multiple cells.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-252699</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where frequent session failures occurred due to CTD
resource exhaustion.
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/addressed/12.2.3.html
+213
View File
@@ -0,0 +1,213 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead" data-sticky-top="62" style="top: 62px">
<tr class="row rowsep">
<th class="entry">
<div class="p"><b class="ph b">Issue ID</b></div>
</th>
<th class="entry">
<div class="p"><b class="ph b">Description</b></div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row">
<td class="entry">
<div class="p">—</div>
</td>
<td class="entry relcol">
<div class="p">
Fixes were made to address the following CVEs:
<ul id="pan_os_12_2_3_addressed_issues_ul-d2c_441_nkc" class="ul">
<li class="li">
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0310"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0310</a
>
</li>
<li class="li">
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0309"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0309</a
>
</li>
</ul>
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-334992</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a PA-455 firewall in FIPS-CC mode did not start
correctly after upgrading from PAN-OS 12.1.8 to 12.2.2.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-334724</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where installing WildFire® content updates disabled
PAN-OS Shield.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-334338</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a PA-450 firewall restarted with the error
<span class="ph codeph"
>general system-shutdown 1: The system is shutting down due to md
initiated dataplane restarts exhausted</span
>.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-331856</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the dnsproxyd process became unresponsive on
TCP/53 connections on VM-Series firewalls.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-329550</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where PA-5280 firewalls experienced multiple
all_pktproc process restarts, resulting in the dataplane going down
and an HA failover.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-329407</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, after upgrading a PA-450R-5G firewall, the
cellular interface did not come up and entered a Dead Zone state.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-326056</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where some ACE applications did not match the correct
security policy when the service was set to Application Default on
PA-5450 firewalls.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-325724</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where importing a PKCS12 certificate on Panorama®
failed with the error
<span class="ph codeph"
>Import of certificate and private-key failed. Failed to extract
certificate</span
>.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-319343</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where management plane resource exhaustion caused
commit latency across Prisma® Access gateways.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-315630</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a PA-450 firewall dropped new connections with
the error
<span class="ph codeph"
>Packet dropped, session allocation failure</span
>.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-310218</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where hidden NFS files under
<span class="ph codeph">/opt/var/s7/lp/log/pan</span> filled up disk
space on PA-7080 firewalls.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p"><b class="ph b">PAN-295806</b></div>
</td>
<td class="entry relcol">
<div class="p">
Fixed a memory leak in the connection handling process.
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/known/12.1.10.html
+242
View File
@@ -0,0 +1,242 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row">
<th class="entry">
<div class="p">Issue ID</div>
</th>
<th class="entry">
<div class="p">Description</div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329665</div></td>
<td class="entry relcol">
<div class="p">
After an Internet of Things (IoT) update, the
<span class="ph systemoutput">TLSv1.3_Default</span> SSL TLS profiles
and their associated certificates disappear from Panorama appliances.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313669</div></td>
<td class="entry relcol">
<div class="p">
(PA-5500 Series firewalls in cluster configurations only) When a
firewall node is removed from a PA-5500 Series cluster, after the
cluster commit and reboot, the node starts in standalone mode with a
default virtual wire (vwire) configuration loaded. This default
configuration is missing zone assignments for ports eth1/1 and eth1/2,
which causes commit operations to fail. Even if zones are manually
assigned to these ports, subsequent commit attempts will fail with a
"no UUId for rule1" error.
</div>
<div class="p">
<span class="ph uicontrol">Workaround:</span> To resolve this, either:
</div>
<ul class="ul">
<li class="li">
Manually assign zone configurations to ports eth1/1 (e.g., untrust)
and eth1/2 (e.g., trust), then open and close security policy rule1
without making changes, and
<span class="ph uicontrol">Commit</span>.
</li>
<li class="li">
Delete the default rule and the default virtual wire Ethernet
interfaces, then commit.
</li>
</ul>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312143</div></td>
<td class="entry relcol">
<div class="p">
(Firewalls in active/passive high availability (HA) configurations
only) When attempting to synchronize the running configuration with an
HA peer, particularly during script runs involving different topology
builds (e.g., during a smoke runlist), the synchronization process
fails. This results in an error indicating that the running
configuration could not be synchronized with the HA peer.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311601</div></td>
<td class="entry relcol">
<div class="p">
If the node is seen stuck with fault "session clearing fault". Node
reboot is the workaround to get the node back in online state after
all other fault conditions are removed.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-300230</div></td>
<td class="entry relcol">
<div class="p">
(NGFW Cluster) In an NGFW cluster, your pings to the HSCI-B link might
fail, even when the link indicates it is up. In the event that the
HSCI-A link is brought down or unplugged, the cluster node will
transition to failed state, avoiding split brain as both HSCI links
are down in this case. Workaround: Reboot the cluster node to resolve
the HSCI-B ping issue.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-299562</div></td>
<td class="entry relcol">
<div class="p">
When a client sends a Client Hello with Transport Layer Security (TLS)
1.3 or TLS 1.2, using only the p-192 elliptic curve and some
non-perfect forward secrecy (PFS) ciphers, the firewall discards the
Client Hello. The firewall should allow the connection to proceed
using TLS 1.2, maintaining backward compatibility with previous
releases.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-298083</div></td>
<td class="entry relcol">
<div class="p">
Draft for review: After you change the system mode on an M-700
appliance from Panorama mode to PAN-DB private cloud mode, the snmpd
process fails to work.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-297114</div></td>
<td class="entry relcol">
<div class="p">
After successfully generating a health check report for managed
firewalls from Panorama, the progress bar does not appear and the
latest health check reports are not displayed (<span
class="ph uicontrol"
>Panorama &gt; Device Deployment &gt; Upgrade Check</span
>).
