aaron.axvig/firewallissues
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'main' of https://github.com/aaronaxvig/firewallissues

Browse Source
This commit is contained in:
aaron.axvig
2026-04-15 14:59:46 -05:00
parent 5621a15c97 10f549ef2a
commit b5569b274c
84 changed files with 3207 additions and 3509 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web/data/issues/PAN-OS/addressed/11.1.0-h1.md
+5 -1
View File
@@ -6,4 +6,8 @@ version: 11.1.0-h1
## PAN-237871 ## PAN-237871
(WF-500 appliances and PAN-DB private cloud deployments only) Fixed an issue where the root-cert was set to expire on December 31, 2023. With this fix, the expiration date has been extended. ```caveat
WF-500 appliances and PAN-DB private cloud deployments only
```
Fixed an issue where the root-cert was set to expire on December 31, 2023. With this fix, the expiration date has been extended.
web/data/issues/PAN-OS/addressed/11.1.0-h2.md
+8 -21
View File
@@ -8,36 +8,23 @@ version: 11.1.0-h2
Fixed the following device certificate issues: Fixed the following device certificate issues:
- The firewall was unable to automatically renew the device - The firewall was unable to automatically renew the device certificate-Fetching device certificates failed incorrectly with the error message OTP is not valid.
certificate-Fetching device certificates failed incorrectly - Firewalls disconnected from Strata Logging Service after renewing the device certificate.
with the error message OTP is not - The device certificate was not correctly generated on the log forwarding card (LFC).
valid. - WildFire cloud logs did not log thermite certificate usage status.
- Firewalls disconnected from Strata Logging Service
after renewing the device certificate.
- The device certificate was not correctly generated on the
log forwarding card (LFC).
- WildFire cloud logs did not log thermite certificate usage
status.
## PAN-237876 ## PAN-237876
Extended the firewall Panorama root CA certificate which was Extended the firewall Panorama root CA certificate which was previously set to expire on April 7th, 2024.
previously set to expire on April 7th, 2024.
## PAN-231771 ## PAN-231771
Fixed an issue where the firewall issued /box/getserv/ requests with Fixed an issue where the firewall issued /box/getserv/ requests with PAN-OS 7.1.0 and did not take device certificates.
PAN-OS 7.1.0 and did not take device certificates.
## PAN-227568 ## PAN-227568
When a device certificate is installed, renewed, or removed, the When a device certificate is installed, renewed, or removed, the firewall will reconnect to the WildFire cloud to use the newest certificate.
firewall will reconnect to the WildFire cloud to use the newest
certificate.
## PAN-215576 ## PAN-215576
Fixed an issue where the userID-Agent Fixed an issue where the userID-Agent and TS-Agent certificates were set to expire on November 18, 2024. With this fix, the expiration date has been extended to January 2032.
and TS-Agent certificates were set to
expire on November 18, 2024. With this fix, the expiration date has
been extended to January 2032.
web/data/issues/PAN-OS/addressed/11.1.0-h3.md
+1 -1
View File
@@ -6,4 +6,4 @@ version: 11.1.0-h3
## PAN-252214 ## PAN-252214
A fix was made to address CVE-2024-3400. A fix was made to address [CVE-2024-3400](https://security.paloaltonetworks.com/CVE-2024-3400).
web/data/issues/PAN-OS/addressed/11.1.0-h4.md
+1 -2
View File
@@ -6,5 +6,4 @@ version: 11.1.0-h4
## PAN-272809 ## PAN-272809
A fix was made to address CVE-2024-0012 (PAN-SA-2024-0015) and A fix was made to address [CVE-2024-0012](https://security.paloaltonetworks.com/CVE-2024-0012) ([PAN-SA-2024-0015](https://security.paloaltonetworks.com/PAN-SA-2024-0015)) and [CVE-2024-9474](https://security.paloaltonetworks.com/CVE-2024-9474).
CVE-2024-9474.
web/data/issues/PAN-OS/addressed/11.1.0.md
+2 -2
View File
@@ -14,7 +14,7 @@ Fixed an issue where SAML authentication failed with the error message Failed to
## PAN-227639 ## PAN-227639
Fixed an issue where the ACC displayed an incorrect DNS-base application traffic byte count. Fixed an issue where the **ACC** displayed an incorrect DNS-base application traffic byte count.
## PAN-227376 ## PAN-227376
@@ -58,7 +58,7 @@ Fixed an issue where, if the number of group queries exceeded the Okta rate limi
## PAN-221126 ## PAN-221126
Fixed an issue where email server profiles (Device > Server Profiles > Email and Panorama > Server Profiles > Email) to forward logs as email notifications were not forwarded in a readable format. Fixed an issue where email server profiles (**Device > Server Profiles > Email and Panorama > Server Profiles > Email**) to forward logs as email notifications were not forwarded in a readable format.
## PAN-218555 ## PAN-218555
web/data/issues/PAN-OS/addressed/11.1.1-h1.md
+1 -1
View File
@@ -6,4 +6,4 @@ version: 11.1.1-h1
## PAN-252214 ## PAN-252214
A fix was made to address CVE-2024-3400. A fix was made to address [CVE-2024-3400](https://security.paloaltonetworks.com/CVE-2024-3400).
web/data/issues/PAN-OS/addressed/11.1.1-h2.md
+1 -2
View File
@@ -6,5 +6,4 @@ version: 11.1.1-h2
## PAN-272809 ## PAN-272809
A fix was made to address CVE-2024-0012 (PAN-SA-2024-0015) and A fix was made to address [CVE-2024-0012](https://security.paloaltonetworks.com/CVE-2024-0012) ([PAN-SA-2024-0015](https://security.paloaltonetworks.com/PAN-SA-2024-0015)) and [CVE-2024-9474](https://security.paloaltonetworks.com/CVE-2024-9474).
CVE-2024-9474.
web/data/issues/PAN-OS/addressed/11.1.1.md
+17 -51
View File
@@ -6,38 +6,28 @@ version: 11.1.1
## PAN-239241 ## PAN-239241
Extended the root certificate for WildFire appliances to December 31, Extended the root certificate for WildFire appliances to December 31, 2032.
2032.
## PAN-238792 ## PAN-238792
Fixed the following device certificate issues: Fixed the following device certificate issues:
- The firewall was unable to automatically renew the device - The firewall was unable to automatically renew the device certificate-Fetching device certificates failed incorrectly with the error message OTP is not valid.
certificate-Fetching device certificates failed incorrectly - Firewalls disconnected from Strata Logging Service after renewing the device certificate.
with the error message OTP is not - The device certificate was not correctly generated on the log forwarding card (LFC).
valid. - WildFire cloud logs did not log thermite certificate usage status.
- Firewalls disconnected from Strata Logging Service
after renewing the device certificate.
- The device certificate was not correctly generated on the
log forwarding card (LFC).
- WildFire cloud logs did not log thermite certificate usage
status.
## PAN-237935 ## PAN-237935
Extended the offline PAN-DB, Panorama, and WildFire certificates Extended the offline PAN-DB, Panorama, and WildFire certificates which were previously set to expire on September 2, 2024.
which were previously set to expire on September 2, 2024.
## PAN-237876 ## PAN-237876
Extended the firewall Panorama root CA certificate which was Extended the firewall Panorama root CA certificate which was previously set to expire on April 7th, 2024.
previously set to expire on April 7th, 2024.
## PAN-236605 ## PAN-236605
Fixed an issue where the configd process stopped Fixed an issue where the configd process stopped responding due to a deadlock related to rule-hit-count.
responding due to a deadlock related to rule-hit-count.
## PAN-235385 ## PAN-235385
@@ -45,17 +35,7 @@ Enhanced wifclient cloud connectivity redundancy.
## PAN-234929 ## PAN-234929
Fixed an issue where tabs in the ACC such as Fixed an issue where tabs in the **ACC** such as **Network Activity** **Threat Activity** and **Blocked Activity** did not display data when you applied a **Time** filter of **Last 15 Minutes**, **Last Hour**, **Last 6 Hours**, or **Last 12 Hours**, and the data that was displayed with the **Last 24 Hours** filter was not accurate. Reports that were run against summary logs also did not display accurate results.
Network Activity
Threat Activity and Blocked
Activity did not display data when you applied a
Time filter of Last 15
Minutes, Last Hour,
Last 6 Hours, or Last 12
Hours, and the data that was displayed with the
Last 24 Hours filter was not accurate.
Reports that were run against summary logs also did not display
accurate results.
## PAN-233957 ## PAN-233957
@@ -63,8 +43,7 @@ accurate results.
PA-5450 firewalls only PA-5450 firewalls only
``` ```
Fixed an issue where the NAT Fixed an issue where the NAT private pool was not used properly when enabling slot 6 DPC.
private pool was not used properly when enabling slot 6 DPC.
## PAN-233191 ## PAN-233191
@@ -72,9 +51,7 @@ private pool was not used properly when enabling slot 6 DPC.
PA-5450 firewalls only PA-5450 firewalls only
``` ```
Fixed an issue where the Data Fixed an issue where the Data Processing Card (DPC) restarted due to path monitor failure after QSFP28 disconnected from the Network Processing Card (NPC).
Processing Card (DPC) restarted due to path monitor failure after
QSFP28 disconnected from the Network Processing Card (NPC).
## PAN-232358 ## PAN-232358
@@ -82,35 +59,24 @@ QSFP28 disconnected from the Network Processing Card (NPC).
PA-5450 firewalls only PA-5450 firewalls only
``` ```
Fixed an issue where the interface Fixed an issue where the interface on QSFP28 ports did not go down when the Tx cable was removed from the QSFP28 module.
on QSFP28 ports did not go down when the Tx cable was removed from
the QSFP28 module.
## PAN-231771 ## PAN-231771
Fixed an issue where the firewall issued /box/getserv/ requests with Fixed an issue where the firewall issued /box/getserv/ requests with PAN-OS 7.1.0 and did not take device certificates.
PAN-OS 7.1.0 and did not take device certificates.
## PAN-231658 ## PAN-231658
Fixed an issue where DNS resolution failed when interfaces were Fixed an issue where DNS resolution failed when interfaces were configured as DHCP and a DNS server was provided via DHCP while also statically configured with DNS servers.
configured as DHCP and a DNS server was provided via DHCP while also
statically configured with DNS servers.
## PAN-231194 ## PAN-231194
Fixed an issue where the firewall was unable to clear hints from the Fixed an issue where the firewall was unable to clear hints from the disk.
disk.
## PAN-227568 ## PAN-227568
When a device certificate is installed, renewed, or removed, the When a device certificate is installed, renewed, or removed, the firewall will reconnect to the WildFire cloud to use the newest certificate.
firewall will reconnect to the WildFire cloud to use the newest
certificate.
## PAN-215576 ## PAN-215576
Fixed an issue where the userID-Agent and Fixed an issue where the userID-Agent and TS-Agent certificates were set to expire on November 18, 2024. With this fix, the expiration date has been extended to January 2032.
TS-Agent certificates were set to
expire on November 18, 2024. With this fix, the expiration date has
been extended to January 2032.
web/data/issues/PAN-OS/addressed/11.1.10-h1.md
+3 -3
View File
@@ -50,7 +50,7 @@ Fixed a race condition issue related to predict processing on multi-core platfor
## PAN-288930 ## PAN-288930
Fixed an issue where traffic from cloud applications intermittently matched an incorrect cloud-apps policy rule when ACE (App-ID Cloud Engine) was enabled. Fixed an issue where traffic from cloud applications intermittently matched an incorrect **cloud-apps** policy rule when ACE (App-ID Cloud Engine) was enabled.
## PAN-288893 ## PAN-288893
@@ -78,7 +78,7 @@ Fixed an issue where sessions timed out sooner than expected due to the pan_prox
## PAN-287734 ## PAN-287734
Fixed an issue where Scan ERR: Internal Err 1002 messages were unexpectedly generated when WIF shared memory use was high. Fixed an issue where **Scan ERR: Internal Err 1002** messages were unexpectedly generated when WIF shared memory use was high.
## PAN-287621 ## PAN-287621
@@ -196,7 +196,7 @@ Fixed an issue where deleting the NTP server address caused a commit validation
## PAN-277234 ## PAN-277234
Fixed an issue where a device group import resulted in a Security policy rule being created with Application set to none. Fixed an issue where a device group import resulted in a Security policy rule being created with **Application** set to **none**.
## PAN-276920 ## PAN-276920
web/data/issues/PAN-OS/addressed/11.1.10-h10.md
+4 -4
View File
@@ -6,7 +6,7 @@ version: 11.1.10-h10
## PAN-306502 ## PAN-306502
Fixed an issue where TLS connection failure occurred when traffic was over TLS1.2 or below, header insertion was enabled on the firewall, send TLS handshake to CTD was enabled, and traffic hit a decryption policy rule configured with the no-decrypt action. Fixed an issue where TLS connection failure occurred when traffic was over TLS1.2 or below, header insertion was enabled on the firewall, **send TLS handshake to CTD** was enabled, and traffic hit a decryption policy rule configured with the **no-decrypt** action.
## PAN-306306 ## PAN-306306
@@ -74,7 +74,7 @@ Fixed an issue where exporting custom reports resulted in empty CSV files.
## PAN-296977 ## PAN-296977
Fixed an issue where the web interface became unresponsive when attempting to view Ethernet interface details after applying a filter in Network > Interfaces. Fixed an issue where the web interface became unresponsive when attempting to view **Ethernet** interface details after applying a filter in **Network > Interfaces**.
## PAN-296397 ## PAN-296397
@@ -122,11 +122,11 @@ Fixed an issue where the number of registered IP Tags on Panorama did not match
## PAN-276484 ## PAN-276484
Fixed an issue where Panorama did not display license information for Cloud NGFW firewalls under (Device Deployment > Licenses) due to the inability to perform batch-license refreshes. Fixed an issue where Panorama did not display license information for Cloud NGFW firewalls under (**Device Deployment > Licenses**) due to the inability to perform batch-license refreshes.
## PAN-276321 ## PAN-276321
Fixed an issue where User-ID mappings were not correctly redistributed from Panorama to firewalls, causing some users to be identified as unknown, which prevented access to resources based on AD group membership. Fixed an issue where User-ID mappings were not correctly redistributed from Panorama to firewalls, causing some users to be identified as **unknown**, which prevented access to resources based on AD group membership.
## PAN-274086 ## PAN-274086
web/data/issues/PAN-OS/addressed/11.1.10-h12.md
+8 -10
View File
@@ -6,7 +6,7 @@ version: 11.1.10-h12
## PAN-309392 ## PAN-309392
Fixed an issue where the scroll bar did not appear when editing Destination Addresses for Policy Based forwarding policy rules. Fixed an issue where the scroll bar did not appear when editing **Destination Addresses** for Policy Based forwarding policy rules.
## PAN-309379 ## PAN-309379
@@ -126,7 +126,7 @@ Fixed an issue where the firewall intermittently failed to forward VXLAN GARP pa
## PAN-292447 ## PAN-292447
Fixed an issue where Panorama did not display data in the Feature Adoption tab in Strata Cloud Manager due to the system creating and deleting a CLI user for each interval instead of reusing a permanent CLI user for telemetry. Fixed an issue where Panorama did not display data in the **Feature Adoption** tab in Strata Cloud Manager due to the system creating and deleting a CLI user for each interval instead of reusing a permanent CLI user for telemetry.
## PAN-291067 ## PAN-291067
@@ -162,7 +162,7 @@ Fixed an issue where the firewall did not automatically recover after a machine
## PAN-283237 ## PAN-283237
Fixed an issue where traffic logs incorrectly displayed the action as allow for traffic matching a Security policy rule configured with the action set to deny. This issue occurred due to the child session being used for policy rule lookup when a configuration update triggered a rematch if the FTP-data application was not in the rule. Fixed an issue where traffic logs incorrectly displayed the action as **allow** for traffic matching a Security policy rule configured with the action set to **deny**. This issue occurred due to the child session being used for policy rule lookup when a configuration update triggered a rematch if the FTP-data application was not in the rule.
## PAN-281588 ## PAN-281588
@@ -170,7 +170,7 @@ Fixed an issue where packet buffer depletion occurred due to the a high number o
## PAN-277464 ## PAN-277464
Fixed an issue with intermittent access and slower than expected loading times when accessing websites. This occurred when Anti-Spyware inline cloud analysis was enabled and the SSL Command and Control action was not either allow or alert and server hello packets were out of order. Fixed an issue with intermittent access and slower than expected loading times when accessing websites. This occurred when Anti-Spyware inline cloud analysis was enabled and the **SSL Command and Control** action was not either **allow** or **alert** and server hello packets were out of order.
## PAN-269535 ## PAN-269535
@@ -198,10 +198,8 @@ Fixed an issue where SNMP walk reported incorrect interface speeds.
## PAN-185731 ## PAN-185731
Fixed an issue where the firewall was unable to parse the URL path and host when the host header was located in a different packet, which resulted in the firewall not logging the URL path in the first packet. The fix is disabled by default. The following CLI commands can be used to enable/disable the feature:set system setting ctd url-crosspkt-host-path-caching enableset system setting ctd url-crosspkt-host-path-caching disableset system setting ctd url-crosspkt-host-path-caching default Fixed an issue where the firewall was unable to parse the URL path and host when the host header was located in a different packet, which resulted in the firewall not logging the URL path in the first packet. The fix is disabled by default. The following CLI commands can be used to enable/disable the feature:
set system setting ctd url-crosspkt-host-path-caching enable - set system setting ctd url-crosspkt-host-path-caching enable
- set system setting ctd url-crosspkt-host-path-caching disable
set system setting ctd url-crosspkt-host-path-caching disable - set system setting ctd url-crosspkt-host-path-caching default
set system setting ctd url-crosspkt-host-path-caching default
web/data/issues/PAN-OS/addressed/11.1.10-h21.md
+65 -1
View File
@@ -6,6 +6,10 @@ version: 11.1.10-h21
## PAN-316911 ## PAN-316911
```caveat
VM-Series firewalls on Amazon Web Services (AWS) environments only
```
Fixed an issue where a newly bootstrapped firewall required a management server restart, relicensing, or license push from Panorama to invoke the device certificate. Fixed an issue where a newly bootstrapped firewall required a management server restart, relicensing, or license push from Panorama to invoke the device certificate.
## PAN-315176 ## PAN-315176
@@ -26,6 +30,10 @@ Fixed an issue where traffic was disrupted during IPSec rekey operations due to
## PAN-313850 ## PAN-313850
```caveat
PA-1400 Series firewalls in HA configurations only
```
Fixed an issue where a split-brain condition occurred and HA1/HA2 links went down while upgrading when the HA configuration used dataplane interfaces for HA1 and a combination of HSCI and Ethernet interfaces for HA2. Fixed an issue where a split-brain condition occurred and HA1/HA2 links went down while upgrading when the HA configuration used dataplane interfaces for HA1 and a combination of HSCI and Ethernet interfaces for HA2.
## PAN-313623 ## PAN-313623
@@ -34,6 +42,10 @@ Fixed an issue where the /opt/pancfg/mgmt/ssl/private/ directory on Palo Alto Ne
## PAN-313572 ## PAN-313572
```caveat
VM-Series firewalls only
```
Fixed an issue where the dataplane restarted due to a segmentation fault. Fixed an issue where the dataplane restarted due to a segmentation fault.
## PAN-312706 ## PAN-312706
@@ -42,14 +54,26 @@ Fixed an issue where the firewalls restarted due to a function lacking a NULL-po
## PAN-311285 ## PAN-311285
```caveat
Firewalls in HA conditions only
```
Fixed an issue where a memory leak occurred related to the ospfd process, which caused RAM usage to continuously increase on active devices in an HA cluster until the device stopped responding, even after an HA failover. Fixed an issue where a memory leak occurred related to the ospfd process, which caused RAM usage to continuously increase on active devices in an HA cluster until the device stopped responding, even after an HA failover.
## PAN-311250 ## PAN-311250
```caveat
Panorama appliances and Log Collectors only
```
Fixed an issue where logs from multiple devices were not visible on Panorama even though the Elasticsearch health status on the dedicated Log Collectors appeared green. Fixed an issue where logs from multiple devices were not visible on Panorama even though the Elasticsearch health status on the dedicated Log Collectors appeared green.
## PAN-311073 ## PAN-311073
```caveat
Panorama managed firewalls in HA configurations only
```
Fixed an issue where firewalls incorrectly updated the modified date and MD5 hash of policy rules during an HA sync commit job or a subsequent local commit, even when no changes were made to the policy rules. Fixed an issue where firewalls incorrectly updated the modified date and MD5 hash of policy rules during an HA sync commit job or a subsequent local commit, even when no changes were made to the policy rules.
## PAN-309300 ## PAN-309300
@@ -58,6 +82,10 @@ Fixed an issue where management plane system resources configuration size exceed
## PAN-308786 ## PAN-308786
```caveat
Panorama appliances only
```
Fixed an issue where traffic log queries using the device_name filter returned no results, and complex log queries that included negation operators produced incorrect outputs. Fixed an issue where traffic log queries using the device_name filter returned no results, and complex log queries that included negation operators produced incorrect outputs.
## PAN-308654 ## PAN-308654
@@ -66,10 +94,18 @@ Fixed an issue where the Elasticsearch Close Indices process closed more indices
## PAN-308507 ## PAN-308507
```caveat
Panorama managed firewalls only
```
Fixed an issue where the firewall intermittently failed to maintain active log forwarding streams to Cortex Data Lake even when duplicate logging and enhanced application logging were enabled. Fixed an issue where the firewall intermittently failed to maintain active log forwarding streams to Cortex Data Lake even when duplicate logging and enhanced application logging were enabled.
## PAN-307702 ## PAN-307702
```caveat
Firewalls in HA configurations only
```
Fixed an issue where traffic passing through AE layer 2 interfaces was interrupted during HA failovers. Fixed an issue where traffic passing through AE layer 2 interfaces was interrupted during HA failovers.
