Remove dates from issue filenames
This commit is contained in:
@@ -0,0 +1,726 @@
|
||||
---
|
||||
type: Known
|
||||
product: PAN-OS
|
||||
version: 11.0.0
|
||||
---
|
||||
|
||||
## WF500-5632
|
||||
|
||||
The number of registered WildFire appliances
|
||||
reported in Panorama (PanoramaManaged WildFire AppliancesFirewalls ConnectedView) does not accurately reflect the
|
||||
current status of connected WildFire appliances.
|
||||
|
||||
## PAN-260851
|
||||
|
||||
From the NGFW or Panorama CLI, you can override the existing
|
||||
application tag even if Disable Override is enabled for the
|
||||
application (ObjectsApplications) tag.
|
||||
|
||||
## PAN-250062
|
||||
|
||||
Device telemetry might fail at configured intervals due to bundle generation issues.
|
||||
|
||||
## PAN-234408
|
||||
|
||||
Enterprise DLP cannot detect and block non-file based traffic for
|
||||
ChatGPT from traffic forwarded to the DLP cloud service from an
|
||||
NGFW.
|
||||
|
||||
## PAN-234015
|
||||
|
||||
The X-Forwarded-For (XFF) value is not displayed in traffic logs.
|
||||
|
||||
## PAN-243951
|
||||
|
||||
On the Panorama management sever in an active/passive High
|
||||
Availability (HA) configuration, managed devices (PanoramaManaged DevicesSummary) display as out-of-sync
|
||||
on the passive HA peer when configuration changes are made to the
|
||||
SD-WAN (PanoramaSD-WAN) configuration on the active HA peer.
|
||||
|
||||
Workaround: Manually synchronize the Panorama HA peers.
|
||||
|
||||
1. Log in to the Panorama web
|
||||
interface on the active HA peer.
|
||||
2. Select Commit and Commit to
|
||||
Panorama the SD-WAN configuration changes on
|
||||
the active HA peer.
|
||||
On the passive HA peer, select PanoramaManaged DevicesSummary and observe that the managed devices are now
|
||||
out-of-sync.
|
||||
3. Log in to the primary HA peer Panorama CLI and
|
||||
trigger a manual synchronization between the active and
|
||||
secondary HA peers.
|
||||
request high-availability sync-to-remote
|
||||
running-config
|
||||
4. Log back in to the active HA peer Panorama web interface and
|
||||
select CommitPush to Devices and Push.
|
||||
|
||||
## PAN-242910
|
||||
|
||||
On the Panorama management server, Panorama administrators (PanoramaAdministrators) that are assigned a custom Panorama admin role (PanoramaAdmin Roles) with Push All Changes enabled
|
||||
are unable to push configuration changes to managed firewalls when
|
||||
Managed Devices and Push For
|
||||
Other Admins are disabled.
|
||||
|
||||
## PAN-241041
|
||||
|
||||
On the Panorama management server exporting template or template
|
||||
stack variables (PanoramaTemplates) in CSV format results in an empty CSV file.
|
||||
|
||||
## PAN-229702
|
||||
|
||||
After upgrading a Panorama HA pair to PAN-OS 11.1, the ElasticSearch
|
||||
connectivity might fail to establish. The issue occurs because the
|
||||
client certificate on one of the Panorama devices does not have the
|
||||
necessary Extended Key Usage (EKU) set for server authentication,
|
||||
which is required for secure TLS communication.
|
||||
|
||||
Workaround:Contact Customer Support to renew the root client
|
||||
certificate.
|
||||
|
||||
## PAN-228515
|
||||
|
||||
The EleasticSearch SSH flaps on the M-600 appliance in Panorama or
|
||||
Log Collector mode. This causes logs to not display on the Panorama
|
||||
management server (MonitorLogs) and the Log Collector health status (PanoramaManaged CollectorsStatus) to display as degraded.
|
||||
|
||||
## PAN-228273
|
||||
|
||||
On the Panorama management server in FIPS-CC mode, the ElasticSearch
|
||||
cluster fails to come up and the show
|
||||
log-collector-es-cluster health command displays
|
||||
the status is
|
||||
red. This results in log ingestion
|
||||
issues for Panorama in Panorama only or Log Collector mode.