</div>
<div class="p">
<span class="ph uicontrol">Workaround</span>: Manually refresh the
page to see the latest reports.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-295946</div></td>
<td class="entry relcol">
<div class="p">
When a Panorama appliance (running PAN-OS 12.1.2 or higher) manages
firewalls running PAN-OS versions lower than 12.1.2, and an NTP server
configuration template includes SHA256 or SHA512 as the authentication
mechanism, pushing this template to the firewalls running PAN-OS
versions lower than 12.1.2 will cause the commit operation to fail.
Workaround: Create two separate templates: one for firewalls running
PAN-OS 12.1.2 or higher (which can include SHA256/SHA512
authentication) and another for firewalls running PAN-OS versions
lower than 12.1.2 (which should use other authentication algorithms
such as SHA1, MD5, or Autokey). Then, push the appropriate template to
the corresponding devices from Panorama.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-294752</div></td>
<td class="entry relcol">
<div class="p">
In any 15-second interval, if connectivity (CI or management) on a
GW-Node (not P-Node) changes more than once, with each change
occurring on a different node and affecting a different link, the
cluster loses its leader, all routing protocols fail, and traffic is
blackholed if route changes occur in the network.
</div>
<div class="p">
Workaround: Reboot nodes that are in a FAILED state or suspend and
unsuspend any online GW-Node (not P-Node).
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-293718</div></td>
<td class="entry relcol">
<div class="p">
Draft for review: When high speed logging is enabled on a PA-5560
device, the expected warning message is not displayed on the web
interface. This prevents administrators from being notified that logs
can only be viewed from Panorama.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-292601</div></td>
<td class="entry relcol">
<div class="p">
PAN-OS 12.1.2 and later 12.1 releases support a Load Balanced DNS
configuration for an address object. If there are two address objects
with same FQDN, but one object has Load Balanced DNS enabled and other
object has Load Balanced DNS disabled, then the policy match for the
removed IP addresses doesn't work as expected. Workaround: Enable (or
disable) Load Balanced DNS consistently for an FQDN that is used with
multiple address objects.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-289524</div></td>
<td class="entry relcol">
<div class="p">
In PAN-OS 12.1.2 and later and PAN-OS 12.2.2 and later releases,
PAN-OS can obtain resolved IP addresses from a load-balanced DNS
server and use them in a policy match. However, this functionality
does not work as intended when the DNS cache reuse flag is enabled.
When the DNS cache reuse flag is enabled, the DNS resolution works as
if the load-balanced DNS flag (for an address object) is disabled.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-283028</div></td>
<td class="entry relcol">
<div class="p">
The following error is thrown when an existing template overrides the
SD-WAN configuration followed by the commit and push from Panorama to
the firewall.
</div>
<div class="p">
BGP is invalid. AS number does not fit in 2 byte AS format
</div>
<div class="p">
This issue occurs because different AS formats are present on the
Panorama and the firewall (the firewall configuration is generated by
the SD-WAN plugin). That is, both the hub and branch firewall must
have the same AS format in hub-and-spoke topology. In full mesh
topology, all the firewalls must have the same AS format.
</div>
</td>
</tr>
</tbody>
</table>
reference/PAN-OS/known/12.1.9.html
+225
View File
@@ -0,0 +1,225 @@
<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row">
<th class="entry">
<div class="p">Issue ID</div>
</th>
<th class="entry">
<div class="p">Description</div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313669</div></td>
<td class="entry relcol">
<div class="p">
(PA-5500 Series firewalls in cluster configurations only) When a
firewall node is removed from a PA-5500 Series cluster, after the
cluster commit and reboot, the node starts in standalone mode with a
default virtual wire (vwire) configuration loaded. This default
configuration is missing zone assignments for ports eth1/1 and eth1/2,
which causes commit operations to fail. Even if zones are manually
assigned to these ports, subsequent commit attempts will fail with a
"no UUId for rule1" error.
</div>
<div class="p">
<span class="ph uicontrol">Workaround:</span> To resolve this, either:
</div>
<ul class="ul">
<li class="li">
Manually assign zone configurations to ports eth1/1 (e.g., untrust)
and eth1/2 (e.g., trust), then open and close security policy rule1
without making changes, and
<span class="ph uicontrol">Commit</span>.