## PAN-307597 ## PAN-307597
@@ -120,6 +156,10 @@ Fixed an issue on the firewall where configuring spyware and vulnerability profi
## PAN-302654 ## PAN-302654
```caveat
Firewalls in active/passive HA configurations only
```
Fixed an issue where, when the HA configuration had multiple logical routers, static or connected routes redistributed into OSPF aged out in the LSDB, which caused the routes to be removed on peer OSPF neighbors. Fixed an issue where, when the HA configuration had multiple logical routers, static or connected routes redistributed into OSPF aged out in the LSDB, which caused the routes to be removed on peer OSPF neighbors.
## PAN-301731 ## PAN-301731
@@ -168,6 +208,10 @@ Fixed an issue where a memory leak related to the configd process occurred.
## PAN-296202 ## PAN-296202
```caveat
Firewalls in active/active HA configurations only
```
Added a log enhancement to capture an issue where, when a commit operation was in progress, newly deployed IP address tags that used the XML API were not immediately reflected in address group resolution, which delayed IP address mapping to address groups and caused traffic to be incorrectly allowed or denied. Added a log enhancement to capture an issue where, when a commit operation was in progress, newly deployed IP address tags that used the XML API were not immediately reflected in address group resolution, which delayed IP address mapping to address groups and caused traffic to be incorrectly allowed or denied.
## PAN-294379 ## PAN-294379
@@ -204,6 +248,10 @@ Fixed an issue where traffic logs incorrectly displayed the action as **allow**
## PAN-279364 ## PAN-279364
```caveat
VM-Series firewalls with multiple NICs only
```
Fixed an issue were the queue count in the task dump displayed an incorrect number of queues for SR-IOV interfaces due to the queue mapping logic incorrectly using a non-multi-NIC function. Fixed an issue were the queue count in the task dump displayed an incorrect number of queues for SR-IOV interfaces due to the queue mapping logic incorrectly using a non-multi-NIC function.
## PAN-279209 ## PAN-279209
@@ -216,14 +264,26 @@ Fixed an issue where DNS Security threat logs were not displayed on the firewall
## PAN-278628 ## PAN-278628
```caveat
Firewalls in HA configurations only
```
Fixed an issue where the configd process restarted during a configuration push from Panorama, which caused the active firewall to lose management access for 20-30 minutes. Fixed an issue where the configd process restarted during a configuration push from Panorama, which caused the active firewall to lose management access for 20-30 minutes.
## PAN-277987 ## PAN-277987
```caveat
VM-Series firewalls in AWS environments only
```
Fixed an issue where HA failover mode incorrectly changed from **interface move** to **secondary IP move** after a reboot. Fixed an issue where HA failover mode incorrectly changed from **interface move** to **secondary IP move** after a reboot.
## PAN-274742 ## PAN-274742
```caveat
VM-Series firewalls only
```
Fixed an issue where the task-queue dump CLI command returned incorrect information in multi-nic mode. Fixed an issue where the task-queue dump CLI command returned incorrect information in multi-nic mode.
## PAN-273487 ## PAN-273487
@@ -232,6 +292,10 @@ Fixed an issue where the distributord process restarted on firewalls in multi-vs
## PAN-273158 ## PAN-273158
```caveat
PA-7000 Series firewalls only
```
Fixed an issue where an incorrect ASIC configuration caused silent packet drops or application slowness when receiving a mix of jumbo and non-jumbo packets. Fixed an issue where an incorrect ASIC configuration caused silent packet drops or application slowness when receiving a mix of jumbo and non-jumbo packets.
## PAN-262353 ## PAN-262353
@@ -248,4 +312,4 @@ Fixed an issue where memory leaks occurred when checking for, downloading, or in
## PAN-243507 ## PAN-243507
Fixed an issue on the firewall web interface where **Logical Router** did not load after an FRR stack upgrade. Fixed an issue on the firewall web interface where **Logical Router** did not load after an Advanced Routing Engine stack upgrade.
web/data/issues/PAN-OS/addressed/11.1.10-h4.md
+7 -7
View File
@@ -34,7 +34,7 @@ Fixed an issue where the logrcvr process stopped responding due to memory alloca
## PAN-294488 ## PAN-294488
Fixed an issue where certificate data was missing in decryption logs for No decrypt policy rules and TLS1.2 traffic after upgrading, and the Subject Common Name, Issuer Common Name, Certificate Start Date, Certificate End Date, Certificate Serial Number, and Certificate Fingerprint fields were blank in the decryption logs. Fixed an issue where certificate data was missing in decryption logs for **No decrypt** policy rules and TLS1.2 traffic after upgrading, and the **Subject Common Name**, **Issuer Common Name**, **Certificate Start Date**, **Certificate End Date**, **Certificate Serial Number**, and **Certificate Fingerprint** fields were blank in the decryption logs.
## PAN-294436 ## PAN-294436
@@ -172,7 +172,7 @@ Fixed an issue where the comm process stopped responding due to missing heartbea
## PAN-287688 ## PAN-287688
Fixed an issue where the firewall failed to connect to the Palo Alto Networks update server when using a customized service route with the source interface as MGT. Fixed an issue where the firewall failed to connect to the Palo Alto Networks update server when using a customized service route with the source interface as **MGT**.
## PAN-287611 ## PAN-287611
@@ -200,7 +200,7 @@ Fixed an issue where the firewall double-freed shared memory when the shared mem
## PAN-286299 ## PAN-286299
Fixed an issue on firewalls running PAN-OS 11.1 releases where, after being offboarded from Panorama, the firewall XML configuration file retained template information from the previous Panorama configuration. As a result, when the firewall and its configuration were imported to another Panorama appliance, all configurations in the Network and Device tab became read-only. Fixed an issue on firewalls running PAN-OS 11.1 releases where, after being offboarded from Panorama, the firewall XML configuration file retained template information from the previous Panorama configuration. As a result, when the firewall and its configuration were imported to another Panorama appliance, all configurations in the **Network** and **Device** tab became read-only.
## PAN-286231 ## PAN-286231
@@ -252,11 +252,11 @@ Fixed an issue where searching configuration logs for an audit_uuid did not retu
## PAN-281096 ## PAN-281096
Fixed an issue on HA clusters where, when link and path monitoring was configured and the failover condition was set to all, disconnecting and reconnecting monitored ethernet ports caused the firewall to switch to a nonfunctional role, which resulted in all interfaces except the HA interface going down. Fixed an issue on HA clusters where, when link and path monitoring was configured and the failover condition was set to **all**, disconnecting and reconnecting monitored ethernet ports caused the firewall to switch to a nonfunctional role, which resulted in all interfaces except the HA interface going down.
## PAN-279901 ## PAN-279901
Fixed an issue where the firewall dropped client hello packets when decryption was enabled, which prevented access to certain websites. This occurred when the client hello packet was truncated, the accumulation proxy assumed that the first packet contains at least 5 bytes, or out-of-order packets were waiting in L4 TCP. An issue was fixed where the firewall dropped fragmented TLS ClientHello packets, which blocked access to certain websites. This occurred because the packets arrived truncated, in varying sizes and orders, and the firewall's heuristics failed to handle them correctly.
To enable this fix, run: debug dataplane set ssl-decrypt accumulate-client-hello disjoined yes To enable this fix, run: debug dataplane set ssl-decrypt accumulate-client-hello disjoined yes
@@ -292,7 +292,7 @@ Fixed an issue on Panorama where the request batch license info CLI command disp
## PAN-271545 ## PAN-271545
Fixed an issue where, when the zone protection option anycast-source was enabled, IPv6 traffic with an interface ID of 0 was dropped even if the subnet was not locally configured on the firewall. Fixed an issue where, when the zone protection option **anycast-source** was enabled, IPv6 traffic with an interface ID of 0 was dropped even if the subnet was not locally configured on the firewall.
## PAN-269659 ## PAN-269659
@@ -300,7 +300,7 @@ Fixed an issue on the firewall where you were unable to configure more than 500
## PAN-268522 ## PAN-268522
Fixed an issue where the firewall failed to connect to the update server with a customized service route when the source interface was set to MGT and the source address was set as IPv4. Fixed an issue where the firewall failed to connect to the update server with a customized service route when the source interface was set to **MGT** and the source address was set as IPv4.
## PAN-268002 ## PAN-268002
web/data/issues/PAN-OS/addressed/11.1.10-h5.md
+1 -1
View File
@@ -54,7 +54,7 @@ Fixed an issue where, after onboarding a firewall to Panorama, IPsec tunnels dis
## PAN-294893 ## PAN-294893
Fixed an issue where firewalls with the Send handshake messages to CTD for inspection setting enabled caused incorrect security policy rules to be matched. Specifically, traffic not identified as openai-base or openai-chatgpt applications was incorrectly matched by the ALLOW-OPEN-AI-FULL-ACCESS-URLS-ALERTS rule. Additionally, the expected response page for blocked URLs was not displayed. Fixed an issue where firewalls with the **Send handshake messages to CTD for inspection** setting enabled caused incorrect security policy rules to be matched. Specifically, traffic not identified as openai-base or openai-chatgpt applications was incorrectly matched by the ALLOW-OPEN-AI-FULL-ACCESS-URLS-ALERTS rule. Additionally, the expected response page for blocked URLs was not displayed.
## PAN-294770 ## PAN-294770
web/data/issues/PAN-OS/addressed/11.1.10-h7.md
+6 -6
View File
@@ -58,11 +58,11 @@ Fixed an issue where, during a refresh of a large External Dynamic List (EDL), t
## PAN-297782 ## PAN-297782
Fixed an issue on Panorama where reassociating a vsys from one device group to another in a multi-vsys environment resulted in another vsys from the same firewall being removed from the original device group. This resulted in the device being moved into the no device groups attached group, a superuser was required to manually reattach the device. Fixed an issue on Panorama where reassociating a vsys from one device group to another in a multi-vsys environment resulted in another vsys from the same firewall being removed from the original device group. This resulted in the device being moved into the **no device groups attached** group, a superuser was required to manually reattach the device.
## PAN-297775 ## PAN-297775
Fixed an issue where, after upgrading to an affected PAN-OS release, the Visible Virtual Systems field started to reference the vsys name instead of the vsys ID, which caused inter-vsys routing to fail. This occurred when a vsys display name matched one of the vsys IDs. Fixed an issue where, after upgrading to an affected PAN-OS release, the **Visible Virtual Systems** field started to reference the vsys name instead of the vsys ID, which caused inter-vsys routing to fail. This occurred when a vsys display name matched one of the vsys IDs.
## PAN-296752 ## PAN-296752
@@ -74,7 +74,7 @@ Fixed an issue where, after upgrading Panorama and Log Collectors, Traffic and T
## PAN-293848 ## PAN-293848
Fixed an issue where Panorama failed to push the default value of None for the secondary NTP server address to managed firewalls, resulting in a commit validation error. This occurred even when configuring the secondary NTP server address as None in Panorama's web interface, and affected both newly deployed and long-standing production firewalls after upgrading. Fixed an issue where Panorama failed to push the default value of **None** for the secondary NTP server address to managed firewalls, resulting in a commit validation error. This occurred even when configuring the secondary NTP server address as **None** in Panorama's web interface, and affected both newly deployed and long-standing production firewalls after upgrading.
## PAN-293847 ## PAN-293847
@@ -118,7 +118,7 @@ Fixed an issue where, after onboarding a firewall to Panorama, IPsec tunnels dis
## PAN-294893 ## PAN-294893
Fixed an issue where firewalls with the Send handshake messages to CTD for inspection setting enabled caused incorrect security policy rules to be matched. Specifically, traffic not identified as openai-base or openai-chatgpt applications was incorrectly matched by the ALLOW-OPEN-AI-FULL-ACCESS-URLS-ALERTS rule. Additionally, the expected response page for blocked URLs was not displayed. Fixed an issue where firewalls with the **Send handshake messages to CTD for inspection** setting enabled caused incorrect security policy rules to be matched. Specifically, traffic not identified as openai-base or openai-chatgpt applications was incorrectly matched by the ALLOW-OPEN-AI-FULL-ACCESS-URLS-ALERTS rule. Additionally, the expected response page for blocked URLs was not displayed.
## PAN-294770 ## PAN-294770
@@ -206,7 +206,7 @@ Fixed an issue where firewalls configured in vwire mode modified DSCP values fro
## PAN-287693 ## PAN-287693
Fixed an issue where Panorama did not use the configured proxy settings to check WildFire private cloud content and instead connected directly to the WildFire device using the management interface. This occurred even when Use Proxy Settings for Private Cloud was enabled. Fixed an issue where Panorama did not use the configured proxy settings to check WildFire private cloud content and instead connected directly to the WildFire device using the management interface. This occurred even when **Use Proxy Settings for Private Cloud was enabled**.
## PAN-287622 ## PAN-287622
@@ -254,7 +254,7 @@ Fixed an issue where the firewall did not display the correct source user in tra
## PAN-277682 ## PAN-277682
Fixed an issue where moving an address object from a device group to shared and renaming it did not reflect in the address group, which caused commits to fail. Fixed an issue where moving an address object from a device group to **shared** and renaming it did not reflect in the address group, which caused commits to fail.
## PAN-277034 ## PAN-277034
web/data/issues/PAN-OS/addressed/11.1.11.md
+60 -60
View File
@@ -18,7 +18,7 @@ Fixed an issue where Panorama managed firewalls with no defined log collector gr
## PAN-296977 ## PAN-296977
Fixed an issue where the web interface became unresponsive when attempting to view Ethernet interface details after applying a filter in Network > Interfaces. Fixed an issue where the web interface became unresponsive when attempting to view **Ethernet** interface details after applying a filter in **Network > Interfaces**.
## PAN-296478 ## PAN-296478
@@ -74,7 +74,7 @@ Fixed an issue on Panorama where commit versions did not display correct data in
## PAN-293985 ## PAN-293985
Fixed an issue with the Panorama web interface where admin users were unable to log in and received the error message 504: Gateway Timeout. Fixed an issue with the Panorama web interface where admin users were unable to log in and received the error message **504: Gateway Timeout**.
## PAN-293877 ## PAN-293877
@@ -106,11 +106,11 @@ Fixed an issue where setting the logdb-quota for the desum log type to 0 caused
Panorama virtual appliances in FIPS mode only Panorama virtual appliances in FIPS mode only
``` ```
Fixed an issue where plugin installs failed with the error invalid image after manually uploading the plugin package from the Customer Support Portal (CSP). Fixed an issue where plugin installs failed with the error **invalid image** after manually uploading the plugin package from the Customer Support Portal (CSP).
## PAN-292980 ## PAN-292980
Fixed an issue on the web interface where the Connected status for a User-ID agent in a non-User-ID Hub vsys displayed as blank if the same agent was also configured in a User-ID Hub vsys. Fixed an issue on the web interface where the **Connected** status for a User-ID agent in a non-User-ID Hub vsys displayed as blank if the same agent was also configured in a User-ID Hub vsys.
## PAN-292770 ## PAN-292770
@@ -170,11 +170,11 @@ Fixed an issue where Panorama in FIPS-CC mode failed to push IKEv2 Post-Quantum
## PAN-290702 ## PAN-290702
Fixed an issue where Log Quotas incorrectly displayed a value that was higher than possible. Fixed an issue where **Log Quotas** incorrectly displayed a value that was higher than possible.
## PAN-290694 ## PAN-290694
Fixed an issue on the Panorama web interface where you were unable to push shared objects to devices if an HA failover occurred during a configuration push. Fixed an issue on the Panorama web interface where you were unable to **push** shared objects to devices if an HA failover occurred during a configuration push.
## PAN-290691 ## PAN-290691
@@ -186,7 +186,7 @@ Fixed an issue where, when multiple scheduled vulnerability reports were were se
## PAN-290241 ## PAN-290241
Fixed an issue where the useridd process became unresponsive, which caused User ID CLI commands to time out. Fixed an issue where the **useridd** process became unresponsive, which caused User ID CLI commands to time out.
## PAN-290239 ## PAN-290239
@@ -202,11 +202,11 @@ Fixed an issue where the dscd process crashed continuously on MIPS platforms (fo
## PAN-290191 ## PAN-290191
Fixed an issue where BGP learned routes were not advertised when Legacy Routing was used and an export policy was configured to match the next hop of the learned route. Fixed an issue where BGP learned routes were not advertised when **Legacy Routing** was used and an export policy was configured to match the next hop of the learned route.
## PAN-290157 ## PAN-290157
Fixed an issue on Panorama where the configd process stopped responding when filtering in the Config Audit window, which caused Panorama to restart unexpectedly. Fixed an issue on Panorama where the configd process stopped responding when filtering in the **Config Audit** window, which caused Panorama to restart unexpectedly.
## PAN-290088 ## PAN-290088
@@ -242,7 +242,7 @@ Fixed an issue where SD-WAN SaaS monitoring did not work with URL monitoring.
## PAN-289736 ## PAN-289736
Fixed an issue where partial-revert operations were taking a long time, causing config lock timeout issues and resulting in frequent error messages being displayed: Timed out while getting config lock. Please try again. Fixed an issue where partial-revert operations were taking a long time, causing config lock timeout issues and resulting in frequent error messages being displayed: **Timed out while getting config lock. Please try again.**
## PAN-289652 ## PAN-289652
@@ -250,11 +250,11 @@ Fixed an issue related to external URL lists where pushing configuration changes
## PAN-289573 ## PAN-289573
Fixed an issue on Panorama where the web interface became unresponsive when attempting to edit the Allow traffic to specified FQDN when Enforce GlobalProtect Connection for Network Access setting in a GlobalProtect portal configuration after adding 40 or more FQDN entries. Fixed an issue on Panorama where the web interface became unresponsive when attempting to edit the **Allow traffic to specified FQDN when Enforce GlobalProtect Connection for Network Access** setting in a GlobalProtect portal configuration after adding 40 or more FQDN entries.
## PAN-289541 ## PAN-289541
Fixed an issue where the bandwidth graphs (Link Monitoring) in Panorama for SD-WAN environments displayed incorrect values. Fixed an issue where the bandwidth graphs (**Link Monitoring**) in Panorama for SD-WAN environments displayed incorrect values.
## PAN-289532 ## PAN-289532
@@ -322,7 +322,7 @@ Fixed an issue on Panorama where, after logging in to the web interface as the Z
## PAN-288930 ## PAN-288930
Fixed an issue where traffic from cloud applications intermittently matched an incorrect cloud-apps policy rule when ACE (App-ID Cloud Engine) was enabled. Fixed an issue where traffic from cloud applications intermittently matched an incorrect **cloud-apps** policy rule when ACE (App-ID Cloud Engine) was enabled.
## PAN-288929 ## PAN-288929
@@ -414,7 +414,7 @@ Fixed an issue where the maximum registered IP address for was incorrectly set t
## PAN-287842 ## PAN-287842
Fixed an issue where the comm process stopped responding due to missing heartbeats, which resulted in a system alert and HA communication loss on slot1. Fixed an issue where the **comm** process stopped responding due to missing heartbeats, which resulted in a system alert and HA communication loss on slot1.
## PAN-287838 ## PAN-287838
@@ -438,7 +438,7 @@ Fixed an issue where SAML authentication failed, which caused the GlobalProtect
## PAN-287688 ## PAN-287688
Fixed an issue where the firewall failed to connect to the Palo Alto Networks update server when using a customized service route with the source interface as MGT. Fixed an issue where the firewall failed to connect to the Palo Alto Networks update server when using a customized service route with the source interface as **MGT**.
## PAN-287621 ## PAN-287621
@@ -470,7 +470,7 @@ Fixed an issue where the firewall generated critical system log alerts every 3 m
## PAN-287392 ## PAN-287392
Fixed the issue on the web interface where ACC graphs displayed No data to display when a filter was applied to Source IP or Destination IP. Fixed the issue on the web interface where **ACC** graphs displayed **No data to display** when a filter was applied to **Source IP** or **Destination IP**.
## PAN-287387 ## PAN-287387
@@ -530,7 +530,7 @@ Fixed an issue where ECMP incorrectly balanced sessions across links based on th
VM-Series firewalls only AWS environments only VM-Series firewalls only AWS environments only
``` ```
Fixed an issue where the firewall did not send ICMP unreachable - Fragmentation Needed message when it received packets larger than the MTU. Fixed an issue where the firewall did not send **ICMP unreachable - Fragmentation Needed** message when it received packets larger than the MTU.
## PAN-286818 ## PAN-286818
@@ -542,7 +542,7 @@ Fixed an issue where closing an SSH session to a Panorama using Ctrl+D did not g
Panorama virtual appliances in HA configurations on Microsoft Azure environments only Panorama virtual appliances in HA configurations on Microsoft Azure environments only
``` ```
Fixed an issue where plugin versions displayed when hovering over the Green Match icon were inconsistent even though the web interface reported the versions as matching. Fixed an issue where plugin versions displayed when hovering over the **Green Match** icon were inconsistent even though the web interface reported the versions as matching.
## PAN-286735 ## PAN-286735
@@ -562,7 +562,7 @@ Added uplink counters to enhance debug capability for traffic drops.
Panorama appliances only Panorama appliances only
``` ```
Fixed an issue where the Require SSL/TLS secured connection in the LDAP profile within the template stack did not take effect after overriding the configuration. This occurred even when the setting was enabled multiple times. Fixed an issue where the **Require SSL/TLS secured connection** in the LDAP profile within the template stack did not take effect after overriding the configuration. This occurred even when the setting was enabled multiple times.
## PAN-286669 ## PAN-286669
@@ -598,7 +598,7 @@ Fixed an issue where, when getting transceiver information from ESCC for SFP 25G
## PAN-286299 ## PAN-286299
Fixed an issue on firewalls running PAN-OS 11.1 releases where, after being offboarded from Panorama, the firewall XML configuration file retained template information from the previous Panorama configuration. As a result, when the firewall and its configuration were imported to another Panorama appliance, all configurations in the Network and Device tab became read-only. Fixed an issue on firewalls running PAN-OS 11.1 releases where, after being offboarded from Panorama, the firewall XML configuration file retained template information from the previous Panorama configuration. As a result, when the firewall and its configuration were imported to another Panorama appliance, all configurations in the **Network** and **Device** tab became read-only.