|
||||
|
||||
## PAN-227344
|
||||
|
||||
On the Panorama management server, PDF Summary Reports (MonitorPDF ReportsManage PDF Summary) display no data and are blank when predefined
|
||||
reports are included in the summary report.
|
||||
|
||||
## PAN-225886
|
||||
|
||||
If you enable explicit proxy mode for the web proxy, intermittent
|
||||
errors and unexpected TCP reconnections may occur.
|
||||
|
||||
## PAN-225337
|
||||
|
||||
On the Panorama management server, the configuration push to a
|
||||
multi-vsys firewall fails if you:
|
||||
|
||||
1. Create a Shared and vsys-specific
|
||||
device group configuration object with an indentical name.
|
||||
For example, a Shared address object
|
||||
called SharedAO1 and a
|
||||
vsys-specific address object also called
|
||||
SharedAO1.
|
||||
2. Reference the Shared object in another
|
||||
Shared configuration. For
|
||||
example, reference the Shared address
|
||||
object (SharedAO1) in a
|
||||
Shared address group called
|
||||
SharedAG1.
|
||||
3. Use the Shared configuration object
|
||||
with the reference in a vsys-specific configuration. For
|
||||
example, reference the Shared address
|
||||
group (SharedAG1) in a
|
||||
vsys-specific policy rule.
|
||||
|
||||
Workaround: Select PanoramaSetupManagement and edit the Panorama Settings to enable one of the
|
||||
following:
|
||||
|
||||
- Shared Unused Address and Service Objects with
|
||||
Devices—This options pushes all
|
||||
Shared objects, along with device
|
||||
group specific objects, to managed firewalls.
|
||||
This is a global setting and applies to all managed
|
||||
firewalls, and may result in pushing too many configuration
|
||||
objects to your managed firewalls.
|
||||
- Objects defined in ancestors will take higher
|
||||
precedence—This option specifies that in the event
|
||||
of objects with the same name, ancestor object take
|
||||
precedence over descendent objects. In this case, the
|
||||
Shared objects take precedence
|
||||
over the vsys-specific object.
|
||||
This is a global setting and applies to all managed
|
||||
firewalls. In the example above, if the IP address for the
|
||||
Shared
|
||||
SharedAO1 object was
|
||||
10.1.1.1 and the device
|
||||
group specific SharedAO1 was
|
||||
10.2.2.2, the
|
||||
10.1.1.1 IP address takes
|
||||
precedence.
|
||||
|
||||
Alternatively, you can remove the duplicate address objects from the
|
||||
device group configuration to allow only the
|
||||
Shared objects in your configuration.
|
||||
|
||||
## PAN-223488
|
||||
|
||||
Closed ElasticSearch shards are not deleted from the Panorama
|
||||
M-Series and virtual appliance. This causes the ElasticSearch shard
|
||||
purging to not work as expected, resulting in high disk usage.
|
||||
|
||||
## PAN-223365
|
||||
|
||||
The Panorama management server is unable to query any logs if the
|
||||
ElasticSearch health status for any Log Collector (PanoramaManaged Collector is degraded.
|
||||
|
||||
Workaround:
|
||||
Log in to the Log Collector
|
||||
CLI and restart ElasticSearch.
|
||||
|
||||
admindebug elasticsearch es-restart all
|
||||
|
||||
## PAN-222586
|
||||
|
||||
On PA-5410, PA-5420, PA-5430, and PA-5440 firewalls, the Filter
|
||||
dropdown menus, Forward Methods, and Built-In Actions for
|
||||
Correlation Log settings (DeviceLog Settings) are not displayed and cannot be configured.
|
||||
|
||||
## PAN-222253
|
||||
|
||||
On the Panorama management server, policy rulebase reordering when
|
||||
you View Rulebase by Groups (Policy<policy-rulebase>) does not persist if you reorder the policy rulebase
|
||||
by dragging and dropping individual policy rules and then moving the
|
||||
entire tag group.
|
||||
|
||||
## PAN-221015
|
||||
|
||||
On M-600 appliances in Panorama or Log Collector mode, the
|
||||
es-1 and
|
||||
es-2 ElasticSearch processes fail
|
||||
to restart when the M-600 appliance is rebooted. The results in the
|
||||
Managed Collector ES health status (PanoramaManaged CollectorsHealth Status) to be degraded.