</li>
<li class="li">
Delete the default rule and the default virtual wire Ethernet
interfaces, then commit.
</li>
</ul>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312143</div></td>
<td class="entry relcol">
<div class="p">
(Firewalls in active/passive high availability (HA) configurations
only) When attempting to synchronize the running configuration with an
HA peer, particularly during script runs involving different topology
builds (e.g., during a smoke runlist), the synchronization process
fails. This results in an error indicating that the running
configuration could not be synchronized with the HA peer.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311601</div></td>
<td class="entry relcol">
<div class="p">
If the node is seen stuck with fault "session clearing fault". Node
reboot is the workaround to get the node back in online state after
all other fault conditions are removed.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-300667</div></td>
<td class="entry relcol">
<div class="p">
Panorama cannot display Threat log entries (Monitor &gt; Logs &gt;
Threat) when the managed log collector is running a lower PAN-OS
release than Panorama. Workaround: Upgrade the log collectors to the
same version as Panorama.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-300230</div></td>
<td class="entry relcol">
<div class="p">
(NGFW Cluster) In an NGFW cluster, your pings to the HSCI-B link might
fail, even when the link indicates it is up. In the event that the
HSCI-A link is brought down or unplugged, the cluster node will
transition to failed state, avoiding split brain as both HSCI links
are down in this case. Workaround: Reboot the cluster node to resolve
the HSCI-B ping issue.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-299562</div></td>
<td class="entry relcol">
<div class="p">
When a client sends a Client Hello with Transport Layer Security (TLS)
1.3 or TLS 1.2, using only the p-192 elliptic curve and some
non-perfect forward secrecy (PFS) ciphers, the firewall discards the
Client Hello. The firewall should allow the connection to proceed
using TLS 1.2, maintaining backward compatibility with previous
releases.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-298083</div></td>
<td class="entry relcol">
<div class="p">
Draft for review: After you change the system mode on an M-700
appliance from Panorama mode to PAN-DB private cloud mode, the snmpd
process fails to work.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-295946</div></td>
<td class="entry relcol">
<div class="p">
When a Panorama appliance (running PAN-OS 12.1.2 or higher) manages
firewalls running PAN-OS versions lower than 12.1.2, and an NTP server
configuration template includes SHA256 or SHA512 as the authentication
mechanism, pushing this template to the firewalls running PAN-OS
versions lower than 12.1.2 will cause the commit operation to fail.
Workaround: Create two separate templates: one for firewalls running
PAN-OS 12.1.2 or higher (which can include SHA256/SHA512
authentication) and another for firewalls running PAN-OS versions
lower than 12.1.2 (which should use other authentication algorithms
such as SHA1, MD5, or Autokey). Then, push the appropriate template to
the corresponding devices from Panorama.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-294752</div></td>
<td class="entry relcol">
<div class="p">
In any 15-second interval, if connectivity (CI or management) on a
GW-Node (not P-Node) changes more than once, with each change
occurring on a different node and affecting a different link, the
cluster loses its leader, all routing protocols fail, and traffic is
blackholed if route changes occur in the network.
</div>
<div class="p">
Workaround: Reboot nodes that are in a FAILED state or suspend and
unsuspend any online GW-Node (not P-Node).
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-293718</div></td>
<td class="entry relcol">
<div class="p">
Draft for review: When high speed logging is enabled on a PA-5560
device, the expected warning message is not displayed on the web
interface. This prevents administrators from being notified that logs
can only be viewed from Panorama.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-292601</div></td>
<td class="entry relcol">
<div class="p">
PAN-OS 12.1.2 and later 12.1 releases support a Load Balanced DNS
configuration for an address object. If there are two address objects
with same FQDN, but one object has Load Balanced DNS enabled and other
object has Load Balanced DNS disabled, then the policy match for the
removed IP addresses doesn't work as expected. Workaround: Enable (or
disable) Load Balanced DNS consistently for an FQDN that is used with
multiple address objects.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-289524</div></td>
<td class="entry relcol">
<div class="p">
In PAN-OS 12.1.2 and later and PAN-OS 12.2.2 and later releases,
PAN-OS can obtain resolved IP addresses from a load-balanced DNS
server and use them in a policy match. However, this functionality
does not work as intended when the DNS cache reuse flag is enabled.
When the DNS cache reuse flag is enabled, the DNS resolution works as
if the load-balanced DNS flag (for an address object) is disabled.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-283028</div></td>
<td class="entry relcol">
<div class="p">
The following error is thrown when an existing template overrides the
SD-WAN configuration followed by the commit and push from Panorama to
the firewall.
</div>
<div class="p">
BGP is invalid. AS number does not fit in 2 byte AS format
</div>
<div class="p">
This issue occurs because different AS formats are present on the
Panorama and the firewall (the firewall configuration is generated by
the SD-WAN plugin). That is, both the hub and branch firewall must
have the same AS format in hub-and-spoke topology. In full mesh
topology, all the firewalls must have the same AS format.
</div>
</td>
</tr>
</tbody>
</table>