## PAN-286231 ## PAN-286231
@@ -626,7 +626,7 @@ Fixed an issue where the all_task process stopped responding, which caused the f
## PAN-285834 ## PAN-285834
Fixed an issue on Panorama where Policy recommendation displayed Unable to read data for certain profiles due to a large response size. Fixed an issue on Panorama where **Policy recommendation** displayed **Unable to read data** for certain profiles due to a large response size.
## PAN-285818 ## PAN-285818
@@ -674,7 +674,7 @@ Fixed an issue where commits remained at 98% completion when static route config
## PAN-285117 ## PAN-285117
Fixed an issue on Panorama where Browse for Agent Video Traffic under GlobalProtect Gateway configurations returned an Invalid Sequence error due to an invalid XPath within the Panorama template and template stack. Fixed an issue on Panorama where **Browse** for Agent Video Traffic under GlobalProtect Gateway configurations returned an **Invalid Sequence** error due to an invalid XPath within the Panorama template and template stack.
## PAN-284968 ## PAN-284968
@@ -682,7 +682,7 @@ Fixed an issue where the dnsproxy process stopped responding when enabling the A
## PAN-284907 ## PAN-284907
Fixed an issue where the Panorama web interface displayed No Data when viewing configuration logs to see changes before and after a configuration change. Fixed an issue where the Panorama web interface displayed **No Data** when viewing configuration logs to see changes before and after a configuration change.
## PAN-284878 ## PAN-284878
@@ -766,7 +766,7 @@ Fixed an issue where HTTP/2 child streams were blocked by strict-ip-check zone p
## PAN-283613 ## PAN-283613
Fixed an issue on the web interface where the IP Tag Quota(%) value displayed as 2 even when changed. Fixed an issue on the web interface where the **IP Tag** **Quota(%)** value displayed as 2 even when changed.
## PAN-283575 ## PAN-283575
@@ -790,7 +790,7 @@ Fixed an issue where log forwarding to all syslog servers failed if one syslog s
## PAN-283206 ## PAN-283206
Fixed an issue where configuring an HTTP profile to send Webhook alerts to Microsoft Teams failed with a 400 Bad request error when clicking Send Test Log . Fixed an issue where configuring an HTTP profile to send Webhook alerts to Microsoft Teams failed with a 400 Bad request error when clicking **Send Test Log** .
## PAN-283138 ## PAN-283138
@@ -834,7 +834,7 @@ Fixed an issue where a firewall was only able to display a maximum of 14 permitt
## PAN-282240 ## PAN-282240
Fixed an issue where, when attempting to modify an Anti-Spyware profile via the web interface under a shared location, clicking the OK button displayed a console exception error. Fixed an issue where, when attempting to modify an Anti-Spyware profile via the web interface under a shared location, clicking the **OK** button displayed a console exception error.
## PAN-281797 ## PAN-281797
@@ -870,7 +870,7 @@ Fixed an issue on Panorama managed firewalls where, when the service route confi
## PAN-281096 ## PAN-281096
Fixed an issue on HA clusters where, when link and path monitoring was configured and the failover condition was set to all, disconnecting and reconnecting monitored ethernet ports caused the firewall to switch to a nonfunctional role, which resulted in all interfaces except the HA interface going down. Fixed an issue on HA clusters where, when link and path monitoring was configured and the failover condition was set to **all**, disconnecting and reconnecting monitored ethernet ports caused the firewall to switch to a nonfunctional role, which resulted in all interfaces except the HA interface going down.
## PAN-280910 ## PAN-280910
@@ -886,7 +886,7 @@ Fixed an issue where all data interfaces went down due to a Forward Error Correc
## PAN-280554 ## PAN-280554
Fixed an issue on the web interface where the Enable local inline categorization option in URL Filtering profiles incorrectly appeared as enabled by default. Fixed an issue on the web interface where the **Enable local inline categorization** option in URL Filtering profiles incorrectly appeared as enabled by default.
## PAN-280409 ## PAN-280409
@@ -906,11 +906,11 @@ Fixed an issue in the URL filtering logs where the columns and the displayed con
## PAN-280013 ## PAN-280013
Fixed an issue where User-ID custom reports were unable to exclude IP address 0.0.0.0 when using the filter ip notin 0.0.0.0. Fixed an issue where User-ID custom reports were unable to exclude IP address 0.0.0.0 when using the filter **ip notin 0.0.0.0**.
## PAN-279901 ## PAN-279901
Fixed an issue where the firewall dropped client hello packets when decryption was enabled, which prevented access to certain websites. This occurred when the client hello packet was truncated, the accumulation proxy assumed that the first packet contains at least 5 bytes, or out-of-order packets were waiting in L4 TCP. An issue was fixed where the firewall dropped fragmented TLS ClientHello packets, which blocked access to certain websites. This occurred because the packets arrived truncated, in varying sizes and orders, and the firewall's heuristics failed to handle them correctly.
To enable this fix, run: debug dataplane set ssl-decrypt accumulate-client-hello disjoined yes To enable this fix, run: debug dataplane set ssl-decrypt accumulate-client-hello disjoined yes
@@ -924,7 +924,7 @@ Fixed an issue on M-600 line cards where the /var/log/messages file flooded with
## PAN-279584 ## PAN-279584
Fixed an issue where, during software deployment from Panorama to multiple firewalls, some firewalls did not automatically reboot after the upgrade, even when Reboot device after install was selected. This was due to the Panorama timing out before the software deployment completed on the affected firewalls, which prevented the reboot request from being sent. Fixed an issue where, during software deployment from Panorama to multiple firewalls, some firewalls did not automatically reboot after the upgrade, even when **Reboot device after install** was selected. This was due to the Panorama timing out before the software deployment completed on the affected firewalls, which prevented the reboot request from being sent.
## PAN-279500 ## PAN-279500
@@ -970,7 +970,7 @@ Fixed an issue where the configd process restarted during a configuration push f
## PAN-278507 ## PAN-278507
Fixed an issue where the OCSP Signing purpose was not included in the Extended Key Usage field when a certificate was generated on the firewall with the OCSP responder called in the certificate. This caused the GlobalProtect connection to fail with the error Missing OCSP signing purpose in the ExtendedKeyUsage. Fixed an issue where the OCSP Signing purpose was not included in the **Extended Key Usage** field when a certificate was generated on the firewall with the OCSP responder called in the certificate. This caused the GlobalProtect connection to fail with the error **Missing OCSP signing purpose in the ExtendedKeyUsage**.
## PAN-278322 ## PAN-278322
@@ -1002,7 +1002,7 @@ Fixed an issue where the number of registered IP Tags on Panorama did not match
VM-Series firewalls in AWS environments only VM-Series firewalls in AWS environments only
``` ```
Fixed an issue where HA failover mode incorrectly changed from interface move to secondary IP move after a reboot. Fixed an issue where HA failover mode incorrectly changed from **interface move** to **secondary IP move** after a reboot.
## PAN-277808 ## PAN-277808
@@ -1014,11 +1014,11 @@ Fixed an issue where Panorama failed to upgrade due to duplicate path-monitor na
## PAN-277682 ## PAN-277682
Fixed an issue where moving an address object from a device group to shared and renaming it did not reflect in the address group, which caused commits to fail. Fixed an issue where moving an address object from a device group to **shared** and renaming it did not reflect in the address group, which caused commits to fail.
## PAN-277464 ## PAN-277464
Fixed an issue with intermittent access and slower than expected loading times when accessing websites. This occurred when Anti-Spyware inline cloud analysis was enabled and the SSL Command and Control action was not either allow* or **alert and server hello packets were out of order. Fixed an issue with intermittent access and slower than expected loading times when accessing websites. This occurred when Anti-Spyware inline cloud analysis was enabled and the **SSL Command and Control** action was not either **allow* or **alert** and server hello packets were out of order.
## PAN-277178 ## PAN-277178
@@ -1064,15 +1064,15 @@ Fixed an issue where Panorama became unresponsive while performing a dynamic add
## PAN-276484 ## PAN-276484
Fixed an issue where Panorama did not display license information for Cloud NGFW firewalls under (Device Deployment > Licenses) due to the inability to perform batch-license refreshes. Fixed an issue where Panorama did not display license information for Cloud NGFW firewalls under (**Device Deployment > Licenses**) due to the inability to perform batch-license refreshes.
## PAN-276321 ## PAN-276321
Fixed an issue where User-ID mappings were not correctly redistributed from Panorama to firewalls, causing some users to be identified as unknown, which prevented access to resources based on AD group membership. Fixed an issue where User-ID mappings were not correctly redistributed from Panorama to firewalls, causing some users to be identified as **unknown**, which prevented access to resources based on AD group membership.
## PAN-276144 ## PAN-276144
Fixed an issue on the web interface where the Response Page action column was not accessible. Fixed an issue on the web interface where the **Response Page** **action** column was not accessible.
## PAN-276075 ## PAN-276075
@@ -1080,7 +1080,7 @@ Fixed an issue where a warning message that pending changes were holding a commi
## PAN-276033 ## PAN-276033
Fixed an issue on Panorama managed firewalls where SAML identity provider and Clientless Apps objects did not have override or revert options. Fixed an issue on Panorama managed firewalls where **SAML identity provider** and **Clientless Apps** objects did not have override or revert options.
## PAN-276000 ## PAN-276000
@@ -1164,7 +1164,7 @@ Fixed an issue where the displayed group name differed depending on whether the
## PAN-273010 ## PAN-273010
Fixed an issue where the configuration version did not increment in the Audit Comment Archive after making changes to the Security policy rule with an audit comment and performing a commit. As a result, all subsequent changes were grouped under the same configuration version, which prevented the comparison of changes in the Rule Changes field of the Security policy rule. Fixed an issue where the configuration version did not increment in the Audit Comment Archive after making changes to the Security policy rule with an audit comment and performing a commit. As a result, all subsequent changes were grouped under the same configuration version, which prevented the comparison of changes in the **Rule Changes** field of the Security policy rule.
## PAN-273008 ## PAN-273008
@@ -1192,7 +1192,7 @@ Fixed an issue where GlobalProtect cookie authentication failed with the error U
## PAN-272469 ## PAN-272469
Fixed an issue where the DNS exception displayed 0 instead of no result in the anti-spyware profile when no threat ID was available for a DNS security category. Fixed an issue where the DNS exception displayed **0** instead of **no result** in the anti-spyware profile when no threat ID was available for a DNS security category.
## PAN-272395 ## PAN-272395
@@ -1240,7 +1240,7 @@ Fixed an issue where the firewall displayed an incorrect maximum translated IP c
## PAN-271061 ## PAN-271061
Fixed an issue on the web interface where you were unable to add Threat IDs to Signature Exceptions. Fixed an issue on the web interface where you were unable to add Threat IDs to **Signature Exceptions**.
## PAN-270323 ## PAN-270323
@@ -1248,7 +1248,7 @@ Fixed an issue where the firewall allowed cleartext web-browsing traffic on port
## PAN-269843 ## PAN-269843
Fixed an issue where the firewall dropped non-SYN TCP packets even when the Reject non-SYN TCP option was set to No when a session rematch was triggered. Fixed an issue where the firewall dropped non-SYN TCP packets even when the **Reject non-SYN TCP** option was set to **No** when a session rematch was triggered.
## PAN-269812 ## PAN-269812
@@ -1284,7 +1284,7 @@ Fixed an issue where users were unable to log in to Panorama and the following e
## PAN-268522 ## PAN-268522
Fixed an issue where the firewall failed to connect to the update server with a customized service route when the source interface was set to MGT and the source address was set as IPv4. Fixed an issue where the firewall failed to connect to the update server with a customized service route when the source interface was set to **MGT** and the source address was set as IPv4.
## PAN-268426 ## PAN-268426
@@ -1292,7 +1292,7 @@ Fixed an issue where the firewall was unable to connect to a syslog server that
## PAN-268308 ## PAN-268308
Fixed an issue where the Push Scope was not automatically displayed when you selected Commit and Pushes Changes Made by. Fixed an issue where the **Push Scope** was not automatically displayed when you selected **Commit and Pushes Changes Made by**.
## PAN-268002 ## PAN-268002
@@ -1308,7 +1308,7 @@ Fixed an issue where the firewall generated AAAA DNS queries when IPv6 firewalli
## PAN-266776 ## PAN-266776
Fixed an issue where virtual machine interfaces displayed unknown for speed and duplex in the CLI and web interface. Fixed an issue where virtual machine interfaces displayed **unknown** for speed and duplex in the CLI and web interface.
## PAN-266569 ## PAN-266569
@@ -1340,7 +1340,7 @@ Fixed an issue where a selective push was blocked when a configuration load was
## PAN-264040 ## PAN-264040
Fixed an issue where AAAA DNS queries went out even when IPv6 firewalling was disabled. Fixed an issue where AAAA DNS queries went out even when **IPv6 firewalling** was disabled.
## PAN-263699 ## PAN-263699
@@ -1364,7 +1364,7 @@ Fixed an issue where the bytes transmitted and packet transmitted counters for h
## PAN-260581 ## PAN-260581
Fixed an issue where Panorama template changes to the zone and virtual router were not pushed to managed firewalls when the template stack default virtual system was set to None. Fixed an issue where Panorama template changes to the zone and virtual router were not pushed to managed firewalls when the template stack default virtual system was set to **None**.
## PAN-260540 ## PAN-260540
@@ -1400,7 +1400,7 @@ Fixed an issue where Panorama became unresponsive and displayed a 504 gateway ti
## PAN-259579 ## PAN-259579
Fixed an issue where the URL Filtering settings on a firewall displayed an override icon even when no settings were overridden. This occurred due to the hold-client-request field did not have a default value and was set to False. Fixed an issue where the URL Filtering settings on a firewall displayed an override icon even when no settings were overridden. This occurred due to the **hold-client-request** field did not have a default value and was set to **False**.
## PAN-259284 ## PAN-259284
@@ -1416,7 +1416,7 @@ Fixed an issue where the firewall displayed the incorrect rule name when a threa
## PAN-257616 ## PAN-257616
Fixed an issue where selective push operations from Panorama to managed firewalls failed with the error message Failed to generate selective push configuration. Schema validation failed. Please try a full push. Fixed an issue where selective push operations from Panorama to managed firewalls failed with the error message **Failed to generate selective push configuration. Schema validation failed. Please try a full push**.
## PAN-257195 ## PAN-257195
@@ -1428,7 +1428,7 @@ Fixed an issue where the mp-monitor logs did not print disk SMART data.
## PAN-257074 ## PAN-257074
Fixed an issue on the Panorama web interface where the template sync status showed Out-of-Sync for managed devices after a combined commit-all operation. This occurred due to Panorama sending the default MD5 sum of the template to the firewall instead of the correct MD5 sum. Fixed an issue on the Panorama web interface where the template sync status showed **Out-of-Sync** for managed devices after a combined commit-all operation. This occurred due to Panorama sending the default MD5 sum of the template to the firewall instead of the correct MD5 sum.
## PAN-255806 ## PAN-255806
@@ -1492,17 +1492,17 @@ Fixed an issue on the Panorama web interface where you were unable to add static
## PAN-242777 ## PAN-242777
Fixed and issue where users previously reported limitations due to session count caps when utilizing Web Proxy features on PA-5400 Series Firewalls. To address these performance complaints and support higher traffic volumes, we have increased the maximum session capacity on specific PA-5400F series platforms, leveraging available system memory. This update ensures greater capacity and stability for high-volume environments. Fixed and issue where users previously reported limitations due to session count caps when utilizing **Web Proxy** features on PA-5400 Series Firewalls. To address these performance complaints and support higher traffic volumes, we have increased the maximum session capacity on specific **PA-5400F** series platforms, leveraging available system memory. This update ensures greater capacity and stability for high-volume environments.
The supported session limits are: The supported session limits are:
| Platform | Max Sessions | | Platform | Max Sessions |
| --- | --- | | -------- | ------------ |
| PA-5410 | 95K | | PA-5410 | 95K |
| PA-5420 | 95K | | PA-5420 | 95K |
| PA-5430 | 95K | | PA-5430 | 95K |
| PA-5440 | 225K | | PA-5440 | 225K |
| PA-5445 | 250K | | PA-5445 | 250K |
## PAN-241230 ## PAN-241230
@@ -1518,7 +1518,7 @@ Fixed an issue where EW dynamic address groups were not created in Panorama when
## PAN-224020 ## PAN-224020
Fixed an issue where CIE validation checks on the firewall prevented configuration pushes from Panorama, which resulted in commit failures during new firewall deployment. This occurred when a template with an Authentication Profile with the Authentication Type as Cloud Authentication Service was pushed to a newly deployed firewall without internet access or without a device certificate. Fixed an issue where CIE validation checks on the firewall prevented configuration pushes from Panorama, which resulted in commit failures during new firewall deployment. This occurred when a template with an Authentication Profile with the **Authentication Type** as **Cloud Authentication Service** was pushed to a newly deployed firewall without internet access or without a device certificate.
## PAN-221137 ## PAN-221137
@@ -1526,7 +1526,7 @@ Fixed an issue where the CLI command to set the target virtual system accepted a
## PAN-215232 ## PAN-215232
Fixed an issue on Panorama where the GlobalProtect app version was displayed incorrectly in the ACC tab. Fixed an issue on Panorama where the GlobalProtect app version was displayed incorrectly in the **ACC** tab.
## PAN-210501 ## PAN-210501
web/data/issues/PAN-OS/addressed/11.1.12.md
+4 -4
View File
@@ -106,15 +106,15 @@ Fixed an issue where, after upgrading Panorama and Log Collectors from PAN-OS 10
## PAN-294893 ## PAN-294893
Fixed an issue where firewalls with the Send handshake messages to CTD for inspection setting enabled caused incorrect Security policy rules to be matched. Specifically, traffic not identified as openai-base or openai-chatgpt applications was incorrectly matched by the ALLOW-OPEN-AI-FULL-ACCESS-URLS-ALERTS rule. Additionally, the expected response page for blocked URLs was not displayed. Fixed an issue where firewalls with the **Send handshake messages to CTD for inspection** setting enabled caused incorrect Security policy rules to be matched. Specifically, traffic not identified as openai-base or openai-chatgpt applications was incorrectly matched by the ALLOW-OPEN-AI-FULL-ACCESS-URLS-ALERTS rule. Additionally, the expected response page for blocked URLs was not displayed.
## PAN-293848 ## PAN-293848
Fixed an issue where Panorama failed to push the default value of None for the secondary NTP server address to managed firewalls, resulting in a commit validation error. This occurred even when configuring the secondary NTP server address as None in Panorama's web interface, and affected both newly deployed and long-standing production firewalls after upgrading. Fixed an issue where Panorama failed to push the default value of **None** for the secondary NTP server address to managed firewalls, resulting in a commit validation error. This occurred even when configuring the secondary NTP server address as **None** in Panorama's web interface, and affected both newly deployed and long-standing production firewalls after upgrading.
## PAN-292447 ## PAN-292447
Fixed an issue where Panorama did not display data in the Feature Adoption tab in Strata Cloud Manager due to the system creating and deleting a CLI user for each interval instead of reusing a permanent CLI user for telemetry. Fixed an issue where Panorama did not display data in the **Feature Adoption** tab in Strata Cloud Manager due to the system creating and deleting a CLI user for each interval instead of reusing a permanent CLI user for telemetry.
## PAN-292393 ## PAN-292393
@@ -154,7 +154,7 @@ Fixed an issue where, after upgrading firewalls to PAN-OS 11.1.6-h1, certain web
## PAN-287693 ## PAN-287693
Fixed an issue where Panorama did not use the configured proxy settings to check WildFire private cloud content and instead connected directly to the WildFire device using the management interface. This occurred even when Use Proxy Settings for Private Cloud was enabled. Fixed an issue where Panorama did not use the configured proxy settings to check WildFire private cloud content and instead connected directly to the WildFire device using the management interface. This occurred even when **Use Proxy Settings for Private Cloud** was enabled.
## PAN-287622 ## PAN-287622
web/data/issues/PAN-OS/addressed/11.1.13-h1.md
+9 -11
View File
@@ -6,7 +6,7 @@ version: 11.1.13-h1
## PAN-309392 ## PAN-309392
Fixed an issue where the scroll bar did not appear when editing Destination Addresses for Policy Based forwarding policy rules. Fixed an issue where the scroll bar did not appear when editing **Destination Addresses** for Policy Based forwarding policy rules.
## PAN-309379 ## PAN-309379
@@ -90,11 +90,11 @@ Fixed an issue where the firewall displayed as disconnected in the SLS due to th
## PAN-302428 ## PAN-302428
Fixed an issue on Panorama where daily scheduled report emails for custom reports were delivered with no content and instead incorrectly displayed the message No matching data found. With this fix, the content is displayed correctly. Fixed an issue on Panorama where daily scheduled report emails for custom reports were delivered with no content and instead incorrectly displayed the message **No matching data found**. With this fix, the content is displayed correctly.
## PAN-302085 ## PAN-302085
Fixed an issue where network values were not displayed in Panorama with the error message There is no value for the selected item. This was due to the device group passing vsysName in Panorama. Fixed an issue where network values were not displayed in Panorama with the error message **There is no value for the selected item**. This was due to the device group passing vsysName in Panorama.
## PAN-301975 ## PAN-301975
@@ -158,7 +158,7 @@ Fixed an issue where the firewall intermittently failed to forward VXLAN GARP pa
## PAN-292447 ## PAN-292447
Fixed an issue where Panorama did not display data in the Feature Adoption tab in Strata Cloud Manager due to the system creating and deleting a CLI user for each interval instead of reusing a permanent CLI user for telemetry. Fixed an issue where Panorama did not display data in the **Feature Adoption** tab in Strata Cloud Manager due to the system creating and deleting a CLI user for each interval instead of reusing a permanent CLI user for telemetry.