|
||||
|
||||
Workaround:
|
||||
Log in to the Panorama or Log
|
||||
Collector CLI experiencing degraded ElasticSearch health
|
||||
and restart all ElasticSearch processes.
|
||||
|
||||
admin>debug elasticsearch es-restart optional all
|
||||
|
||||
Code copied to clipboard
|
||||
|
||||
Unable to copy due to lack of browser support.
|
||||
|
||||
Copy
|
||||
|
||||
## PAN-220180
|
||||
|
||||
Configured botnet reports (MonitorBotnet) are not generated.
|
||||
|
||||
## PAN-219644
|
||||
|
||||
Firewalls forwarding logs to a syslog server over TLS (ObjectsLog Forwarding) use the default Palo Alto Networks certificate
|
||||
instead of the custom certificate configured on the firewall.
|
||||
|
||||
## PAN-218521
|
||||
|
||||
The ElasticSearch process on the M-600 appliance in Log Collector
|
||||
mode may enter a continuous reboot cycle. This results in the M-600
|
||||
appliance becoming unresponsive, consuming logging disk space, and
|
||||
preventing new log ingestion.
|
||||
|
||||
## PAN-217307
|
||||
|
||||
The following Security policy rule (PoliciesSecurity) filters return no results:
|
||||
|
||||
log-start eq no
|
||||
|
||||
log-end eq no
|
||||
|
||||
log-end eq yes
|
||||
|
||||
## PAN-216214
|
||||
|
||||
For Panorama-managed firewalls in an Active/Active High Availability
|
||||
(HA) configuration where you configure the firewall HA settings (DeviceHigh Availability) in a template or template stack (PanoramaTemplates), performing a local commit on one of the HA
|
||||
firewalls triggers an HA config sync on the peer firewall. This
|
||||
causes the HA peer configuration to go Out of
|
||||
Sync.
|
||||
|
||||
## PAN-215778
|
||||
|
||||
On the M-600 appliance in Management Only mode, XML API Get requests
|
||||
for /config fail with the following
|
||||
error due to exceeding the total configuration size
|
||||
supported on the M-600 appliance.
|
||||
|
||||
504 Gateway timeout
|
||||
|
||||
## PAN-215082
|
||||
|
||||
M-300 and M-700 appliances may generate erroneous system logs (MonitorLogsSystem) to alert that the M-Series appliance memory usage
|
||||
limits are reached.
|
||||
|
||||
## PAN-213746
|
||||
|
||||
On the Panorama management server, the Hostkey
|
||||
displayed as undefined undefined if you
|
||||
override an SSH Service Profile (DeviceCertificate ManagementSSH Service Profile) Hostkey configured in a Template from the Template
|
||||
Stack.
|
||||
|
||||
## PAN-213119
|
||||
|
||||
PA-5410 and PA-5420 firewalls display the following error when you
|
||||
view the Block IP list (MonitorBlock IP):
|
||||
|
||||
show -> dis-block-table is
|
||||
unexpected
|
||||
|
||||
## PAN-212889
|
||||
|
||||
On the Panorama management server, different threat names are used
|
||||
when querying the same threat in the Threat Monitor (MonitorApp ScopeThreat Monitor) and ACC. This results in the
|
||||
ACC displaying no data to display when
|
||||
you are redirected to the ACC after clicking a threat name in the
|
||||
Threat Monitor and filtering the same threat name in the Global
|
||||
Filters.
|
||||
|
||||
## PAN-212533
|
||||
|
||||
Modifying the Administrator Type for an
|
||||
existing administrator (DeviceAdministrators or PanoramaAdministrators) from Superuser to a
|
||||
Role-Based custom admin, or vice versa,
|
||||
does not modify the access privileges of the administrator.
|
||||
|
||||
## PAN-211531
|
||||
|
||||
On the Panorama management server, admins can still
|
||||
perform a selective push to managed firewalls when Push All
|
||||
Changes and Push for Other Admins
|
||||
are disabled in the admin role profile (PanoramaAdmin Roles).
|
||||
|
||||
## PAN-209937
|
||||
|
||||
Certificate-based authentication for administrator accounts may be
|
||||
unable to log into the Panorama or firewall web interface with the
|
||||
following error:
|
||||
|
||||
Bad Request - Your browser sent a request that this
|
||||
server could not understand
|
||||
|
||||
## PAN-208325
|
||||
|
||||
The following NextGen firewalls and Panorama management server models
|
||||
are unable to automatically renew the device certificate (DeviceSetupManagement or PanoramaSetupManagement).
|
||||
|
||||
- M-300 and M-700
|
||||
- PA-410 Firewall
|
||||
- PA-415 and PA-445 Firewalls
|
||||
- PA-440, PA-450, and PA-460 Firewalls
|
||||
- PA-1400 Series
|
||||
- PA-3400 Series
|
||||
- PA-5410, PA-5420, and PA-5430 Firewalls
|
||||
- PA-5440 Firewall
|
||||
- PA-5450 Firewall
|
||||
|
||||
Workaround: Log in to the firewall CLI or Panorama CLI and fetch the
|
||||
device certificate.
|
||||
|
||||
admin>request certificate fetch
|
||||
|
||||
## PAN-208189
|
||||
|
||||
Traffic fails to match and reach all destinations if a Security
|
||||
policy rule includes FQDN objects that resolve to two or more IP
|
||||
addresses.
|
||||
|
||||
## PAN-207770
|
||||
|
||||
Data filtering logs (MonitorLogsData Filtering)
|
||||
incorrectly display the traffic Direction as server-to-client instead
|
||||
of client-to-server for upload traffic
|
||||
that matches Enterprise data loss prevention (DLP) data patterns (ObjectsDLPData
|
||||
Filtering Patterns) in an Enterprise DLP data
|
||||
filtering profile (ObjectsDLPData Filtering Profiles).
|
||||
|
||||
## PAN-207733
|
||||
|
||||
When a DHCPv6 client is configured on HA
|
||||
Active/Passive firewalls, if the DHCPv6 server goes down, after
|
||||
the lease time expires, the DHCPv6 client should enter SOLICIT state
|
||||
on both the Active and Passive firewalls. Instead, the client is
|
||||
stuck in BOUND state with an IPv6 address having lease time 0 on
|
||||
the Passive firewall.
|
||||
|
||||
## PAN-207629
|
||||
|
||||
On the Panorama management server, selective push fails to managed
|
||||
firewalls if the managed firewalls are enabled with multiple vsys
|
||||
and the Push Scope contains shared objects in device groups.
|
||||
|
||||
## PAN-207616
|
||||
|
||||
On the Panorama management server, after
|
||||
selecting managed firewalls and creating a new Tag (PanoramaManaged DevicesSummary) the managed firewalls are
|
||||
automatically unselected and any new tag created is applied to the
|
||||
managed firewalls for which you initially created the new tag.
|
||||
|
||||
Workaround: Select
|
||||
and then unselect the managed firewalls for which you created a
|
||||
new tag.
|
||||
|
||||
## PAN-207611
|
||||
|
||||
When a DHCPv6 client is configured on HA
|
||||
Active/Passive firewalls, the Passive firewall sometimes crashes.
|
||||
|
||||
## PAN-207040
|
||||
|
||||
If you disable Advanced Routing, remove
|
||||
logical routers, and downgrade from PAN-OS 11.0.0 to a PAN-OS 10.2.x
|
||||
or 10.1.x release, subsequent commits fail and SD-WAN devices on
|
||||
Panorama have no Virtual Router name.
|
||||
|
||||
## PAN-206913
|
||||
|
||||
When a DHCPv6 client is configured on HA
|
||||
Active/Passive firewalls, releasing the IPv6 address from the client
|
||||
(using Release in the UI or using the request dhcp client ipv6 release all CLI
|
||||
command) releases the IPv6 address from the Active firewall, but
|
||||
not the Passive firewall.
|
||||
|
||||
## PAN-206909
|
||||
|
||||
The Dedicated Log Collector is unable to
|
||||
reconnect to the Panorama management server if the configd process
|
||||
crashes. This results in the Dedicated Log Collector losing connectivity
|
||||
to Panorama despite the managed collector connection Status (PanoramaManaged Collector)
|
||||
displaying connected and the managed colletor Health status displaying
|
||||
as healthy.
|
||||
|
||||
This results in the local Panorama config and
|
||||
system logs not being forwarded to the Dedicated Log Collector.
|
||||
Firewall log forwarding to the disconnected Dedicated Log Collector
|
||||
is not impacted.
|
||||
|
||||
Workaround: Restart the mgmtsrvr process
|
||||
on the Dedicated Log Collector.