## PAN-291945 ## PAN-291945
@@ -170,7 +170,7 @@ Fixed an issue where the firewall did not automatically recover after a machine
## PAN-283237 ## PAN-283237
Fixed an issue where traffic logs incorrectly displayed the action as allow for traffic matching a Security policy rule configured with the action set to deny. This issue occurred due to the child session being used for policy rule lookup when a configuration update triggered a rematch if the FTP-data application was not in the rule. Fixed an issue where traffic logs incorrectly displayed the action as **allow** for traffic matching a Security policy rule configured with the action set to **deny**. This issue occurred due to the child session being used for policy rule lookup when a configuration update triggered a rematch if the FTP-data application was not in the rule.
## PAN-281588 ## PAN-281588
@@ -198,10 +198,8 @@ Fixed an issue where memory leaks related to the devsrvr process occurred when d
## PAN-185731 ## PAN-185731
Fixed an issue where the firewall was unable to parse the URL path and host when the host header was located in a different packet, which resulted in the firewall not logging the URL path in the first packet. The fix is disabled by default. The following CLI commands can be used to enable/disable the feature:set system setting ctd url-crosspkt-host-path-caching enableset system setting ctd url-crosspkt-host-path-caching disableset system setting ctd url-crosspkt-host-path-caching default Fixed an issue where the firewall was unable to parse the URL path and host when the host header was located in a different packet, which resulted in the firewall not logging the URL path in the first packet. The fix is disabled by default. The following CLI commands can be used to enable/disable the feature:
set system setting ctd url-crosspkt-host-path-caching enable - set system setting ctd url-crosspkt-host-path-caching enable
- set system setting ctd url-crosspkt-host-path-caching disable
set system setting ctd url-crosspkt-host-path-caching disable - set system setting ctd url-crosspkt-host-path-caching default
set system setting ctd url-crosspkt-host-path-caching default
web/data/issues/PAN-OS/addressed/11.1.13-h2.md
+1 -1
View File
@@ -78,7 +78,7 @@ Fixed an issue where, after upgrading the firewall to an affected release, Globa
## PAN-305700 ## PAN-305700
Fixed an issue where a reboot loop occurred when OSPF interfaces were configued with a link type of point-to-point. Fixed an issue where a reboot loop occurred when OSPF interfaces were configued with a link type of **point-to-point**.
## PAN-305552 ## PAN-305552
web/data/issues/PAN-OS/addressed/11.1.13-h3.md
+28
View File
@@ -6,6 +6,10 @@ version: 11.1.13-h3
## PAN-316911 ## PAN-316911
```caveat
VM-Series firewalls on Amazon Web Services (AWS) environments only
```
Fixed an issue where a newly bootstrapped firewall required a management server restart, relicensing, or license push from Panorama to invoke the device certificate. Fixed an issue where a newly bootstrapped firewall required a management server restart, relicensing, or license push from Panorama to invoke the device certificate.
## PAN-315176 ## PAN-315176
@@ -18,6 +22,10 @@ Fixed an issue where traffic was disrupted during IPSec rekey operations due to
## PAN-313850 ## PAN-313850
```caveat
PA-1400 Series firewalls in HA configurations only
```
Fixed an issue where a split-brain condition occurred and HA1/HA2 links went down while upgrading when the HA configuration used dataplane interfaces for HA1 and a combination of HSCI and Ethernet interfaces for HA2. Fixed an issue where a split-brain condition occurred and HA1/HA2 links went down while upgrading when the HA configuration used dataplane interfaces for HA1 and a combination of HSCI and Ethernet interfaces for HA2.
## PAN-313623 ## PAN-313623
@@ -26,10 +34,18 @@ Fixed an issue where the /opt/pancfg/mgmt/ssl/private/ directory on Palo Alto Ne
## PAN-311285 ## PAN-311285
```caveat
Firewalls in HA conditions only
```
Fixed an issue where a memory leak occurred related to the ospfd process, which caused RAM usage to continuously increase on active devices in an HA cluster until the device stopped responding, even after an HA failover. Fixed an issue where a memory leak occurred related to the ospfd process, which caused RAM usage to continuously increase on active devices in an HA cluster until the device stopped responding, even after an HA failover.
## PAN-308507 ## PAN-308507
```caveat
Panorama managed firewalls only
```
Fixed an issue where the firewall intermittently failed to maintain active log forwarding streams to Cortex Data Lake even when duplicate logging and enhanced application logging were enabled. Fixed an issue where the firewall intermittently failed to maintain active log forwarding streams to Cortex Data Lake even when duplicate logging and enhanced application logging were enabled.
## PAN-309300 ## PAN-309300
@@ -38,6 +54,10 @@ Fixed an issue where management plane system resources configuration size exceed
## PAN-302654 ## PAN-302654
```caveat
Firewalls in active/passive HA configurations only
```
Fixed an issue where, when the HA configuration had multiple logical routers, static or connected routes redistributed into OSPF aged out in the LSDB, which caused the routes to be removed on peer OSPF neighbors. Fixed an issue where, when the HA configuration had multiple logical routers, static or connected routes redistributed into OSPF aged out in the LSDB, which caused the routes to be removed on peer OSPF neighbors.
## PAN-300423 ## PAN-300423
@@ -50,8 +70,16 @@ Optimized the commit workflow to reduce the size of the effective configuration,
## PAN-296202 ## PAN-296202
```caveat
Firewalls in active/active HA configurations only
```
Added a log enhancement to capture an issue where, when a commit operation was in progress, newly deployed IP address tags that used the XML API were not immediately reflected in address group resolution, which delayed IP address mapping to address groups and caused traffic to be incorrectly allowed or denied. Added a log enhancement to capture an issue where, when a commit operation was in progress, newly deployed IP address tags that used the XML API were not immediately reflected in address group resolution, which delayed IP address mapping to address groups and caused traffic to be incorrectly allowed or denied.
## PAN-273158 ## PAN-273158
```caveat
PA-7000 Series firewalls only
```
Fixed an issue where an incorrect ASIC configuration caused silent packet drops or application slowness when receiving a mix of jumbo and non-jumbo packets. Fixed an issue where an incorrect ASIC configuration caused silent packet drops or application slowness when receiving a mix of jumbo and non-jumbo packets.
web/data/issues/PAN-OS/addressed/11.1.2-h1.md
+3 -9
View File
@@ -6,9 +6,7 @@ version: 11.1.2-h1
## PAN-242879 ## PAN-242879
Fixed an issue where the dataplane restarted when advanced features Fixed an issue where the dataplane restarted when advanced features such as Advanced Threat Protection, Advanced WildFire, and Advanced URL Filtering hit max latency under inline mode.
such as Advanced Threat Protection, Advanced WildFire, and Advanced
URL Filtering hit max latency under inline mode.
## PAN-242634 ## PAN-242634
@@ -16,15 +14,11 @@ URL Filtering hit max latency under inline mode.
PA-1400 Series, PA-3400 Series, and PA-5400 Series firewalls only PA-1400 Series, PA-3400 Series, and PA-5400 Series firewalls only
``` ```
Fixed an issue where a large packet burst from the Fixed an issue where a large packet burst from the dataplane to the management plane caused the DPDK kernel network interface to become unresponsive.
dataplane to the management plane caused the DPDK kernel network
interface to become unresponsive.
## PAN-240166 ## PAN-240166
Fixed an issue where, when explicit proxy was configured on the Fixed an issue where, when explicit proxy was configured on the firewall, websites loaded more slowly than expected or did not load due to DNS using TCP.
firewall, websites loaded more slowly than expected or did not load
due to DNS using TCP.
## PAN-239279 ## PAN-239279
web/data/issues/PAN-OS/addressed/11.1.2-h12.md
+12 -31
View File
@@ -6,14 +6,11 @@ version: 11.1.2-h12
## PAN-264421 ## PAN-264421
Fixed an issue on Panorama where Push Scope Fixed an issue on Panorama where **Push Scope** did not populate automatically after changing the device group configuration.
did not populate automatically after changing the device group
configuration.
## PAN-263226 ## PAN-263226
Fixed an issue where decryption based traffic failed on Explicit Fixed an issue where decryption based traffic failed on Explicit Proxy nodes.
Proxy nodes.
## PAN-262831 ## PAN-262831
@@ -21,56 +18,40 @@ Proxy nodes.
PA-5450 firewalls only PA-5450 firewalls only
``` ```
Fixed an intermittent issue where Fixed an intermittent issue where the all_task process stopped responding, which caused the firewall to restart.
the all_task process stopped responding, which caused
the firewall to restart.
## PAN-262593 ## PAN-262593
Fixed an issue where traffic to websites failed on the Google Chrome Fixed an issue where traffic to websites failed on the Google Chrome web browser on Secure Web Gateway (SWG) nodes.
web browser on Secure Web Gateway (SWG) nodes.
## PAN-261991 ## PAN-261991
Fixed an issue where traffic that did not match a decryption policy Fixed an issue where traffic that did not match a decryption policy rule, or matched a no-decrypt policy rule, failed when accumulation proxy was enabled and a Zone Protection profile was configured with syn-cookies enabled.
rule, or matched a no-decrypt policy rule, failed when accumulation
proxy was enabled and a Zone Protection profile was configured with
syn-cookies enabled.
## PAN-261917 ## PAN-261917
Fixed an issue where websites with a no-decrypt policy rule were Fixed an issue where websites with a no-decrypt policy rule were decrypted in traffic log when using a Google Chrome browser with PQC enabled.
decrypted in traffic log when using a Google Chrome browser with PQC
enabled.
## PAN-259769 ## PAN-259769
Fixed an issue where the GlobalProtect portal was not accessible via Fixed an issue where the GlobalProtect portal was not accessible via a web browser and displayed the error ERR_EMPTY_RESPONSE.
a web browser and displayed the error
ERR_EMPTY_RESPONSE.
## PAN-258736 ## PAN-258736
Fixed an issue where policy rule configurations pushed from Panorama Fixed an issue where policy rule configurations pushed from Panorama were not reflected on the firewall if the rule had 63 characters.
were not reflected on the firewall if the rule had 63
characters.
## PAN-253213 ## PAN-253213
Fixed an issue where the firewall sent HIP notifications every time Fixed an issue where the firewall sent HIP notifications every time it received a HIP report instead of every two hours.
it received a HIP report instead of every two hours.
## PAN-252300 ## PAN-252300
Fixed an issue where you were unable to select device groups in the Fixed an issue where you were unable to select device groups in the push scope for user accounts.
push scope for user accounts.
## PAN-245690 ## PAN-245690
Fixed an issue where the Managed Collectors Fixed an issue where the **Managed Collectors** health status on Panorama displayed as empty.
health status on Panorama displayed as empty.
## PAN-209574 ## PAN-209574
Fixed an issue with HTTP/2 traffic where downloading large files did Fixed an issue with HTTP/2 traffic where downloading large files did not work when decryption was enabled.
not work when decryption was enabled.
web/data/issues/PAN-OS/addressed/11.1.2-h14.md
+9 -26
View File
@@ -6,8 +6,7 @@ version: 11.1.2-h14
## PAN-262287 ## PAN-262287
Fixed an issue where dereferencing a NULL pointer that occurred Fixed an issue where dereferencing a NULL pointer that occurred caused pan_task processes to stop responding.
caused pan_task processes to stop responding.
## PAN-261673 ## PAN-261673
@@ -15,22 +14,15 @@ caused pan_task processes to stop responding.
VM-Series firewalls on Microsoft Azure environments only VM-Series firewalls on Microsoft Azure environments only
``` ```
Fixed an issue where, when Accelerated Networking was enabled, Fixed an issue where, when Accelerated Networking was enabled, traffic was dropped because of the flow_parse_ip_hdr counter related to an Nvidia driver issue.
traffic was dropped because of the
flow_parse_ip_hdr counter related to an Nvidia
driver issue.
## PAN-259151 ## PAN-259151
Fixed an issue where unused objects were pushed to the firewall, Fixed an issue where unused objects were pushed to the firewall, which caused configuration pushes to fail with the error Number of address groups exceed platform capacity.
which caused configuration pushes to fail with the error
Number of address groups exceed platform
capacity.
## PAN-259002 ## PAN-259002
Fixed an issue where frequent external dynamic list updates caused Fixed an issue where frequent external dynamic list updates caused the configd process to restart.
the configd process to restart.
## PAN-257601 ## PAN-257601
@@ -38,25 +30,19 @@ the configd process to restart.
PA-5450 firewalls only PA-5450 firewalls only
``` ```
Fixed an issue where Networking Fixed an issue where Networking Cards (NC) experienced an internal link fault which caused path monitoring failure on the Dataplane Processing Card (DPC).
Cards (NC) experienced an internal link fault which caused path
monitoring failure on the Dataplane Processing Card (DPC).
## PAN-257327 ## PAN-257327
Fixed an issue where a failover event occurred unexpectedly on the Fixed an issue where a failover event occurred unexpectedly on the firewall.
firewall.
## PAN-253626 ## PAN-253626
Fixed an issue on Panorama where unused objects were pushed to the Fixed an issue on Panorama where unused objects were pushed to the firewall, which caused the push operations to intermittently fail.
firewall, which caused the push operations to intermittently
fail.
## PAN-236191 ## PAN-236191
Fixed an issue where the web interface performance was slower than Fixed an issue where the web interface performance was slower than expected.
expected.
## PAN-222542 ## PAN-222542
@@ -64,7 +50,4 @@ expected.
PA-7000 Series firewalls only PA-7000 Series firewalls only
``` ```
Fixed an issue where Log Fixed an issue where Log Forward Cards (LFC) were incorrectly identified as distribution policies, which caused packet loss due to traffic, BFD, and other control packets being forwarded to the LFC.
Forward Cards (LFC) were incorrectly identified as distribution
policies, which caused packet loss due to traffic, BFD, and other
control packets being forwarded to the LFC.
web/data/issues/PAN-OS/addressed/11.1.2-h15.md
+1 -2
View File
@@ -6,5 +6,4 @@ version: 11.1.2-h15
## PAN-272809 ## PAN-272809
A fix was made to address CVE-2024-0012 (PAN-SA-2024-0015) and A fix was made to address [CVE-2024-0012](https://security.paloaltonetworks.com/CVE-2024-0012) ([PAN-SA-2024-0015](https://security.paloaltonetworks.com/PAN-SA-2024-0015)) and [CVE-2024-9474](https://security.paloaltonetworks.com/CVE-2024-9474).
CVE-2024-9474.
web/data/issues/PAN-OS/addressed/11.1.2-h16.md
+12 -31
View File
@@ -6,23 +6,19 @@ version: 11.1.2-h16
## PAN-272809 ## PAN-272809
A fix was made to address CVE-2024-0012 (PAN-SA-2024-0015) and A fix was made to address [CVE-2024-0012](https://security.paloaltonetworks.com/CVE-2024-0012) ([PAN-SA-2024-0015](https://security.paloaltonetworks.com/PAN-SA-2024-0015)) and [CVE-2024-9474](https://security.paloaltonetworks.com/CVE-2024-9474).
CVE-2024-9474.
## PAN-269000 ## PAN-269000
Fixed an issue where the firewall stopped responding due to a NULL Fixed an issue where the firewall stopped responding due to a NULL pointer dereference when path monitoring failed.
pointer dereference when path monitoring failed.
## PAN-265785 ## PAN-265785
Fixed an issue where the firewall rebooted due to a sysd Fixed an issue where the firewall rebooted due to a sysd variable being modified before it was created.
variable being modified before it was created.
## PAN-265179 ## PAN-265179
Fixed an issue where a kernel race condition caused the firewall to Fixed an issue where a kernel race condition caused the firewall to reboot with a kernel panic.
reboot with a kernel panic.
## PAN-263973 ## PAN-263973
@@ -34,30 +30,23 @@ Fixed an issue where log collectors had a low incoming log rate.
PA-5440 and PA-5445 firewalls only PA-5440 and PA-5445 firewalls only
``` ```
Fixed an issue where Fixed an issue where interrupts were generated at a certain packet rate, and dataplane processes missed heartbeats, which caused the dataplane to go down.
interrupts were generated at a certain packet rate, and dataplane
processes missed heartbeats, which caused the dataplane to go
down.
## PAN-259881 ## PAN-259881
Fixed an issue on Panorama where traffic log details were not Fixed an issue on Panorama where traffic log details were not displayed under **detailed log view**.
displayed under detailed log view.
## PAN-259351 ## PAN-259351
A fix was made to address CVE-2024-3393. A fix was made to address [CVE-2024-3393](https://security.paloaltonetworks.com/CVE-2024-3393).
## PAN-256223 ## PAN-256223
Fixed an issue where device telemetry log collection filled the root Fixed an issue where device telemetry log collection filled the root partition.
partition.
## PAN-255747 ## PAN-255747
Fixed an issue on the firewall where CLI commands returned Fixed an issue on the firewall where CLI commands returned Server error: op command for client dagger timed out as client is not available.
Server error: op command for client dagger timed
out as client is not available.
## PAN-253485 ## PAN-253485
@@ -65,20 +54,12 @@ out as client is not available.
Firewalls in active/passive HA configurations only Firewalls in active/passive HA configurations only
``` ```
Fixed Fixed an issue where dataplane packet capture filter configuration failed on the active firewall with the error op command for client dagger timed out as client is not available.
an issue where dataplane packet capture filter configuration failed
on the active firewall with the error op command for
client dagger timed out as client is not
available.
## PAN-249300 ## PAN-249300
Fixed an issue where, when CUID was enabled, the CUID firewall pub Fixed an issue where, when CUID was enabled, the CUID firewall pub node was slower than expected when processing incoming traffic and User-ID mapping redistribution between PAN-OS nodes was impacted.
node was slower than expected when processing incoming traffic and
User-ID mapping redistribution between PAN-OS nodes was
impacted.
## PAN-219805 ## PAN-219805
Fixed an issue where the reportd process stopped Fixed an issue where the reportd process stopped responding due to a race condition.
responding due to a race condition.
web/data/issues/PAN-OS/addressed/11.1.2-h18.md
+6 -15
View File
@@ -6,33 +6,24 @@ version: 11.1.2-h18
## PAN-279604 ## PAN-279604
Fixed an issue where scheduled SaaS application usage reports were Fixed an issue where scheduled SaaS application usage reports were generated incorrectly, and the login page was displayed instead of the report content.
generated incorrectly, and the login page was displayed instead of
the report content.
## PAN-273085 ## PAN-273085
Fixed an issue on the web interface where you were unable to edit or Fixed an issue on the web interface where you were unable to edit or create policy rules.
create policy rules.
## PAN-272006 ## PAN-272006
Fixed an issue where the firewall did not trigger a kernel core dump Fixed an issue where the firewall did not trigger a kernel core dump as a large core when the CPLD (Complex Programmable Logic Device) sent a Non-Maskable Interrupt (NMI) to the CPU.
as a large core when the CPLD (Complex Programmable Logic Device)
sent a Non-Maskable Interrupt (NMI) to the CPU.
## PAN-271926 ## PAN-271926
Fixed an issue where TLS 1.3 decryption failed with a bad record MAC Fixed an issue where TLS 1.3 decryption failed with a bad record MAC error when the firewall was configured to decrypt and inspect TLS traffic.
error when the firewall was configured to decrypt and inspect TLS
traffic.
## PAN-270549 ## PAN-270549
Fixed an issue where some TLS connections were not handled correctly, Fixed an issue where some TLS connections were not handled correctly, which led to instability in the dataplane.
which led to instability in the dataplane.
## PAN-268727 ## PAN-268727
Fixed an issue where traffic was dropped when the accumulation proxy Fixed an issue where traffic was dropped when the accumulation proxy was enabled and header insertion modified packets.
was enabled and header insertion modified packets.
web/data/issues/PAN-OS/addressed/11.1.2-h3.md
+4 -14
View File
@@ -6,26 +6,16 @@ version: 11.1.2-h3
## PAN-252214 ## PAN-252214
A fix was made to address CVE-2024-3400. A fix was made to address [CVE-2024-3400](https://security.paloaltonetworks.com/CVE-2024-3400).
## PAN-246949 ## PAN-246949
Fixed an issue where custom admin users were not able to click Fixed an issue where custom admin users were not able to click **OK** in the push scope selection window when device group or template were disabled under commit in the admin roles.
OK in the push scope selection window
when device group or template were disabled under commit in the
admin roles.
## PAN-244013 ## PAN-244013
Fixed an issue on the Panorama web interface where, when a new Fixed an issue on the Panorama web interface where, when a new content package was installed, new **Anti-Spyware Signatures** and new **Vulnerability Signatures** were not visible in their respective profiles.
content package was installed, new Anti-Spyware
Signatures and new Vulnerability
Signatures were not visible in their respective
profiles.
## PAN-243951 ## PAN-243951
Fixed an issue on Panorama appliances in active/passive HA Fixed an issue on Panorama appliances in active/passive HA configurations where managed devices displayed as out-of-sync on the passive appliance when peer configuration changes were made to the SD-WAN configuration on the active peer.
configurations where managed devices displayed as out-of-sync on the
passive appliance when peer configuration changes were made to the
SD-WAN configuration on the active peer.
web/data/issues/PAN-OS/addressed/11.1.2-h4.md
+26 -64
View File
@@ -6,31 +6,23 @@ version: 11.1.2-h4
## PAN-252214 ## PAN-252214
A fix was made to address CVE-2024-3400. A fix was made to address [CVE-2024-3400](https://security.paloaltonetworks.com/CVE-2024-3400).
## PAN-251013 ## PAN-251013
Fixed an issue on the web interface where the Virtual Fixed an issue on the web interface where the **Virtual Router** and **Virtual System** configurations for the template incorrectly showed as **none**.
Router and Virtual System
configurations for the template incorrectly showed as
none.
## PAN-250686 ## PAN-250686
Fixed an issue where selective push operations did not work when more Fixed an issue where selective push operations did not work when more than one admin user simultaneously performed changes and partial commits on Panorama.
than one admin user simultaneously performed changes and partial
commits on Panorama.
## PAN-249931 ## PAN-249931
Fixed an issue where configuration pushes from Panorama on PAN-OS Fixed an issue where configuration pushes from Panorama on PAN-OS 11.1.1 to a firewall on a PAN-OS 10.2 release failed.
11.1.1 to a firewall on a PAN-OS 10.2 release failed.
## PAN-249808 ## PAN-249808
Fixed an issue where the configd process stopped Fixed an issue where the configd process stopped responding when performing multi-device group pushes via XML API.
responding when performing multi-device group pushes via XML
API.
## PAN-247403 ## PAN-247403
@@ -38,114 +30,84 @@ API.
VM-Series firewalls only VM-Series firewalls only
``` ```
Fixed an issue where the push Fixed an issue where the push scope CLI command took longer than expected, which caused the web interface to be slow.
scope CLI command took longer than expected, which caused the web
interface to be slow.
## PAN-246960 ## PAN-246960
Fixed an issue where firewalls failed to fetch content updates from Fixed an issue where firewalls failed to fetch content updates from the Wildfire Private Cloud due to an **Unsupported protocol** error.
the Wildfire Private Cloud due to an Unsupported
protocol error.
## PAN-244894 ## PAN-244894
Fixed an issue where turning off mprelay logging caused Fixed an issue where turning off mprelay logging caused *mprelay* heartbeat failure.
*mprelay* heartbeat failure.
## PAN-244622 ## PAN-244622
Fixed an issue where FIB re-push did not work with Advanced Routing Fixed an issue where FIB re-push did not work with Advanced Routing enabled.
enabled.
## PAN-244227 ## PAN-244227
Fixed an issue where inconsistent FIB entries across the dataplane Fixed an issue where inconsistent FIB entries across the dataplane were not detected.
were not detected.
## PAN-242309 ## PAN-242309
Fixed an issue where a higher byte count (s2c) was observed for Fixed an issue where a higher byte count (s2c) was observed for DNS-Base application.
DNS-Base application.
## PAN-242027 ## PAN-242027
Fixed an issue where the all-task process repeatedly Fixed an issue where the all-task process repeatedly restarted during memory allocation failures.
restarted during memory allocation failures.
## PAN-241141 ## PAN-241141
Fixed an issue where creating more than one address object in the Fixed an issue where creating more than one address object in the same XML API request resulted in a commit error.
same XML API request resulted in a commit error.
## PAN-240477 ## PAN-240477
Fixed a temporary hardware issue that caused PAN-SFP-PLUS-CU-5M to Fixed a temporary hardware issue that caused PAN-SFP-PLUS-CU-5M to not be able to link up on PA-3400 and PA-1400 Series firewalls.
not be able to link up on PA-3400 and PA-1400 Series firewalls.
## PAN-240308 ## PAN-240308
Fixed an issue where ElasticSearch did not work as expected when Fixed an issue where ElasticSearch did not work as expected when raid-mounts were not fully ready after a reboot.
raid-mounts were not fully ready after a reboot.
## PAN-239367 ## PAN-239367
Fixed an issue on the firewall where a memory leak associated with Fixed an issue on the firewall where a memory leak associated with the logrcvr process occurred.
the logrcvr process occurred.
## PAN-239354 ## PAN-239354
Fixed an issue where DNS resolution was delayed when an Antispyware Fixed an issue where DNS resolution was delayed when an Antispyware policy rule was applied to both client to firewall and firewall to internal DNS server legs of a connection.
policy rule was applied to both client to firewall and firewall to
internal DNS server legs of a connection.
## PAN-238643 ## PAN-238643
Fixed an issue where a memory leak caused multiple processes to stop Fixed an issue where a memory leak caused multiple processes to stop responding when VM Information Sources was configured
responding when VM Information Sources was configured
## PAN-237537 ## PAN-237537
Fixed an issue where, when deleting CTD entries, the Fixed an issue where, when deleting CTD entries, the all_pktproc process stopped responding which resulted in dataplane failure.
all_pktproc process stopped responding which
resulted in dataplane failure.
## PAN-237208 ## PAN-237208
Fixed an issue where the reportd process stopped and the Fixed an issue where the reportd process stopped and the firewall rebooted.
firewall rebooted.
## PAN-233789 ## PAN-233789
Fixed an issue with push and commit and push operations where the Fixed an issue with push and commit and push operations where the user was not correctly bound to the scope, which caused all device groups to be selected for a selective push.
user was not correctly bound to the scope, which caused all device
groups to be selected for a selective push.
## PAN-233692 ## PAN-233692
Fixed an issue on Panorama where the configd process Fixed an issue on Panorama where the configd process stopped, which caused performance issues.
stopped, which caused performance issues.
## PAN-233684 ## PAN-233684
Fixed an issue on Panorama where Push to Fixed an issue on Panorama where **Push to Devices** or **Commit and Push** operations took longer than expected on the web interface.
Devices or Commit and Push
operations took longer than expected on the web interface.
## PAN-231148 ## PAN-231148
Fixed an issue where no DHCP option list was defined when using Fixed an issue where no DHCP option list was defined when using GlobalProtect.
GlobalProtect.
## PAN-230746 ## PAN-230746
Fixed an issue on the web interface where device groups with a large Fixed an issue on the web interface where device groups with a large number of managed firewalls displayed the **Policy** page more slowly than expected.
number of managed firewalls displayed the
Policy page more slowly than
expected.
## PAN-205482 ## PAN-205482
Fixed an issue related to the configd process where Fixed an issue related to the configd process where Panorama displayed the error **Server not responding** when editing policies.
Panorama displayed the error Server not
responding when editing policies.
web/data/issues/PAN-OS/addressed/11.1.2-h9.md
+17 -48
View File
@@ -6,20 +6,15 @@ version: 11.1.2-h9
## PAN-258225 ## PAN-258225
Fixed an issue on the Panorama web interface where Security policy Fixed an issue on the Panorama web interface where Security policy rules loaded more slowly than expected.
rules loaded more slowly than expected.
## PAN-257615 ## PAN-257615
Fixed an issue on Panorama where logs did not display or displayed Fixed an issue on Panorama where logs did not display or displayed intermittently on the web interface.
intermittently on the web interface.
## PAN-256725 ## PAN-256725
Fixed an issue on the Panorama interface where Fixed an issue on the Panorama interface where **Traffic** and **Unified** event details loaded more slowly than expected.
Traffic and
Unified event details loaded more slowly
than expected.
## PAN-255868 ## PAN-255868
@@ -27,27 +22,19 @@ than expected.
PA-3400 Series firewalls only PA-3400 Series firewalls only
``` ```
Fixed an issue where the Fixed an issue where the firewall entered maintenance mode after enabling kernel data collection during the silent reboot.
firewall entered maintenance mode after enabling kernel data
collection during the silent reboot.
## PAN-255266 ## PAN-255266
Fixed an issue where you were unable to clone a template stack with Fixed an issue where you were unable to clone a template stack with the Pre-Shared Key variable.
the Pre-Shared Key variable.
## PAN-254411 ## PAN-254411
Fixed an issue where the configd process stopped Fixed an issue where the configd process stopped responding, which caused **RR_CONNECTION_REFUSED** error messages to be displayed in admin sessions.
responding, which caused
RR_CONNECTION_REFUSED error messages to
be displayed in admin sessions.
## PAN-253546 ## PAN-253546
Fixed an issue where a TLS client hello was split into multiple Fixed an issue where a TLS client hello was split into multiple packets and arrived out of order, so the packets were dropped and the session terminated.
packets and arrived out of order, so the packets were dropped and
the session terminated.
## PAN-251563 ## PAN-251563
@@ -55,42 +42,31 @@ Added CPLD enhancement to capture external power issues.
## PAN-247099 ## PAN-247099
Fixed an issue where the firewall decrypted traffic unexpectedly when Fixed an issue where the firewall decrypted traffic unexpectedly when the client hello was spread across multiple packets.
the client hello was spread across multiple packets.
## PAN-246772 ## PAN-246772
Fixed an issue on the firewall where the dataplane went down due to a Fixed an issue on the firewall where the dataplane went down due to a path monitor failure caused by an OOM condition related to the pan_task process.
path monitor failure caused by an OOM condition related to the
pan_task process.
## PAN-246059 ## PAN-246059
Fixed an issue where forwarded logs were not visible on Panorama due Fixed an issue where forwarded logs were not visible on Panorama due to the Elasticsearch service not starting when it encountered old and unsupported indices.
to the Elasticsearch service not starting when it encountered old
and unsupported indices.
## PAN-245428 ## PAN-245428
Fixed an issue where FIB entries aged out and were incorrectly Fixed an issue where FIB entries aged out and were incorrectly removed after an HA failover event.
removed after an HA failover event.
## PAN-244548 ## PAN-244548
Fixed an issue where ECMP sessions changed destination MAC addresses Fixed an issue where ECMP sessions changed destination MAC addresses mid-session, which caused connections to be reset.
mid-session, which caused connections to be reset.
## PAN-243098 ## PAN-243098
Fixed an issue with corrupted images when SSL decryption and Security Fixed an issue with corrupted images when SSL decryption and Security profiles were configured.
profiles were configured.
## PAN-240739 ## PAN-240739
Fixed an issue where the ECMP FIB update on the dataplane didn't Fixed an issue where the ECMP FIB update on the dataplane didn't clear the pending change flag, which caused the next non-ECMP FIB update to miss the latest generation ID and age out after 5 minutes.
clear the pending change flag, which caused the next non-ECMP FIB
update to miss the latest generation ID and age out after 5
minutes.
## PAN-240612 ## PAN-240612
@@ -98,19 +74,12 @@ Fixed a kernel panic caused by a third-party issue.
## PAN-240596 ## PAN-240596
Fixed an issue where the all_task process stopped Fixed an issue where the all_task process stopped responding due to an invalid memory address.
responding due to an invalid memory address.
## PAN-236133 ## PAN-236133
Fixed an issue where SSL traffic was impacted when SSL Fixed an issue where SSL traffic was impacted when **SSL Command and Control detector** for Incline Cloud Analysis was set to**reset-both**, **reset-client**, **reset-server**, or **drop**.
Command and Control detector for Incline Cloud
Analysis was set to reset-both,
reset-client,
reset-server, or
drop.
## PAN-234560 ## PAN-234560
Fixed an issue where the daily summary report displayed IPv6 Fixed an issue where the daily summary report displayed IPv6 addresses instead of IPv4 addresses.
addresses instead of IPv4 addresses.
web/data/issues/PAN-OS/addressed/11.1.2.md
+6 -9
View File
@@ -18,11 +18,11 @@ Fixed an issue where scheduled email reports failed if the @ symbol before the m
## PAN-241504 ## PAN-241504
Fixed an issue on the web interface where filtering logs under the Monitor tab was slower than expected. Fixed an issue on the web interface where filtering logs under the **Monitor** tab was slower than expected.
## PAN-239769 ## PAN-239769
Fixed an issue where object references in a rule were renamed, and a selective revert of the changes with Commit changes by me caused a reference error. Fixed an issue where object references in a rule were renamed, and a selective revert of the changes with **Commit changes by me** caused a reference error.
## PAN-238769 ## PAN-238769
@@ -42,7 +42,7 @@ Fixed an issue where the /opt/panlogs partition reached capacity due to the logd
## PAN-235840 ## PAN-235840
Fixed an issue where, after a configuration push from Panorama to managed firewalls, the status displayed as None and the push took longer than expected. Fixed an issue where, after a configuration push from Panorama to managed firewalls, the status displayed as **None** and the push took longer than expected.
## PAN-235585 ## PAN-235585
@@ -62,13 +62,11 @@ Fixed an issue where selective pushes on Panorama removed a previously pushed co
## PAN-226785 ## PAN-226785
Fixed an issue where accessing websites with HTTP to HTTPS redirect Fixed an issue where accessing websites with HTTP to HTTPS redirect failed via explicit proxy.
failed via explicit proxy.
## PAN-225337 ## PAN-225337
Fixed an issue on Panorama related to Shared configuration objects Fixed an issue on Panorama related to Shared configuration objects where configuration pushes to multi-vsys firewalls failed.
where configuration pushes to multi-vsys firewalls failed.
## PAN-225203 ## PAN-225203
@@ -88,5 +86,4 @@ Fixed an issue where selective pushes failed with the error message Failed to ge
Panorama appliances in Log Collector mode only Panorama appliances in Log Collector mode only
``` ```
Fixed an Fixed an issue where Panorama stopped processing and saving logs.
issue where Panorama stopped processing and saving logs.
web/data/issues/PAN-OS/addressed/11.1.3-h1.md
+2 -5
View File
@@ -6,8 +6,7 @@ version: 11.1.3-h1
## PAN-256765 ## PAN-256765
Fixed an issue where you were unable to push variables from Panorama Fixed an issue where you were unable to push variables from Panorama in service routes for non-cluster templates.
in service routes for non-cluster templates.
## PAN-255868 ## PAN-255868
@@ -15,6 +14,4 @@ in service routes for non-cluster templates.
PA-3400 Series firewalls only PA-3400 Series firewalls only
``` ```
Fixed an issue where the Fixed an issue where the firewall entered maintenance mode after enabling kernel data collection during the silent reboot.
firewall entered maintenance mode after enabling kernel data
collection during the silent reboot.
web/data/issues/PAN-OS/addressed/11.1.3-h10.md
+18 -48
View File
@@ -10,20 +10,15 @@ version: 11.1.3-h10
PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-5450 firewalls only PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-5450 firewalls only
``` ```
Fixed an issue where the copper ports Fixed an issue where the copper ports flapped when generating a technical support file or executing telemetry.
flapped when generating a technical support file or executing
telemetry.
## PAN-265287 ## PAN-265287
Fixed an issue where the firewall experienced a packet buffer leak in Fixed an issue where the firewall experienced a packet buffer leak in the dataplane of the network processing card (NPC) when processing certain net messages.
the dataplane of the network processing card (NPC) when processing
certain net messages.
## PAN-265287 ## PAN-265287
Fixed an issue where the firewall experienced a packet buffer leak in Fixed an issue where the firewall experienced a packet buffer leak in the dataplane of the NPC when processing certain net messages.
the dataplane of the NPC when processing certain net messages.
## PAN-263973 ## PAN-263973
@@ -31,37 +26,27 @@ Fixed an issue where log collectors had a low incoming log rate.
## PAN-262287 ## PAN-262287
Fixed an issue where dereferencing a NULL pointer that occurred Fixed an issue where dereferencing a NULL pointer that occurred caused pan_task processes to stop responding.
caused pan_task processes to stop responding.
## PAN-261485 ## PAN-261485
Fixed an issue where the firewall dropped the Real Time Transport Fixed an issue where the firewall dropped the Real Time Transport Protocol (RTP) session for the second SIP call on Persistent-DIPP connections when the source port of the client device was reset.
Protocol (RTP) session for the second SIP call on Persistent-DIPP
connections when the source port of the client device was reset.
## PAN-259733 ## PAN-259733
Fixed an issue where a custom report was not deleted on Panorama when Fixed an issue where a custom report was not deleted on Panorama when expected.
expected.
## PAN-259151 ## PAN-259151
Fixed an issue where unused objects were pushed to the firewall, Fixed an issue where unused objects were pushed to the firewall, which caused configuration pushes to fail with the error Number of address groups exceed platform capacity.
which caused configuration pushes to fail with the error
Number of address groups exceed platform
capacity.
## PAN-257912 ## PAN-257912
Fixed an issue where the firewall stopped responding when it received Fixed an issue where the firewall stopped responding when it received RADIUS traffic and user equipment (UE) traffic at the same time on an NPC.
RADIUS traffic and user equipment (UE) traffic at the same time on
an NPC.
## PAN-257615 ## PAN-257615
Fixed an issue on Panorama where logs did not display or displayed Fixed an issue on Panorama where logs did not display or displayed intermittently on the web interface.
intermittently on the web interface.
## PAN-257601 ## PAN-257601
@@ -69,9 +54,7 @@ intermittently on the web interface.
PA-5450 firewalls only PA-5450 firewalls only
``` ```
Fixed an issue where Networking Fixed an issue where Networking Cards (NC) experienced an internal link fault which caused path monitoring failure on the Dataplane Processing Card (DPC).
Cards (NC) experienced an internal link fault which caused path
monitoring failure on the Dataplane Processing Card (DPC).
## PAN-257327 ## PAN-257327
@@ -79,41 +62,31 @@ monitoring failure on the Dataplane Processing Card (DPC).
PA-5440 firewalls only PA-5440 firewalls only
``` ```
Fixed an issue where a failover Fixed an issue where a failover event occurred unexpectedly on the firewall.
event occurred unexpectedly on the firewall.
## PAN-256725 ## PAN-256725
Fixed an issue on the Panorama interface where Fixed an issue on the Panorama interface where **Traffic** and **Unified** event details loaded more slowly than expected.
Traffic and
Unified event details loaded more slowly
than expected.
## PAN-254794 ## PAN-254794
Fixed an issue where the Panorama management server stopped Fixed an issue where the Panorama management server stopped responding.
responding.
## PAN-253626 ## PAN-253626
Fixed an issue on Panorama where unused objects were pushed to the Fixed an issue on Panorama where unused objects were pushed to the firewall, which caused the push operations to intermittently fail.
firewall, which caused the push operations to intermittently
fail.
## PAN-250394 ## PAN-250394
Fixed an issue where a large amount of group data caused Fixed an issue where a large amount of group data caused serialization errors and prevented synchronization.
serialization errors and prevented synchronization.
## PAN-246708 ## PAN-246708
Fixed an issue where the firewall stopped responding when the Fixed an issue where the firewall stopped responding when the all_pktproc repeatedly restarted.
all_pktproc repeatedly restarted.
## PAN-243098 ## PAN-243098
Fixed an issue with corrupted images when SSL decryption and Security Fixed an issue with corrupted images when SSL decryption and Security profiles were configured.
profiles were configured.
## PAN-222542 ## PAN-222542
@@ -121,7 +94,4 @@ profiles were configured.
PA-7000 Series firewalls only PA-7000 Series firewalls only
``` ```
Fixed an issue where Log Fixed an issue where Log Forward Cards (LFC) were incorrectly identified as distribution policies, which caused packet loss due to traffic, BFD, and other control packets being forwarded to the LFC.
Forward Cards (LFC) were incorrectly identified as distribution
policies, which caused packet loss due to traffic, BFD, and other
control packets being forwarded to the LFC.
web/data/issues/PAN-OS/addressed/11.1.3-h11.md
+1 -2
View File
@@ -6,5 +6,4 @@ version: 11.1.3-h11
## PAN-272809 ## PAN-272809
A fix was made to address CVE-2024-0012 (PAN-SA-2024-0015) and A fix was made to address [CVE-2024-0012](https://security.paloaltonetworks.com/CVE-2024-0012) ([PAN-SA-2024-0015](https://security.paloaltonetworks.com/PAN-SA-2024-0015)) and [CVE-2024-9474](https://security.paloaltonetworks.com/CVE-2024-9474).
CVE-2024-9474.
web/data/issues/PAN-OS/addressed/11.1.3-h13.md
+13 -28
View File
@@ -6,18 +6,15 @@ version: 11.1.3-h13
## PAN-272809 ## PAN-272809
A fix was made to address CVE-2024-0012 (PAN-SA-2024-0015) and A fix was made to address [CVE-2024-0012](https://security.paloaltonetworks.com/CVE-2024-0012) ([PAN-SA-2024-0015](https://security.paloaltonetworks.com/PAN-SA-2024-0015)) and [CVE-2024-9474](https://security.paloaltonetworks.com/CVE-2024-9474).
CVE-2024-9474.
## PAN-269000 ## PAN-269000
Fixed an issue where the firewall stopped responding due to a NULL Fixed an issue where the firewall stopped responding due to a NULL pointer dereference when path monitoring failed.
pointer dereference when path monitoring failed.
## PAN-265785 ## PAN-265785
Fixed an issue where the firewall rebooted due to a sysd Fixed an issue where the firewall rebooted due to a sysd variable being modified before it was created.
variable being modified before it was created.
## PAN-263208 ## PAN-263208
@@ -25,52 +22,40 @@ variable being modified before it was created.
PA-5440 and PA-5445 firewalls only PA-5440 and PA-5445 firewalls only
``` ```
Fixed an issue where Fixed an issue where interrupts were generated at a certain packet rate, and dataplane processes missed heartbeats, which caused the dataplane to go down.
interrupts were generated at a certain packet rate, and dataplane
processes missed heartbeats, which caused the dataplane to go
down.
## PAN-260604 ## PAN-260604
Fixed an issue where the firewall displayed inaccurate throughput Fixed an issue where the firewall displayed inaccurate throughput utilization stats in NetFlow analyzer tools.
utilization stats in NetFlow analyzer tools.
## PAN-259881 ## PAN-259881
Fixed an issue on Panorama where traffic log details were not Fixed an issue on Panorama where traffic log details were not displayed under **detailed log view**.
displayed under detailed log view.
## PAN-259351 ## PAN-259351
A fix was made to address CVE-2024-3393. A fix was made to address [CVE-2024-3393](https://security.paloaltonetworks.com/CVE-2024-3393).
## PAN-258799 ## PAN-258799
Fixed an issue where, when updating a Security Policy Fixed an issue where, when updating a Security Policy **Policy Optimizer**, the web interface stopped responding.
Policy Optimizer, the web interface
stopped responding.
## PAN-256223 ## PAN-256223
Fixed an issue where device telemetry log collection filled the root Fixed an issue where device telemetry log collection filled the root partition.
partition.
## PAN-255915 ## PAN-255915
Fixed an issue where a memory leak in the sslmgr process Fixed an issue where a memory leak in the sslmgr process caused the firewall to restart.
caused the firewall to restart.