|
||||
|
||||
1. Log in to the Dedicated Log Collector
|
||||
CLI.
|
||||
2. Confirm the Dedicated Log Collector is disconnected from
|
||||
Panorama.
|
||||
admin> show panorama-status
|
||||
Verify
|
||||
the Connected status is no.
|
||||
3. Restart the mgmtsrvr process.
|
||||
admin> debug software restart process management-server
|
||||
|
||||
## PAN-206416
|
||||
|
||||
On the Panorama management server, no data
|
||||
filtering log (MonitorLogsData Filtering) is generated
|
||||
when the managed firewall loses connectivity to the following cloud services,
|
||||
and as a result fails to forward matched traffic for inspection.
|
||||
|
||||
- DLP cloud service
|
||||
- Advanced Threat Protection inline cloud analysis service
|
||||
- Advanced URL Filtering cloud service
|
||||
|
||||
## PAN-206315
|
||||
|
||||
```caveat
|
||||
PA-1420 firewall only
|
||||
```
|
||||
|
||||
In an active/passive high
|
||||
availability (HA) configuration, the show session info CLI
|
||||
command shows that the passive firewall has packet rate and throughput
|
||||
values. The packet rate and throughput of the passive firewall should
|
||||
be zero since it is not processing traffic.
|
||||
|
||||
## PAN-206253
|
||||
|
||||
For PA-1400 and PA-3400 Series firewalls, the default log rate is set
|
||||
too low and the max configurable log rate is incorrectly capped
|
||||
resulting in the firewall not generating more than 6,826 logs per
|
||||
second.
|
||||
|
||||
## PAN-206005
|
||||
|
||||
```caveat
|
||||
PA-1400 Series, PA-3400 Series, and PA-5440 firewalls only
|
||||
```
|
||||
|
||||
The I7_misc memory pool on these platforms
|
||||
is undersized and can cause a loss of connectivity when reaching
|
||||
the limit of the memory pool. Certain features, like using a decryption
|
||||
profile with Strip ALPN disabled, can lead to depleting the memory
|
||||
pool and causing a connection loss.
|
||||
|
||||
Workaround: Disable
|
||||
HTTP2 by enabling Strip ALPN in the decryption profile or avoid
|
||||
usage of the I7_misc memory pool.
|
||||
|
||||
## PAN-205255
|
||||
|
||||
There is a rare PAN-OS issue that causes the dataplane to restart unexpectedly.
|
||||
|
||||
## PAN-205187
|
||||
|
||||
ElasticSearch may not start properly when a newly installed Panorama
|
||||
virtual appliance powers on for the first time, resulting in the
|
||||
Panorama virtual appliance being unable to query logs forwarded from
|
||||
the managed firewall to a Log Collector.
|
||||
|
||||
Workaround:
|
||||
Log in to the Panorama CLI
|
||||
and start the PAN-OS software.
|
||||
|
||||
admin>request restart software
|
||||
|
||||
## PAN-205009
|
||||
|
||||
```caveat
|
||||
PA-1420 firewall only
|
||||
```
|
||||
|
||||
In an active/passive high
|
||||
availability (HA) configuration, the show interface all, show-high availability interface ha2,
|
||||
and show high-availability all CLI
|
||||
commands display the HSCI port state as unknown on both the active
|
||||
and passive firewalls.
|
||||
|
||||
## PAN-204615
|
||||
|
||||
BGP sessions can flap even when an unrelated configuration is
|
||||
committed. This results in the BGP session going down and getting
|
||||
established again. As a result, BGP routes get exchanged again,
|
||||
which can lead to momentary traffic disruption if BGP routes were in
|
||||
use for establishing traffic.
|
||||
|
||||
## PAN-201910
|
||||
|
||||
PAN-OS security profiles might consume a
|
||||
large amount of memory depending on the profile configuration and
|
||||
quantity. In some cases, this might reduce the number of supported security
|
||||
profiles below the stated maximum for a given platform.
|
||||
|
||||
## PAN-201855
|
||||
|
||||
On the Panorama management server, cloning any template (PanoramaTemplates) corrupts certificates (DeviceCertificate ManagementCertificates) with the Block Private Key
|
||||
Export setting enabled across all templates. This
|
||||
results in managed firewalls experiencing issues wherever the
|
||||
corrupted certificate is referenced.