## PAN-254826 ## PAN-254826
Fixed an issue where the firewall stopped responding when processing Fixed an issue where the firewall stopped responding when processing traffic.
traffic.
## PAN-254794 ## PAN-254794
Fixed an issue where the Panorama management server stopped Fixed an issue where the Panorama management server stopped responding.
responding.
## PAN-254577 ## PAN-254577
Fixed an issue where a core file was created on the Log Forwarding Fixed an issue where a core file was created on the Log Forwarding Card (LFC) due to a third-party software issue.
Card (LFC) due to a third-party software issue.
web/data/issues/PAN-OS/addressed/11.1.3-h2.md
+6 -14
View File
@@ -6,8 +6,7 @@ version: 11.1.3-h2
## PAN-259733 ## PAN-259733
Fixed an issue where a custom report was not deleted on Panorama when Fixed an issue where a custom report was not deleted on Panorama when expected.
expected.
## PAN-259473 ## PAN-259473
@@ -15,27 +14,20 @@ expected.
PA-5450 firewalls only PA-5450 firewalls only
``` ```
Fixed an issue where the chassis Fixed an issue where the chassis shut down when FAN1 was removed.
shut down when FAN1 was removed.
## PAN-254411 ## PAN-254411
Fixed an issue where the configd process stopped Fixed an issue where the configd process stopped responding, which caused **ERR_CONNECTION_REFUSED** error messages to be displayed in admin sessions.
responding, which caused ERR_CONNECTION_REFUSED error
messages to be displayed in admin sessions.
## PAN-253546 ## PAN-253546
Fixed an issue where a TLS client hello was split into multiple Fixed an issue where a TLS client hello was split into multiple packets and arrived out of order, so the packets were dropped and the session terminated.
packets and arrived out of order, so the packets were dropped and
the session terminated.
## PAN-249814 ## PAN-249814
Fixed an issue where multiple all_task processes stopped Fixed an issue where multiple all_task processes stopped responding, which caused the dataplane to fail.
responding, which caused the dataplane to fail.
## PAN-247099 ## PAN-247099
Fixed an issue where the firewall decrypted traffic unexpectedly when Fixed an issue where the firewall decrypted traffic unexpectedly when the client hello was spread across multiple packets.
the client hello was spread across multiple packets.
web/data/issues/PAN-OS/addressed/11.1.3-h4.md
+8 -25
View File
@@ -6,10 +6,7 @@ version: 11.1.3-h4
## PAN-259480 ## PAN-259480
Fixed an issue where the varrcvr process stopped Fixed an issue where the varrcvr process stopped responding after running out of memory due to how the process queued and dequeued files for WildFire file forwarding when a WildFire Analysis Security profile was enabled.
responding after running out of memory due to how the process queued
and dequeued files for WildFire file forwarding when a WildFire
Analysis Security profile was enabled.
## PAN-257925 ## PAN-257925
@@ -17,20 +14,15 @@ Analysis Security profile was enabled.
CN-Series firewalls only CN-Series firewalls only
``` ```
Fixed an issue where the CLI Fixed an issue where the CLI command show system setting ctd state did not work as expected.
command show system setting ctd state
did not work as expected.
## PAN-257615 ## PAN-257615
Fixed an issue on Panorama where logs did not display or displayed Fixed an issue on Panorama where logs did not display or displayed intermittently on the web interface.
intermittently on the web interface.
## PAN-257462 ## PAN-257462
Fixed an issue related to the varrcvr process where the Fixed an issue related to the varrcvr process where the management plane CPU was higher than expected during WildFire updates.
management plane CPU was higher than expected during WildFire
updates.
## PAN-256385 ## PAN-256385
@@ -38,21 +30,15 @@ updates.
CN-Series firewalls only CN-Series firewalls only
``` ```
Fixed an issue where Fixed an issue where communication was broken between the management plane and the dataplane when anti-spyware profiles were configured in a Security policy rule.
communication was broken between the management plane and the
dataplane when anti-spyware profiles were configured in a Security
policy rule.
## PAN-254373 ## PAN-254373
Fixed an issue where the firewall did not handle error code 500 Fixed an issue where the firewall did not handle error code 500 responses from the WildFire cloud correctly.
responses from the WildFire cloud correctly.
## PAN-251639 ## PAN-251639
Fixed an issue where an out-of-memory condition occurred due to a Fixed an issue where an out-of-memory condition occurred due to a memory leak related to the varrvcr process when a WildFire Analysis security profile was enabled.
memory leak related to the varrvcr process when a
WildFire Analysis security profile was enabled.
## PAN-248148 ## PAN-248148
@@ -60,7 +46,4 @@ Jumbo frame feature support is enabled.
## PAN-225213 ## PAN-225213
Fixed an issue where Push All Changes Fixed an issue where **Push All Changes** displayed changes that were already committed in the push scope for another device group after performing a selective commit and selective push to the first device group.
displayed changes that were already committed in the push scope for
another device group after performing a selective commit and
selective push to the first device group.
web/data/issues/PAN-OS/addressed/11.1.3-h6.md
+8 -21
View File
@@ -6,32 +6,23 @@ version: 11.1.3-h6
## PAN-263226 ## PAN-263226
Fixed an issue where decryption based traffic failed on Explicit Fixed an issue where decryption based traffic failed on Explicit Proxy nodes.
Proxy nodes.
## PAN-262593 ## PAN-262593
Fixed an issue where traffic to websites failed on the Google Chrome Fixed an issue where traffic to websites failed on the Google Chrome web browser on Secure Web Gateway (SWG) nodes.
web browser on Secure Web Gateway (SWG) nodes.
## PAN-261991 ## PAN-261991
Fixed an issue where traffic that did not match a decryption policy Fixed an issue where traffic that did not match a decryption policy rule, or matched a no-decrypt policy rule, failed when accumulation proxy was enabled and a Zone Protection profile was configured with syn-cookies enabled.
rule, or matched a no-decrypt policy rule, failed when accumulation
proxy was enabled and a Zone Protection profile was configured with
syn-cookies enabled.
## PAN-261917 ## PAN-261917
Fixed an issue where websites with a no-decrypt policy rule were Fixed an issue where websites with a no-decrypt policy rule were decrypted in traffic log when using a Google Chrome browser with PQC enabled.
decrypted in traffic log when using a Google Chrome browser with PQC
enabled.
## PAN-259769 ## PAN-259769
Fixed an issue where the GlobalProtect portal was not accessible via Fixed an issue where the GlobalProtect portal was not accessible via a web browser and displayed the error ERR_EMPTY_RESPONSE.
a web browser and displayed the error
ERR_EMPTY_RESPONSE.
## PAN-257957 ## PAN-257957
@@ -39,16 +30,12 @@ ERR_EMPTY_RESPONSE.
Firewalls and Panorama appliances in FIPS-CC mode only Firewalls and Panorama appliances in FIPS-CC mode only
``` ```
Fixed an issue where the authd process restarted if Fixed an issue where the authd process restarted if RADIUS PAP/CHAP authentication was used.
RADIUS PAP/CHAP authentication was used.
## PAN-242331 ## PAN-242331
Fixed an issue where Prisma Access remote network firewalls Fixed an issue where Prisma Access remote network firewalls intermittently created incorrect user-to-IP-address mappings.
intermittently created incorrect user-to-IP-address mappings.
## PAN-232214 ## PAN-232214
Fixed an issue where GlobalProtect clients remained in the connecting Fixed an issue where GlobalProtect clients remained in the connecting state during portal pre-login when Kerberos single sign-on (SSO) was enabled.
state during portal pre-login when Kerberos single sign-on (SSO) was
enabled.
web/data/issues/PAN-OS/addressed/11.1.3.md
+138 -367
View File
@@ -6,43 +6,31 @@ version: 11.1.3
## PAN-251013 ## PAN-251013
Fixed an issue on the web interface where the Virtual Fixed an issue on the web interface where the **Virtual Router** and **Virtual System** configurations for the template incorrectly showed as **none**.
Router and Virtual System
configurations for the template incorrectly showed as
none.
## PAN-250686 ## PAN-250686
Fixed an issue where selective push operations did not work when more Fixed an issue where selective push operations did not work when more than one admin user simultaneously performed changes and partial commits on Panorama.
than one admin user simultaneously performed changes and partial
commits on Panorama.
## PAN-249808 ## PAN-249808
Fixed an issue where the configd process stopped Fixed an issue where the configd process stopped responding when performing multi-device group pushes via XML API.
responding when performing multi-device group pushes via XML
API.
## PAN-249597 ## PAN-249597
Fixed an issue where the Policy page on the Fixed an issue where the **Policy** page on the Panorama web interface was slower than expected when a device group had a large number of managed devices.
Panorama web interface was slower than expected when a device group
had a large number of managed devices.
## PAN-249019 ## PAN-249019
Fixed an issue where the all_pktproc process stopped Fixed an issue where the all_pktproc process stopped responding, which caused the firewall to become unresponsive.
responding, which caused the firewall to become unresponsive.
## PAN-248748 ## PAN-248748
Fixed an issue that caused the dataplane to stop responding when Fixed an issue that caused the dataplane to stop responding when running a packet diagnostic with Jumbo frames enabled.
running a packet diagnostic with Jumbo frames enabled.
## PAN-248105 ## PAN-248105
Fixed an issue where the GlobalProtect SSL VPN tunnel immediately Fixed an issue where the GlobalProtect SSL VPN tunnel immediately disconnected due to a keep-alive timeout.
disconnected due to a keep-alive timeout.
## PAN-247403 ## PAN-247403
@@ -50,14 +38,11 @@ disconnected due to a keep-alive timeout.
Panorama virtual appliances only Panorama virtual appliances only
``` ```
Fixed an issue where the Fixed an issue where the push scope CLI command took longer than expected, which caused the web interface to be slow.
push scope CLI command took longer than expected, which caused the
web interface to be slow.
## PAN-246707 ## PAN-246707
Fixed an issue where failover was not triggered when multiple Fixed an issue where failover was not triggered when multiple processes stopped responding.
processes stopped responding.
## PAN-246420 ## PAN-246420
@@ -65,39 +50,31 @@ processes stopped responding.
PA-5450 Series firewalls only PA-5450 Series firewalls only
``` ```
Fixed an issue where the Fixed an issue where the firewall rebooted unexpectedly during an upgrade.
firewall rebooted unexpectedly during an upgrade.
## PAN-246215 ## PAN-246215
Fixed an issue where the sleep time for a suspended Fixed an issue where the sleep time for a suspended pan_task process caused configuration and policy updates to be blocked.
pan_task process caused configuration and policy
updates to be blocked.
## PAN-245701 ## PAN-245701
Fixed an issue where the returned values to SNMP requests for data Fixed an issue where the returned values to SNMP requests for data port statistics were incorrect.
port statistics were incorrect.
## PAN-245690 ## PAN-245690
Fixed an issue where the Managed Collectors health status on Panorama Fixed an issue where the Managed Collectors health status on Panorama displayed as empty.
displayed as empty.
## PAN-245428 ## PAN-245428
Fixed an issue where FIB entries aged out and were incorrectly Fixed an issue where FIB entries aged out and were incorrectly removed after an HA failover event.
removed after an HA failover event.
## PAN-245387 ## PAN-245387
Fixed an issue where selective push failed intermittently due to Fixed an issue where selective push failed intermittently due to schema validation or bad encryption errors.
schema validation or bad encryption errors.
## PAN-245041 ## PAN-245041
Fixed an issue where the WF-500 appliance returned an error verdict Fixed an issue where the WF-500 appliance returned an error verdict for every sample in FIPS mode.
for every sample in FIPS mode.
## PAN-244907 ## PAN-244907
@@ -105,25 +82,19 @@ for every sample in FIPS mode.
PA-3400, PA-5400, and PA-1400 Series firewalls only PA-3400, PA-5400, and PA-1400 Series firewalls only
``` ```
Fixed Fixed an issue where virtual wire ports did not go down when moving from an active state to a suspended state.
an issue where virtual wire ports did not go down when moving from
an active state to a suspended state.
## PAN-244894 ## PAN-244894
Fixed an issue where turning off mprelay logging caused Fixed an issue where turning off mprelay logging caused mprelay heartbeat failure.
mprelay heartbeat failure.
## PAN-244836 ## PAN-244836
A knob was introduced to toggle the default behavior of BGP in the A knob was introduced to toggle the default behavior of BGP in the Advanced Routing stack to not suppress duplicate updates. By default, the prefix updates are suppressed for optimization.
Advanced Routing stack to not suppress duplicate updates. By
default, the prefix updates are suppressed for optimization.
## PAN-244648 ## PAN-244648
Fixed an issue where, when FIPS was enabled in maintenance mode, the Fixed an issue where, when FIPS was enabled in maintenance mode, the firewall rebooted and returned to maintenance mode.
firewall rebooted and returned to maintenance mode.
## PAN-244625 ## PAN-244625
@@ -131,55 +102,43 @@ firewall rebooted and returned to maintenance mode.
VM-Series firewalls only VM-Series firewalls only
``` ```
Fixed an issue where incorrect Fixed an issue where incorrect virtual MAC addresses were used in interfaces.
virtual MAC addresses were used in interfaces.
## PAN-244622 ## PAN-244622
Fixed an issue where FIB re-push did not work with Advanced Routing Fixed an issue where FIB re-push did not work with Advanced Routing enabled.
enabled.
## PAN-244548 ## PAN-244548
Fixed an issue where ECMP sessions changed destination MAC addresses Fixed an issue where ECMP sessions changed destination MAC addresses mid-session, which caused connections to be reset.
mid-session, which caused connections to be reset.
## PAN-244493 ## PAN-244493
Fixed a memory limitation with mapping subinterfaces to VPCE Fixed a memory limitation with mapping subinterfaces to VPCE endpoints for GCP IPS, Amazon Web Services (AWS) integration with GWLB, and NSX service chain mapping.
endpoints for GCP IPS, Amazon Web Services (AWS) integration with
GWLB, and NSX service chain mapping.
## PAN-244227 ## PAN-244227
Fixed an issue where inconsistent FIB entries across the dataplane Fixed an issue where inconsistent FIB entries across the dataplane were not detected.
were not detected.
## PAN-244013 ## PAN-244013
Fixed an issue where the web interface did not display newly added Fixed an issue where the web interface did not display newly added Anti-Spyware signatures or Vulnerability Signatures.
Anti-Spyware signatures or Vulnerability Signatures.
## PAN-243463 ## PAN-243463
Fixed an issue where high Enhanced Application Log traffic used Fixed an issue where high Enhanced Application Log traffic used excess system resources and caused processes to not work.
excess system resources and caused processes to not work.
## PAN-242027 ## PAN-242027
Fixed an issue where the all-task process repeatedly Fixed an issue where the all-task process repeatedly restarted during memory allocation failures.
restarted during memory allocation failures.
## PAN-241548 ## PAN-241548
Fixed an issue where the firewall stopped responding when switching Fixed an issue where the firewall stopped responding when switching from endpoint authentication bypass to endpoint Kerberos authentication with SWG-proxy traffic.
from endpoint authentication bypass to endpoint Kerberos
authentication with SWG-proxy traffic.
## PAN-241230 ## PAN-241230
Fixed an issue where the SNMP get request status value for Panorama Fixed an issue where the SNMP get request status value for Panorama connections was incorrect.
connections was incorrect.
## PAN-241164 ## PAN-241164
@@ -187,20 +146,15 @@ connections was incorrect.
PA-410 firewalls only PA-410 firewalls only
``` ```
Fixed an issue where system and Fixed an issue where system and configuration logs sent from the firewall to Panorama contained the serial number field instead of the firewall device name.
configuration logs sent from the firewall to Panorama contained the
serial number field instead of the firewall device name.
## PAN-241141 ## PAN-241141
Fixed an issue where creating more than one address object in the Fixed an issue where creating more than one address object in the same XML API request resulted in a commit error.
same XML API request resulted in a commit error.
## PAN-241041 ## PAN-241041
Fixed an issue where, after upgrading to 11.1.0, exporting CSV files Fixed an issue where, after upgrading to 11.1.0, exporting CSV files for template stack variables or template variables resulted in an empty file.
for template stack variables or template variables resulted in an
empty file.
## PAN-241018 ## PAN-241018
@@ -208,26 +162,19 @@ empty file.
VM-Series firewalls in Microsoft Azure environments only VM-Series firewalls in Microsoft Azure environments only
``` ```
Fixed a Dataplane Development Kit (DPDK) issue where interfaces Fixed a Dataplane Development Kit (DPDK) issue where interfaces remained in a link-down stage after an Azure hot plug event.
remained in a link-down stage after an Azure hot plug event.
## PAN-240993 ## PAN-240993
Fixed an issue where you were unable to revert a sort in task manager Fixed an issue where you were unable to revert a sort in task manager in the admin column.
in the admin column.
## PAN-240786 ## PAN-240786
Fixed an issue on firewalls in HA configurations where VXLAN sessions Fixed an issue on firewalls in HA configurations where VXLAN sessions were allocated, but not installed or freed, which resulted in a constant high session table usage that was not synced between the firewalls. This resulted in a session count mismatch.
were allocated, but not installed or freed, which resulted in a
constant high session table usage that was not synced between the
firewalls. This resulted in a session count mismatch.
## PAN-240618 ## PAN-240618
Fixed an issue where configuration commits were successful even when Fixed an issue where configuration commits were successful even when dynamic peer IKE gateways configured on the same interface and IP address that did not have the same IKE crypto profile.
dynamic peer IKE gateways configured on the same interface and IP
address that did not have the same IKE crypto profile.
## PAN-240612 ## PAN-240612
@@ -235,137 +182,99 @@ Fixed a kernel panic caused by a third-party issue
## PAN-240596 ## PAN-240596
Fixed an issue where all_task stopped responding due to Fixed an issue where all_task stopped responding due to an invalid memory address.
an invalid memory address.
## PAN-240477 ## PAN-240477
Fixed a temporary hardware issue that caused PAN-SFP-PLUS-CU-5M to Fixed a temporary hardware issue that caused PAN-SFP-PLUS-CU-5M to not be able to link up on PA-3400 and PA-1400 Series firewalls.
not be able to link up on PA-3400 and PA-1400 Series firewalls.
## PAN-240368 ## PAN-240368
Fixed an issue where authentication portal redirection for HTTPS Fixed an issue where authentication portal redirection for HTTPS websites did not work when **Enhanced Handling of SSL/TLS Handshakes for Decrypted Traffic** was enabled.
websites did not work when Enhanced Handling of SSL/TLS
Handshakes for Decrypted Traffic was enabled.
## PAN-240347 ## PAN-240347
Fixed an issue with the web interface where the Fixed an issue with the web interface where the **Dashboard** and a **Device Group** policy rule took longer than expected to load.
Dashboard and a Device
Group policy rule took longer than expected to
load.
## PAN-240308 ## PAN-240308
Fixed an issue where ElasticSearch did not work as expected when Fixed an issue where ElasticSearch did not work as expected when raid-mounts were not fully ready after a reboot.
raid-mounts were not fully ready after a reboot.
## PAN-240251 ## PAN-240251
Fixed an issue where the vldmgr process incorrectly Fixed an issue where the vldmgr process incorrectly restarted during an Elasticsearch restart.
restarted during an Elasticsearch restart.
## PAN-239776 ## PAN-239776
Fixed an issue where Panorama went into maintenance mode due to a Fixed an issue where Panorama went into maintenance mode due to a GlobalProtect quota configuration that was under the minimum required quota.
GlobalProtect quota configuration that was under the minimum
required quota.
## PAN-239722 ## PAN-239722
Fixed an issue where SNMP scans to the firewall took longer than Fixed an issue where SNMP scans to the firewall took longer than expected and intermittently timed out.
expected and intermittently timed out.
## PAN-239662 ## PAN-239662
Fixed an issue where the NSSA default route from the firewall was not Fixed an issue where the NSSA default route from the firewall was not generated to advertise even though the backbone area default route was advertised during a graceful restart.
generated to advertise even though the backbone area default route
was advertised during a graceful restart.
## PAN-239367 ## PAN-239367
Fixed an issue on the firewall where a memory leak associated with Fixed an issue on the firewall where a memory leak associated with the logrcvr process occurred.
the logrcvr process occurred.
## PAN-239354 ## PAN-239354
Fixed an issue where DNS resolution was delayed when an antispyware Fixed an issue where DNS resolution was delayed when an antispyware policy rule was applied to both client to firewall and firewall to internal DNS server legs of a connection.
policy rule was applied to both client to firewall and firewall to
internal DNS server legs of a connection.
## PAN-239337 ## PAN-239337
Fixed an issue where the log_index was suspended and corrupted BDX Fixed an issue where the log_index was suspended and corrupted BDX files flooded the index_log.
files flooded the index_log.
## PAN-239256 ## PAN-239256
Fixed an issue where ARP entries were unable to be completed for Fixed an issue where ARP entries were unable to be completed for subinterfaces with SNAT configured.
subinterfaces with SNAT configured.
## PAN-239255 ## PAN-239255
Fixed an issue where the firewall did not update the ARP cache Fixed an issue where the firewall did not update the ARP cache timeout value after modifying the arp-cache-timeout setting.
timeout value after modifying the
arp-cache-timeout setting.
## PAN-238996 ## PAN-238996
Fixed an issue where commits did not complete and remained in a Fixed an issue where commits did not complete and remained in a pending state due to a race condition. With this fix, the commit will fail after 60 seconds and not remain in a pending state.
pending state due to a race condition. With this fix, the commit
will fail after 60 seconds and not remain in a pending state.
## PAN-238643 ## PAN-238643
Fixed an issue where a memory leak caused multiple processes to stop Fixed an issue where a memory leak caused multiple processes to stop responding when VM Information Sources was configured.
responding when VM Information Sources was configured.
## PAN-238625 ## PAN-238625
Fixed an issue where, when the physical interface went down, the Fixed an issue where, when the physical interface went down, the SD-WAN Ethernet connection state still showed **UP/path-monitor** due to the Active URL SaaS monitor connection state remaining UP/path-monitor.
SD-WAN Ethernet connection state still showed
UP/path-monitor due to the Active URL
SaaS monitor connection state remaining UP/path-monitor.
## PAN-238621 ## PAN-238621
Fixed an issue where the HA3 link status remained down when updating Fixed an issue where the HA3 link status remained down when updating the HA3 interface configuration when the AE interface was up.
the HA3 interface configuration when the AE interface was up.
## PAN-238562 ## PAN-238562
Fixed an issue where log collectors stopped responding when gathering Fixed an issue where log collectors stopped responding when gathering reports from Panorama.
reports from Panorama.
## PAN-238508 ## PAN-238508
Fixed an issue where the routed process created Fixed an issue where the routed process created excessive logs in the log file.
excessive logs in the log file.
## PAN-237678 ## PAN-237678
Fixed an issue with firewalls in active/passive HA configurations Fixed an issue with firewalls in active/passive HA configurations where the passive firewall displayed the error message Unable to read QSFP Module ID when the passive link state was set to shutdown.
where the passive firewall displayed the error message
Unable to read QSFP Module ID when
the passive link state was set to shutdown.
## PAN-237537 ## PAN-237537
Fixed an issue where, when deleting CTD entries, the Fixed an issue where, when deleting CTD entries, the all_pktproc process stopped responding which resulted in dataplane failure.
all_pktproc process stopped responding which
resulted in dataplane failure.
## PAN-237478 ## PAN-237478
Fixed an issue where the traffic log displayed 0 bytes for denied Fixed an issue where the traffic log displayed 0 bytes for denied sessions.
sessions.
## PAN-237454 ## PAN-237454
Fixed an issue where Panorama stopped redistributing IP Fixed an issue where Panorama stopped redistributing IP address-to-username mappings when packet loss occurred between the distributor and the client.
address-to-username mappings when packet loss occurred between the
distributor and the client.
## PAN-237369 ## PAN-237369
@@ -373,64 +282,47 @@ distributor and the client.
PA-1420 firewalls only PA-1420 firewalls only
``` ```
Fixed an issue where the Fixed an issue where the all_task process stopped responding, which caused the firewall to become unresponsive.
all_task process stopped responding, which caused
the firewall to become unresponsive.
## PAN-237246 ## PAN-237246
Fixed an issue where the all_pktproc process repeatedly Fixed an issue where the all_pktproc process repeatedly restarted, which caused the firewall to go into a nonfunctional state.
restarted, which caused the firewall to go into a nonfunctional
state.
## PAN-236802 ## PAN-236802
Fixed an issue on firewalls in HA configurations where unexpected Fixed an issue on firewalls in HA configurations where unexpected failovers occurred.
failovers occurred.
## PAN-236261 ## PAN-236261
Fixed an issue where a proxy server was used for External Dynamic Fixed an issue where a proxy server was used for External Dynamic List communication even when the dataplane interface was configured through service routes.
List communication even when the dataplane interface was configured
through service routes.
## PAN-236244 ## PAN-236244
Fixed an issue where you were unable to select Authentication Fixed an issue where you were unable to select Authentication Profiles via the web interface.
Profiles via the web interface.
## PAN-236233 ## PAN-236233
Fixed an issue where SNMP reports displayed incorrect values for SSL Fixed an issue where SNMP reports displayed incorrect values for SSL Proxy sessions and SSL Proxy utilization.
Proxy sessions and SSL Proxy utilization.
## PAN-235737 ## PAN-235737
Fixed an issue where the brdagent process stopped Fixed an issue where the brdagent process stopped responding due to a sudden increase in logging to the bcm.log.
responding due to a sudden increase in logging to the bcm.log.
## PAN-235628 ## PAN-235628
Fixed an issue where you were not prompted for login credentials when Fixed an issue where you were not prompted for login credentials when you disconnected and connected back to the GlobalProtect portal when SAML authentication was selected along with Single Sign-On (SSO) and Single Log Out (SLO).
you disconnected and connected back to the GlobalProtect portal when
SAML authentication was selected along with Single Sign-On (SSO) and
Single Log Out (SLO).
## PAN-235557 ## PAN-235557
Fixed an issue where uploads from tunnels, including GlobalProtect, Fixed an issue where uploads from tunnels, including GlobalProtect, were slower than expected when the inner and outer sessions were on different dataplanes.
were slower than expected when the inner and outer sessions were on
different dataplanes.
## PAN-235476 ## PAN-235476
Fixed an issue where threat logs from different Security zones were Fixed an issue where threat logs from different Security zones were aggregated into one log.
aggregated into one log.
## PAN-235168 ## PAN-235168
Fixed an issue where disk space became full even after clearing old Fixed an issue where disk space became full even after clearing old logs and content images.
logs and content images.
## PAN-235081 ## PAN-235081
@@ -438,60 +330,43 @@ logs and content images.
VM-Series firewalls only VM-Series firewalls only
``` ```
Fixed an issue where the firewall Fixed an issue where the firewall sent packets to its own interface after configuring NAT64.
sent packets to its own interface after configuring NAT64.
## PAN-234596 ## PAN-234596
Fixed an issue on firewalls in active/passive HA configurations where Fixed an issue on firewalls in active/passive HA configurations where the passive firewall incorrectly became active after a reboot.
the passive firewall incorrectly became active after a reboot.
## PAN-234459 ## PAN-234459
Fixed an issue with the firewall web interface where local SSL Fixed an issue with the firewall web interface where local SSL decryption exclusion cache entries were not visible.
decryption exclusion cache entries were not visible.
## PAN-234290 ## PAN-234290
Fixed an issue where the firewall displayed incorrect interface Fixed an issue where the firewall displayed incorrect interface transfer rates when running the CLI command show system state filter-pretty sys.s1.px with a filter.
transfer rates when running the CLI command show
system state filter-pretty sys.s1.px with a
filter.
## PAN-234169 ## PAN-234169
Fixed an issue where downloading files failed or was slower than Fixed an issue where downloading files failed or was slower than expected due to malware scanning even when the session was matched to a Security policy rule with no Anti-Virus profile attached.
expected due to malware scanning even when the session was matched
to a Security policy rule with no Anti-Virus profile attached.
## PAN-234031 ## PAN-234031
Fixed an issue on multi-core firewalls where the firewall displayed Fixed an issue on multi-core firewalls where the firewall displayed packets out of order when capturing packets on the transmit stage.
packets out of order when capturing packets on the transmit
stage.
## PAN-233833 ## PAN-233833
Fixed an issue where enabling Jumbo frames resulted in software Fixed an issue where enabling Jumbo frames resulted in software packet buffer depletion.
packet buffer depletion.
## PAN-233789 ## PAN-233789
Fixed an issue with Push and Commit Fixed an issue with **Push** and **Commit and Push** operations where the user was not correctly bound to the scope, which caused all device groups to be selected for a selective push.
and Push operations where the user was not correctly
bound to the scope, which caused all device groups to be selected
for a selective push.
## PAN-233692 ## PAN-233692
Fixed an issue on Panorama where the configd process Fixed an issue on Panorama where the configd process stopped, which caused performance issues.
stopped, which caused performance issues.
## PAN-233684 ## PAN-233684
Fixed an issue on Panorama where Push to Fixed an issue on Panorama where **Push to Devices** or **Commit and Push** operations took longer than expected on the web interface.
Devices or Commit and Push
operations took longer than expected on the web interface.
## PAN-233603 ## PAN-233603
@@ -499,65 +374,47 @@ operations took longer than expected on the web interface.
CN-Series firewalls only CN-Series firewalls only
``` ```
Fixed an issue where slot Fixed an issue where slot information was not correct after a slotd process restart on the management pod.
information was not correct after a slotd process
restart on the management pod.
## PAN-233541 ## PAN-233541
Fixed an issue where device group and template administrators with Fixed an issue where device group and template administrators with access to a specific virtual system were able to see logs for all virtual systems via Context Switch.
access to a specific virtual system were able to see logs for all
virtual systems via Context Switch.
## PAN-233517 ## PAN-233517
Fixed an issue on Panorama where managed device templates and device Fixed an issue on Panorama where managed device templates and device groups took longer than expected to display in the **Push to Devices** window.
groups took longer than expected to display in the Push
to Devices window.
## PAN-233463 ## PAN-233463
Fixed an issue where the X-Forwarded-For (XFF) IP addressed value was Fixed an issue where the X-Forwarded-For (XFF) IP addressed value was not displayed in traffic logs.
not displayed in traffic logs.
## PAN-233207 ## PAN-233207
Fixed an issue where the configd process stopped Fixed an issue where the configd process stopped responding when a partial configuration revert operation was performed.
responding when a partial configuration revert operation was
performed.
## PAN-233039 ## PAN-233039
Fixed an issue where GENEVE encapsulated packets coming from a GFE Fixed an issue where GENEVE encapsulated packets coming from a GFE Proxy mapped to an incorrect Security policy rule.
Proxy mapped to an incorrect Security policy rule.
## PAN-232953 ## PAN-232953
Fixed an issue where you were able to cancel the same commit Fixed an issue where you were able to cancel the same commit repeatedly, which displayed the error message Cannot stop job <job> at this time.
repeatedly, which displayed the error message Cannot
stop job <job> at this time.
## PAN-232368 ## PAN-232368
Fixed an issue where commits failed with the error message Fixed an issue where commits failed with the error message Error: Max. user groups used in policy 1389 exceed capacity (1000).
Error: Max. user groups used in policy 1389 exceed
capacity (1000).
## PAN-232250 ## PAN-232250
Fixed an issue where, when SSH service profiles for management access Fixed an issue where, when SSH service profiles for management access were set to **None**, the reported output was incorrect.
were set to None, the reported output was
incorrect.
## PAN-231802 ## PAN-231802
Fixed an issue where an Advanced Routing BGP session flapped with Fixed an issue where an Advanced Routing BGP session flapped with commits when BGP peer authentication was enabled.
commits when BGP peer authentication was enabled.
## PAN-231552 ## PAN-231552
Fixed an issue where traffic returning from a third-party Security Fixed an issue where traffic returning from a third-party Security chain was dropped.
chain was dropped.
## PAN-231507 ## PAN-231507
@@ -565,22 +422,15 @@ chain was dropped.
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
Fixed an issue where, when Fixed an issue where, when an HSCI interface was used as an HA2 interface, HA2 packets were intermittently dropped on the passive firewall, which caused the HA2 connection to flap due to missing HA2 keepalive messages.
an HSCI interface was used as an HA2 interface, HA2 packets were
intermittently dropped on the passive firewall, which caused the HA2
connection to flap due to missing HA2 keepalive messages.
## PAN-231480 ## PAN-231480
Fixed an issue where the firewall CLI output for GlobalProtect log Fixed an issue where the firewall CLI output for GlobalProtect log quota settings did not match the settings configured on the Panorama web interface.
quota settings did not match the settings configured on the Panorama
web interface.
## PAN-231439 ## PAN-231439
Fixed an issue where, when a VoIP call using dynamic IP and NAT was Fixed an issue where, when a VoIP call using dynamic IP and NAT was put on hold, the audio became one-way due to early termination of NAT ports.
put on hold, the audio became one-way due to early termination of
NAT ports.
## PAN-231395 ## PAN-231395
@@ -588,22 +438,15 @@ Fixed an intermittent issue where the OCSP query failed.
## PAN-231148 ## PAN-231148
Fixed an issue where no DHCP option list was defined when using Fixed an issue where no DHCP option list was defined when using GlobalProtect.
GlobalProtect.
## PAN-230813 ## PAN-230813
Fixed an issue where flex memory leak caused decryption failure and Fixed an issue where flex memory leak caused decryption failure and commit failure with the error message Error preparing global objects failed to handle CONFIG_UPDATE_START.
commit failure with the error message Error preparing
global objects failed to handle
CONFIG_UPDATE_START.
## PAN-230746 ## PAN-230746
Fixed an issue on the web interface where device groups with a large Fixed an issue on the web interface where device groups with a large number of managed firewalls displayed the **Policy** page more slowly than expected.
number of managed firewalls displayed the
Policy page more slowly than
expected.
## PAN-230656 ## PAN-230656
@@ -611,27 +454,19 @@ expected.
Firewalls in HA configurations only Firewalls in HA configurations only
``` ```
Fixed an issue where a Fixed an issue where a split brain condition occurred on both firewalls after booting up any firewall, and an HA switchover occurred after booting up a firewall with a higher HA priority even when no preemptive option was enabled on the firewall.
split brain condition occurred on both firewalls after booting up
any firewall, and an HA switchover occurred after booting up a
firewall with a higher HA priority even when no preemptive option
was enabled on the firewall.
## PAN-230377 ## PAN-230377
Fixed an issue where FEC support was not enabled by default for Fixed an issue where FEC support was not enabled by default for PAN-25G-SFP28-LR modules.
PAN-25G-SFP28-LR modules.
## PAN-230372 ## PAN-230372
Fixed an issue where OCSP queries did not work after upgrading to a Fixed an issue where OCSP queries did not work after upgrading to a PAN-OS 11.0 release.
PAN-OS 11.0 release.
## PAN-230039 ## PAN-230039
Fixed an issue where migrating from an Enterprise License Agreement Fixed an issue where migrating from an Enterprise License Agreement (ELA) to a Flexible VM-Series License failed with a deactivation error message.
(ELA) to a Flexible VM-Series License failed with a deactivation
error message.
## PAN-229985 ## PAN-229985
@@ -639,15 +474,11 @@ error message.
VM-Series firewalls in Amazon Web Services (AWS) only VM-Series firewalls in Amazon Web Services (AWS) only
``` ```
Fixed an issue where, when Gateway Load Balancer (GWLB) overlay Fixed an issue where, when Gateway Load Balancer (GWLB) overlay routing was enabled, GWLB packets re-encapsulated with the incorrect flow cookie in the GENEVE header when transmitting the response back to GWLB.
routing was enabled, GWLB packets re-encapsulated with the incorrect
flow cookie in the GENEVE header when transmitting the response back
to GWLB.
## PAN-229874 ## PAN-229874
Fixed an issue where the firewall was unable to form OSPFv3 adjacency Fixed an issue where the firewall was unable to form OSPFv3 adjacency when using an ESP authentication profile.
when using an ESP authentication profile.
## PAN-229873 ## PAN-229873
@@ -655,19 +486,15 @@ when using an ESP authentication profile.
PA-7050 firewalls only PA-7050 firewalls only
``` ```
Fixed an issue related to Fixed an issue related to brdagent process errors.
brdagent process errors.
## PAN-229315 ## PAN-229315
Fixed an issue where Octets in NetFlow records were always reported Fixed an issue where Octets in NetFlow records were always reported to be 0 despite having a non-zero packet count.
to be 0 despite having a non-zero packet count.
## PAN-229069 ## PAN-229069
Fixed an issue where clientless VPN portal users were unable to Fixed an issue where clientless VPN portal users were unable to access clientless applications due to an SSL renegotiation being triggered.
access clientless applications due to an SSL renegotiation being
triggered.
## PAN-228457 ## PAN-228457
@@ -675,83 +502,55 @@ triggered.
PA-7000 firewalls only PA-7000 firewalls only
``` ```
Fixed an issue where the GTP logs Fixed an issue where the GTP logs forwarded from the firewall to the log collector did not include the pcap.
forwarded from the firewall to the log collector did not include the
pcap.
## PAN-228442 ## PAN-228442
Fixed an issue on firewalls in active/passive HA configurations where Fixed an issue on firewalls in active/passive HA configurations where sessions did not fail over from the active firewall to the passive firewall when upgrading PAN-OS.
sessions did not fail over from the active firewall to the passive
firewall when upgrading PAN-OS.
## PAN-228323 ## PAN-228323
Fixed an issue where a large number of Panorama management server Fixed an issue where a large number of Panorama management server cookies were created in the Redis database when the Cloud-Service plugin sent an authentication request every second, and logging in to or using Panorama was slower than expected.
cookies were created in the Redis database when the Cloud-Service
plugin sent an authentication request every second, and logging in
to or using Panorama was slower than expected.
## PAN-227973 ## PAN-227973
Fixed an issue where commits failed after renaming an address object Fixed an issue where commits failed after renaming an address object or object group with a selective commit.
or object group with a selective commit.
## PAN-227939 ## PAN-227939
Fixed an issue where the all_task process stopped Fixed an issue where the all_task process stopped responding due to high wifclient memory usage, which caused the firewall to reboot.
responding due to high wifclient memory usage, which caused the
firewall to reboot.
## PAN-227887 ## PAN-227887
Fixed an issue where IP address checksums were calculated Fixed an issue where IP address checksums were calculated incorrectly.
incorrectly.
## PAN-227510 ## PAN-227510
Fixed an issue where the error message Failed to Fixed an issue where the error message Failed to establish GRPC connection to UrlCat service: failed to start grpc connection was displayed in the system log when the Advanced URL Filtering license was applied but not configured.
establish GRPC connection to UrlCat service: failed to start
grpc connection was displayed in the system log
when the Advanced URL Filtering license was applied but not
configured.
## PAN-227064 ## PAN-227064
Fixed an issue with high availability (HA) sync failure when Fixed an issue with high availability (HA) sync failure when performing a partial commit after creating a Security policy via REST API.
performing a partial commit after creating a Security policy via
REST API.
## PAN-226489 ## PAN-226489
Fixed an issue where Panorama was unable to push scheduled dynamic Fixed an issue where Panorama was unable to push scheduled dynamic updates to firewalls with the error message Failed to add deploy job. Too many (30) deploy jobs pending for device.
updates to firewalls with the error message Failed to
add deploy job. Too many (30) deploy jobs pending for
device.
## PAN-225090 ## PAN-225090
Fixed an issue on Panorama where Commit and Fixed an issue on Panorama where **Commit and Push** was grayed out when making changes to a template or device group.
Push was grayed out when making changes to a
template or device group.
## PAN-225064 ## PAN-225064
Fixed an issue where Panorama stopped responding and entered a Fixed an issue where Panorama stopped responding and entered a non-functional state after moving multiple Security policy rules at the same time from one device group to another device group.
non-functional state after moving multiple Security policy rules at
the same time from one device group to another device group.
## PAN-224938 ## PAN-224938
Fixed an issue where the CLI command settings for set Fixed an issue where the CLI command settings for set system setting logging max-log-rate did not persist after a mgmtsrvr process restart.
system setting logging max-log-rate did not
persist after a mgmtsrvr process restart.
## PAN-224584 ## PAN-224584
Fixed an issue on Panorama where generating UAR reports for 30 days Fixed an issue on Panorama where generating UAR reports for 30 days or more was slower than expected, and reports showed the same logs repeatedly in a loop.
or more was slower than expected, and reports showed the same logs
repeatedly in a loop.
## PAN-224424 ## PAN-224424
@@ -759,9 +558,7 @@ repeatedly in a loop.
PA-3440 firewalls only PA-3440 firewalls only
``` ```
Fixed an issue where you were Fixed an issue where you were unable to set the link speed as 25Gbps from the drop-down in the template for Ethernet ports 1/23 through 1/26.
unable to set the link speed as 25Gbps from the drop-down in the
template for Ethernet ports 1/23 through 1/26.
## PAN-224060 ## PAN-224060
@@ -769,30 +566,23 @@ template for Ethernet ports 1/23 through 1/26.
PA-220 Series firewalls only PA-220 Series firewalls only
``` ```
Fixed an issue where multiple Fixed an issue where multiple dataplane processes stopped responding after an upgrade.
dataplane processes stopped responding after an upgrade.
## PAN-223365 ## PAN-223365
Fixed an issue where Panorama was unable to query any logs if the Fixed an issue where Panorama was unable to query any logs if the Elasticsearch health status for any log collector was degraded.
Elasticsearch health status for any log collector was degraded.
## PAN-223172 ## PAN-223172
Fixed an issue on Panorama where host IDs manually added to the Fixed an issue on Panorama where host IDs manually added to the device quarantine list were unexpectedly removed.
device quarantine list were unexpectedly removed.
## PAN-222188 ## PAN-222188
A CLI command was introduced to address an issue where SNMP A CLI command was introduced to address an issue where SNMP monitoring performance was slower than expected, which resulted in snmpwalk timeouts.
monitoring performance was slower than expected, which resulted in
snmpwalk timeouts.
## PAN-222002 ## PAN-222002
Fixed an issue where content updates failed with the error message Fixed an issue where content updates failed with the error message Unable to get key pancontent-8.0.pass from cryptod. Error -9.
Unable to get key pancontent-8.0.pass from
cryptod. Error -9.
## PAN-220931 ## PAN-220931
@@ -800,54 +590,39 @@ cryptod. Error -9.
Panorama appliances in FIPS-CC mode only Panorama appliances in FIPS-CC mode only
``` ```
Fixed an issue Fixed an issue where scheduled email reports did not contain PDF attachments.
where scheduled email reports did not contain PDF attachments.
## PAN-219805 ## PAN-219805
Fixed an issue where the reportd process stopped Fixed an issue where the reportd process stopped responding due to a race condition.
responding due to a race condition.
## PAN-219113 ## PAN-219113
Fixed an issue where, when a port on the NPC was configured for log Fixed an issue where, when a port on the NPC was configured for log forwarding, the ingress traffic on the card was sent for processing to the LPC, and the LPC card was reloaded when the ingress volume of traffic was high.
forwarding, the ingress traffic on the card was sent for processing
to the LPC, and the LPC card was reloaded when the ingress volume of
traffic was high.
## PAN-217619 ## PAN-217619
Fixed an issue where supported Bi-DI transceivers were not recognized Fixed an issue where supported Bi-DI transceivers were not recognized which caused ports to not come up.
which caused ports to not come up.