|
||||
|
||||
For example, you have template A, B, and C where templates A and B
|
||||
have certificates with the Block Private Key
|
||||
Export setting enabled. Cloning template C corrupts
|
||||
the certificates with Block Private Key
|
||||
Export setting enabled in templates A and B.
|
||||
|
||||
Workaround: After cloning a template, delete and re-import the
|
||||
corrupted certificates.
|
||||
|
||||
## PAN-199557
|
||||
|
||||
On M-600 appliances in an Active/Passive high availability (HA)
|
||||
configuration, the configd process
|
||||
restarts due to a memory leak on the
|
||||
Active Panorama HA peer. This
|
||||
causes the Panorama web interface and CLI to become unresponsive.
|
||||
|
||||
Workaround: Manually reboot the
|
||||
Active Panorama HA peer.
|
||||
|
||||
## PAN-197588
|
||||
|
||||
The PAN-OS ACC (Application Command Center)
|
||||
does not display a widget detailing statistics and data associated
|
||||
with vulnerability exploits that have been detected using inline
|
||||
cloud analysis.
|
||||
|
||||
## PAN-197419
|
||||
|
||||
```caveat
|
||||
PA-1400 Series firewalls only
|
||||
```
|
||||
|
||||
In NetworkInterfaceEthernet, the power over Ethernet
|
||||
(PoE) ports do not display a Tag value.
|
||||
|
||||
## PAN-197097
|
||||
|
||||
Large Scale VPN (LSVPN) does not support
|
||||
IPv6 addresses on the satellite firewall.
|
||||
|
||||
## PAN-196758
|
||||
|
||||
On the Panorama management server, pushing
|
||||
a configuration change to firewalls leveraging SD-WAN erroneously
|
||||
show the auto-provisioned BGP configurations for SD-WAN as being
|
||||
edited or deleted despite no edits or deletions being made when
|
||||
you Preview Changes (CommitPush to DevicesEdit Selections or CommitCommit and PushEdit Selections).
|
||||
|
||||
## PAN-196146
|
||||
|
||||
The VM-Series firewall on Azure does not
|
||||
boot up with a hostname (specified in an init-cgf.txt or user data)
|
||||
when bootstrapped.
|
||||
|
||||
## PAN-195968
|
||||
|
||||
```caveat
|
||||
PA-1400 Series firewalls only
|
||||
```
|
||||
|
||||
When using the CLI to configure power over Ethernet (PoE) on a non-PoE
|
||||
port, the CLI prints an error depending on whether an interface
|
||||
type was selected on the non-PoE port or not. If an interface type, such
|
||||
as tap, Layer 2, or virtual wire, was selected before PoE was configured,
|
||||
the error message will not include the interface name (eg. ethernet1/4).
|
||||
If an interface type was not selected before PoE was configured,
|
||||
the error message will include the interface name.
|
||||
|
||||
## PAN-195568
|
||||
|
||||
When PAN-OS 11.0 is installed on multiple data plane platforms, users
|
||||
are unable to connect to the GlobalProtect portal or gateway.
|
||||
|
||||
## PAN-195342
|
||||
|
||||
On the Panorama management server, Context
|
||||
Switch fails when you try to Context Switch from a managed firewall running
|
||||
PAN-OS 10.1.7 or earlier release back to Panorama and the following
|
||||
error is displayed:
|
||||
|
||||
Could not find start token '@start@'
|
||||
|
||||
## PAN-194978
|
||||
|
||||
```caveat
|
||||
PA-1400 Series firewalls only
|
||||
```
|
||||
|
||||
In NetworkInterfaceEthernet, hovering the mouse over
|
||||
a power over Ethernet (PoE) Link State icon
|
||||
does not display link speed and link duplex details.
|
||||
|
||||
## PAN-194424
|
||||
|
||||
```caveat
|
||||
PA-5450 firewall only
|
||||
```
|
||||
|
||||
Upgrading
|
||||
to PAN-OS 10.2.2 while having a log interface configured can cause
|
||||
both the log interface and the management interface to remain connected
|
||||
to the log collector.
|
||||
|
||||
Workaround: Restart the log receiver service
|
||||
by running the following CLI command:
|
||||
|
||||
debug software restart process log-receiver
|
||||
|
||||
## PAN-192282
|
||||
|
||||
```caveat
|
||||
PA-415 and PA-445 firewalls only
|
||||
```
|
||||
|
||||
In 1G mode, the MGT and Ethernet 1/1 port LEDs glow amber instead of
|
||||
green.
|
||||
|
||||
## PAN-187685
|
||||
|
||||
On the Panorama management server, the Template Status
|
||||
displays no synchronization status (PanoramaManaged DevicesSummary)
|
||||
after a bootstrapped firewall is successfully added to Panorama.
|
||||
|
||||
Workaround: After
|
||||
the bootstrapped firewall is successfully added to Panorama, log in to the Panorama web interface and
|
||||
select CommitPush
|
||||
to Devices.
|
||||
|
||||
## PAN-187407
|
||||
|
||||
The configured Advanced Threat Prevention
|
||||
inline cloud analysis action for a given model might not be honored
|
||||
under the following condition: If the firewall is set to Hold
|
||||
client request for category lookup and the action set
|
||||
to Reset-Both and the URL cache has been
|
||||
cleared, the first request for inline cloud analysis will be bypassed.
|
||||
|
||||
## PAN-186283
|
||||
|
||||
Templates appear out-of-sync on Panorama
|
||||
after successfully deploying the CFT stack using the Panorama plugin for
|
||||
AWS.
|
||||
|
||||
Workaround: Use CommitPush to Devices to synchronize
|
||||
the templates.
|
||||
|
||||
## PAN-184708
|
||||
|
||||
```caveat
|
||||
Panorama managed firewalls
|
||||
```
|
||||
|
||||
Scheduled report emails (MonitorPDF ReportsEmail Scheduler) are not emailed if:
|
||||
|
||||
- A scheduled report email contains
|
||||
a Report Group (MonitorPDF
|
||||
ReportsReport Group)
|
||||
which includes a SaaS Application Usage report.
|
||||
- A scheduled report contains only a SaaS Application Usage Report.
|
||||
|
||||
Workaround: To
|
||||
receive a scheduled report email for all other PDF report types:
|
||||
|
||||
1. Select MonitorPDF ReportsReport Groups and
|
||||
remove all SaaS Application Usage reports from all Report Groups.
|
||||
2. Select MonitorPDF
|
||||
ReportsEmail Scheduler and
|
||||
edit the scheduled report email that contains only a SaaS Application Usage
|
||||
report. For the Recurrence, select Disable and
|
||||
click OK.
|
||||
Repeat this step for all scheduled
|
||||
report emails that contain only a SaaS Application Usage report.
|
||||
3. Commit.
|
||||
()
|
||||
Select CommitCommit
|
||||
and Push
|
||||
|
||||
## PAN-184406
|
||||
|
||||
Using the CLI to add a RAID disk pair to
|
||||
an M-700 appliance causes the dmdb process to crash.
|
||||
|
||||
Workaround: Contact
|
||||
customer support to stop the dmdb process before adding a RAID disk
|
||||
pair to a M-700 appliance.
|
||||
|
||||
## PAN-183404
|
||||
|
||||
Static IP addresses are not recognized when
|
||||
"and" operators are used with IP CIDR range.
|
||||
|
||||
## PAN-182734
|
||||
|
||||
On an Advanced Routing Engine, if you change
|
||||
the IPSec tunnel configuration, BGP flaps.
|
||||
|
||||
## PAN-181933
|
||||
|
||||
If you use multiple log forwarding cards
|
||||
(LFCs) on the PA-7000 series, all of the cards may not receive all
|
||||
of the updates and the mappings for the clients may become out of sync,
|
||||
which causes the firewall to not correctly populate the Source User
|
||||
column in the session logs.
|
||||
|
||||
## PAN-171938
|
||||
|
||||
No results are displayed when you Show Application
|
||||
Filter for a Security policy rule (PoliciesSecurityApplicationValueShow Application Filter).
|
||||
|
||||
## PAN-164885
|
||||
|
||||
On the Panorama management server, pushes to managed firewalls (CommitPush to Devices or Commit and Push) may fail
|
||||
when an EDL (ObjectsExternal Dynamic Lists) is configured to Check for
|
||||
updates every 5 minutes due to the commit and EDL
|
||||
fetch processes overlapping. This is more likely to occur when
|
||||
multiple EDLs are configured to check for updates every 5
|
||||
minutes.
|
||||
Reference in New Issue
Block a user