## PAN-217307 ## PAN-217307
Fixed an issue where the log-start and Fixed an issue where the log-start and log-end policy rule filters did not return reliable results when set to no or yes.
log-end policy rule filters did not
return reliable results when set to no
or yes.
## PAN-217241 ## PAN-217241
Fixed an issue where predict session conversion failed for RTP and Fixed an issue where predict session conversion failed for RTP and RTCP traffic.
RTCP traffic.
## PAN-209574 ## PAN-209574
Fixed an issue with HTTP/2 traffic where downloading large files did Fixed an issue with HTTP/2 traffic where downloading large files did not work when decryption was enabled.
not work when decryption was enabled.
## PAN-205482 ## PAN-205482
Fixed an issue related to the configd process where Fixed an issue related to the configd process where Panorama displayed the error **Server not responding** when editing policies.
Panorama displayed the error Server not
responding when editing policies.
## PAN-199141 ## PAN-199141
Fixed an issue where renaming a device group and then performing a Fixed an issue where renaming a device group and then performing a partial commit led to the device group hierarchy being incorrectly changed.
partial commit led to the device group hierarchy being incorrectly
changed.
## PAN-196395 ## PAN-196395
@@ -855,12 +630,8 @@ changed.
PA-5450 firewalls only PA-5450 firewalls only
``` ```
Fixed an issue where the firewall Fixed an issue where the firewall accepted 12 aggregate ethernet interfaces, but you were unable to configure interfaces 9-12 via the web interface.
accepted 12 aggregate ethernet interfaces, but you were unable to
configure interfaces 9-12 via the web interface.
## PAN-174454 ## PAN-174454
Fixed an issue where the firewall did not fetch group and user Fixed an issue where the firewall did not fetch group and user membership due to the Okta sync domain not matching the active Cloud Identity Engine domain.
membership due to the Okta sync domain not matching the active Cloud
Identity Engine domain.
web/data/issues/PAN-OS/addressed/11.1.4-h1.md
+9 -30
View File
@@ -6,31 +6,23 @@ version: 11.1.4-h1
## PAN-245690 ## PAN-245690
Fixed an issue where the Managed Collectors Fixed an issue where the **Managed Collectors** health status on Panorama displayed as empty.
health status on Panorama displayed as empty.
## PAN-259733 ## PAN-259733
Fixed an issue where a custom report was not deleted on Panorama when Fixed an issue where a custom report was not deleted on Panorama when expected.
expected.
## PAN-259480 ## PAN-259480
Fixed an issue where the varrcvr process stopped Fixed an issue where the varrcvr process stopped responding after running out of memory due to how the process queued and dequeued files for WildFire file forwarding when a WildFire Analysis Security profile was enabled.
responding after running out of memory due to how the process queued
and dequeued files for WildFire file forwarding when a WildFire
Analysis Security profile was enabled.
## PAN-257615 ## PAN-257615
Fixed an issue on Panorama where logs did not display or displayed Fixed an issue on Panorama where logs did not display or displayed intermittently on the web interface.
intermittently on the web interface.
## PAN-257462 ## PAN-257462
Fixed an issue related to the varrcvr process where the Fixed an issue related to the varrcvr process where the management plane CPU was higher than expected during WildFire updates.
management plane CPU was higher than expected during WildFire
updates.
## PAN-257028 ## PAN-257028
@@ -38,29 +30,16 @@ updates.
Firewalls in active/passive HA configurations only Firewalls in active/passive HA configurations only
``` ```
Fixed Fixed an issue where firewalls entered a non-functional state and displayed the error message Dataplane down: path monitor failure during the fail-over.
an issue where firewalls entered a non-functional state and
displayed the error message Dataplane down: path
monitor failure during the fail-over.
## PAN-255711 ## PAN-255711
Fixed an issue where the firewall displayed a malformed request error Fixed an issue where the firewall displayed a malformed request error when selecting a custom format and clicking **OK** on the configuration window due to the log type **Correlation** incorrectly being displayed (**Device > Log Setting - Correlation > Syslog Server Profile > Custom Log Format > Correlation**).
when selecting a custom format and clicking
OK on the configuration window due to the
log type Correlation incorrectly being
displayed (Device > Log Setting - Correlation > Syslog
Server Profile > Custom Log Format >
Correlation).
## PAN-254373 ## PAN-254373
Fixed an issue where the firewall did not handle error code 500 Fixed an issue where the firewall did not handle error code 500 responses from the WildFire cloud correctly.
responses from the WildFire cloud correctly.
## PAN-225213 ## PAN-225213
Fixed an issue where Push All Changes Fixed an issue where **Push All Changes** displayed changes that were already committed in the push scope for another device group after performing a selective commit and selective push to the first device group.
displayed changes that were already committed in the push scope for
another device group after performing a selective commit and
selective push to the first device group.
web/data/issues/PAN-OS/addressed/11.1.4-h13.md
+68 -177
View File
@@ -6,19 +6,15 @@ version: 11.1.4-h13
## PAN-279604 ## PAN-279604
Fixed an issue where scheduled SaaS application usage reports were Fixed an issue where scheduled SaaS application usage reports were generated incorrectly, and the login page was displayed instead of the report content.
generated incorrectly, and the login page was displayed instead of
the report content.
## PAN-278088 ## PAN-278088
Fixed an issue where the show system resources Fixed an issue where the show system resources follow CLI command was not available.
follow CLI command was not available.
## PAN-274791 ## PAN-274791
Fixed an issue where the firewall rebooted when Shared Pool Type 32 Fixed an issue where the firewall rebooted when Shared Pool Type 32 was depleted and traffic matched advanced features.
was depleted and traffic matched advanced features.
## PAN-274592 ## PAN-274592
@@ -26,38 +22,31 @@ was depleted and traffic matched advanced features.
Firewalls in HA configurations only Firewalls in HA configurations only
``` ```
Fixed an issue where Fixed an issue where the firewall did not fail over when the active firewall experienced data plane issues.
the firewall did not fail over when the active firewall experienced
data plane issues.
## PAN-273994 ## PAN-273994
A fix was made to address CVE-2025-0111. A fix was made to address [CVE-2025-0111](https://security.paloaltonetworks.com/CVE-2025-0111).
## PAN-273971 ## PAN-273971
A fix was made to address CVE-2025-0108. A fix was made to address [CVE-2025-0108](https://security.paloaltonetworks.com/CVE-2025-0108).
## PAN-273278 ## PAN-273278
A fix was made to address CVE-2025-0109. A fix was made to address [CVE-2025-0109](https://security.paloaltonetworks.com/CVE-2025-0109).
## PAN-273129 ## PAN-273129
Fixed an issue on the web interface where the Fixed an issue on the web interface where the **negate** option was visible when you clicked on the rule name, but not when you viewed the target options from the **rulebase** attribute.
negate option was visible when you
clicked on the rule name, but not when you viewed the target options
from the rulebase attribute.
## PAN-273085 ## PAN-273085
Fixed an issue on the web interface where you were unable to edit or Fixed an issue on the web interface where you were unable to edit or create policy rules.
create policy rules.
## PAN-273026 ## PAN-273026
Fixed an issue where traffic logs did not display correctly when Fixed an issue where traffic logs did not display correctly when filters were applied.
filters were applied.
## PAN-273019 ## PAN-273019
@@ -65,15 +54,11 @@ Fixed an intermittent issue where SSL decryption failed.
## PAN-272959 ## PAN-272959
Fixed an issue where the firewall generated BGP update packets larger Fixed an issue where the firewall generated BGP update packets larger than 1500 bytes when the interface MTU was 1500 bytes and jumbo frames were enabled globally.
than 1500 bytes when the interface MTU was 1500 bytes and jumbo
frames were enabled globally.
## PAN-272006 ## PAN-272006
Fixed an issue where the firewall did not trigger a kernel core dump Fixed an issue where the firewall did not trigger a kernel core dump as a large core when the CPLD (Complex Programmable Logic Device) sent a Non-Maskable Interrupt (NMI) to the CPU.
as a large core when the CPLD (Complex Programmable Logic Device)
sent a Non-Maskable Interrupt (NMI) to the CPU.
## PAN-271937 ## PAN-271937
@@ -81,20 +66,15 @@ sent a Non-Maskable Interrupt (NMI) to the CPU.
PA-5450 firewalls only PA-5450 firewalls only
``` ```
Fixed an issue where the Fixed an issue where the logrcvr process stopped responding when processing logs from a large number of sources.
logrcvr process stopped responding when processing
logs from a large number of sources.
## PAN-271926 ## PAN-271926
Fixed an issue where TLS 1.3 decryption failed with a bad record MAC Fixed an issue where TLS 1.3 decryption failed with a bad record MAC error when the firewall was configured to decrypt and inspect TLS traffic.
error when the firewall was configured to decrypt and inspect TLS
traffic.
## PAN-270549 ## PAN-270549
Fixed an issue where some TLS connections were not handled correctly, Fixed an issue where some TLS connections were not handled correctly, which led to instability in the dataplane.
which led to instability in the dataplane.
## PAN-270471 ## PAN-270471
@@ -102,11 +82,7 @@ which led to instability in the dataplane.
Firewalls in active/active configurations only Firewalls in active/active configurations only
``` ```
Fixed an Fixed an issue where the firewall did not detect configuration changes when only the interface of an IKE gateway was changed, which caused IPSec tunnels to not come up after migrating the IKE gateway IP address from a subinterface to a physical interface.
issue where the firewall did not detect configuration changes when
only the interface of an IKE gateway was changed, which caused IPSec
tunnels to not come up after migrating the IKE gateway IP address
from a subinterface to a physical interface.
## PAN-270077 ## PAN-270077
@@ -114,52 +90,39 @@ from a subinterface to a physical interface.
VM-Series firewalls in Amazon Web Services (AWS) environments only VM-Series firewalls in Amazon Web Services (AWS) environments only
``` ```
Fixed an issue template values were missing in newly Fixed an issue template values were missing in newly spun firewalls in auto scale deployments without an explicit push with forced template values from Panorama.
spun firewalls in auto scale deployments without an explicit push
with forced template values from Panorama.
## PAN-269731 ## PAN-269731
Fixed an issue where Panorama did not display logs from firewalls Fixed an issue where Panorama did not display logs from firewalls after upgrading to PAN-OS 10.2.11 on devices due to Elasticsearch (ES) getting restarted continuously.
after upgrading to PAN-OS 10.2.11 on devices due to Elasticsearch
(ES) getting restarted continuously.
## PAN-269539 ## PAN-269539
Fixed an issue where whitespace was added before the timestamp in Fixed an issue where whitespace was added before the timestamp in syslog logs forwarded from Panorama.
syslog logs forwarded from Panorama.
## PAN-269499 ## PAN-269499
Fixed an issue where the firewall stopped responding when receiving a Fixed an issue where the firewall stopped responding when receiving a high number of logs.
high number of logs.
## PAN-269106 ## PAN-269106
Fixed issue where the wifclient Fixed issue where the wifclient restarted and multiple processes stopped responding.
restarted and multiple processes stopped responding.
## PAN-268909 ## PAN-268909
Fixed an issue where IP address tags were removed from firewalls Fixed an issue where IP address tags were removed from firewalls after a management server or useridd process restart. This occurred when a Panorama serial-number based configuration was used for User-ID redistribution.
after a management server or useridd process restart.
This occurred when a Panorama serial-number based configuration was
used for User-ID redistribution.
## PAN-268815 ## PAN-268815
Fixed an issue where the firewall entered a non-functional state due Fixed an issue where the firewall entered a non-functional state due to duplicate entries in the shared memory.
to duplicate entries in the shared memory.
## PAN-268727 ## PAN-268727
Fixed an issue where traffic was dropped when the accumulation proxy Fixed an issue where traffic was dropped when the accumulation proxy was enabled and header insertion modified packets.
was enabled and header insertion modified packets.
## PAN-267781 ## PAN-267781
Fixed an issue where Panorama did not display the Source Dynamic Fixed an issue where Panorama did not display the Source Dynamic Address Group.
Address Group.
## PAN-267762 ## PAN-267762
@@ -167,117 +130,83 @@ Address Group.
Panorama virtual appliances in Management-Only mode Panorama virtual appliances in Management-Only mode
``` ```
Fixed Fixed a issue where the maximum configuration size was lower than expected.
a issue where the maximum configuration size was lower than
expected.
## PAN-267671 ## PAN-267671
Fixed an issue where the firewall rebooted unexpectedly Fixed an issue where the firewall rebooted unexpectedly due to the all_task process restarting with an OOM condition due to a memory leak on the reportd process.
due to the all_task process restarting with an OOM
condition due to a memory leak on the reportd
process.
## PAN-267430 ## PAN-267430
Fixed an issue where Panorama was unable to return logs for queries Fixed an issue where Panorama was unable to return logs for queries that were longer than 64,000 characters.
that were longer than 64,000 characters.
## PAN-267097 ## PAN-267097
Fixed an issue where the replay database size increased significantly Fixed an issue where the replay database size increased significantly due to local and special configurations not being purged after commits.
due to local and special configurations not being purged after
commits.
## PAN-266581 ## PAN-266581
Fixed an issue where a failed SSL connection to a syslog server Fixed an issue where a failed SSL connection to a syslog server resulted in a /tmp/srvr.crt.xxxxxx file not being removed, which caused index node (inode) exhaustion.
resulted in a /tmp/srvr.crt.xxxxxx file
not being removed, which caused index node (inode) exhaustion.
## PAN-266559 ## PAN-266559
Fixed an issue where partial commits failed when objects that were Fixed an issue where partial commits failed when objects that were referenced in a high number of Security policy rules were renamed.
referenced in a high number of Security policy rules were
renamed.
## PAN-266354 ## PAN-266354
Fixed an issue where Hybrid-SWG explicit proxy connections failed Fixed an issue where Hybrid-SWG explicit proxy connections failed when the number of destination domains exceeded 1024.
when the number of destination domains exceeded 1024.
## PAN-265745 ## PAN-265745
Fixed an issue where the firewall displayed incorrect MAC receive Fixed an issue where the firewall displayed incorrect MAC receive error counters for VMWare devices hosted in ESXi.
error counters for VMWare devices hosted in ESXi.
## PAN-265179 ## PAN-265179
Fixed an issue where a kernel race condition caused the firewall to Fixed an issue where a kernel race condition caused the firewall to reboot with a kernel panic.
reboot with a kernel panic.
## PAN-265160 ## PAN-265160
Fixed an issue where the firewall created multiple connections to a Fixed an issue where the firewall created multiple connections to a syslog server and remained in the FINWAIT1 state, which caused logs to drop while being forwarded to the syslog server.
syslog server and remained in the FINWAIT1 state, which caused logs
to drop while being forwarded to the syslog server.
## PAN-264369 ## PAN-264369
Fixed an issue where the 7 Day Threat Report Fixed an issue where the **7 Day Threat Report** was empty in the scheduled reports sent via email.
was empty in the scheduled reports sent via email.
## PAN-263291 ## PAN-263291
Fixed an issue where Microsoft Outlook did not work as expected when Fixed an issue where Microsoft Outlook did not work as expected when the GlobalProtect clientless VPN was configured.
the GlobalProtect clientless VPN was configured.
## PAN-262627 ## PAN-262627
Fixed an issue where the firewall rebooted into maintenance mode due Fixed an issue where the firewall rebooted into maintenance mode due to a service failure in the configd process.
to a service failure in the configd process.
## PAN-262383 ## PAN-262383
Fixed an issue where the firewall was unable to decompress the HTTP2 Fixed an issue where the firewall was unable to decompress the HTTP2 header, which caused the session to be classified as unknown-tcp instead of web-browsing.
header, which caused the session to be classified as unknown-tcp
instead of web-browsing.
## PAN-262254 ## PAN-262254
Fixed an issue where the firewall experienced an OOM condition and Fixed an issue where the firewall experienced an OOM condition and the useridd process stopped responding, which caused the firewall to drop interfaces from their respective aggregate groups.
the useridd process stopped responding, which caused
the firewall to drop interfaces from their respective aggregate
groups.
## PAN-261998 ## PAN-261998
Fixed an issue where the firewall configuration process restarted Fixed an issue where the firewall configuration process restarted during an External Dynamic List refresh or a commit and push operation.
during an External Dynamic List refresh or a commit and push
operation.
## PAN-260290 ## PAN-260290
Fixed an issue for fixed model licenses to support new content size Fixed an issue for fixed model licenses to support new content size requirements by reducing the total sessions supported to be equivalent to their flex memory counterpart
requirements by reducing the total sessions supported to be
equivalent to their flex memory counterpart
## PAN-260149 ## PAN-260149
Fixed an issue where the management plane DNS cache size was lower Fixed an issue where the management plane DNS cache size was lower than expected.
than expected.
## PAN-259055 ## PAN-259055
Fixed an issue where the firewall stopped responding when receiving Fixed an issue where the firewall stopped responding when receiving SNMPv3 traps.
SNMPv3 traps.
## PAN-258996 ## PAN-258996
Fixed an issue where the firewall displayed the SFP ports as Fixed an issue where the firewall displayed the SFP ports as PowerDown when the SFP transceiver was removed and reinserted or the port was shut down and brought back up on the peer device.
PowerDown when the SFP transceiver
was removed and reinserted or the port was shut down and brought
back up on the peer device.
## PAN-257390 ## PAN-257390
@@ -285,32 +214,23 @@ back up on the peer device.
PA-5250 firewalls only PA-5250 firewalls only
``` ```
Fixed an issue where the Fixed an issue where the logrcvr process stopped responding due to a segmentation fault.
logrcvr process stopped responding due to a
segmentation fault.
## PAN-256669 ## PAN-256669
Fixed an issue where the memory usage reported by SNMP did not match Fixed an issue where the memory usage reported by SNMP did not match the memory usage reported by the top command.
the memory usage reported by the top command.
## PAN-255773 ## PAN-255773
Fixed an issue where errors related to applications in Fixed an issue where errors related to applications in **Content-preview** caused commit failures.
Content-preview caused commit
failures.
## PAN-255747 ## PAN-255747
Fixed an issue on the firewall where CLI commands returned Fixed an issue on the firewall where CLI commands returned Server error: op command for client dagger timed out as client is not available.
Server error: op command for client dagger timed
out as client is not available.
## PAN-255653 ## PAN-255653
Fixed an HA failover issue where, when Management Processing Card Fixed an HA failover issue where, when Management Processing Card (MPC) or Base Card (BC) failures occurred, the HA link went down, which caused fpp-down events on one firewall.
(MPC) or Base Card (BC) failures occurred, the HA link went down,
which caused fpp-down events on one firewall.
## PAN-253485 ## PAN-253485
@@ -318,101 +238,72 @@ which caused fpp-down events on one firewall.
Firewalls in active/passive HA configurations only Firewalls in active/passive HA configurations only
``` ```
Fixed Fixed an issue where dataplane packet capture filter configuration failed on the active firewall with the error op command for client dagger timed out as client is not available.
an issue where dataplane packet capture filter configuration failed
on the active firewall with the error op command for
client dagger timed out as client is not
available.
## PAN-252669 ## PAN-252669
Fixed an issue where the ikemgr process stopped Fixed an issue where the ikemgr process stopped responding with a SIGSEGV error.
responding with a SIGSEGV error.
## PAN-252036 ## PAN-252036
Fixed an issue where, when the GlobalProtect portal was not Fixed an issue where, when the GlobalProtect portal was not configured, accessing the GlobalProtect gateway still loaded a portal malformed page.
configured, accessing the GlobalProtect gateway still loaded a
portal malformed page.
## PAN-252224 ## PAN-252224
Fixed an issue where Panorama did not forward logs to a syslog server Fixed an issue where Panorama did not forward logs to a syslog server over an SSL connection using CRL as a revocation verification method.
over an SSL connection using CRL as a revocation verification
method.
## PAN-250585 ## PAN-250585
Fixed an issue where the firewall CPU use increased after upgrading Fixed an issue where the firewall CPU use increased after upgrading from PAN-OS 10.2.4-h4 to PAN-OS 10.2.8 due to a change in system resource reporting by the REST API.
from PAN-OS 10.2.4-h4 to PAN-OS 10.2.8 due to a change in system
resource reporting by the REST API.
## PAN-246209 ## PAN-246209
Fixed an issue where IPSec VPN tunnels went down after receiving a Fixed an issue where IPSec VPN tunnels went down after receiving a DHCP server message that the DHCP client cleared the IP address on the interface.
DHCP server message that the DHCP client cleared the IP address on
the interface.
## PAN-242739 ## PAN-242739
Fixed an issue on the firewall where the dataplane repeatedly Fixed an issue on the firewall where the dataplane repeatedly restarted.
restarted.
## PAN-240225 ## PAN-240225
Fixed an issue where authentication failed on web-based GlobalProtect Fixed an issue where authentication failed on web-based GlobalProtect portal.
portal.
## PAN-238594 ## PAN-238594
Fixed an issue where the firewall rebooted when a QSFP28 cable was Fixed an issue where the firewall rebooted when a QSFP28 cable was removed from the port while the port was passing traffic.
removed from the port while the port was passing traffic.
## PAN-232833 ## PAN-232833
Fixed an issue where the following error message displayed for IoT Fixed an issue where the following error message displayed for IoT trial licenses: IoT Security license is required for the feature to function.
trial licenses: IoT Security license is required for
the feature to function.
## PAN-232550 ## PAN-232550
Fixed an issue where SNMPv3 authentication failed when using SHA-512 Fixed an issue where SNMPv3 authentication failed when using SHA-512 Auth protocol.
Auth protocol.
## PAN-225228 ## PAN-225228
Fixed an issue where filtering threat logs using any value under Fixed an issue where filtering threat logs using any value under **THREAT ID/NAME** displayed the error **Invalid term**.
THREAT ID/NAME displayed the error
Invalid term.
## PAN-218873 ## PAN-218873
Fixed an issue where a HIP mask was reused when an existing IP Fixed an issue where a HIP mask was reused when an existing IP address user mapping was updated by a new IP address user mapping that had a different username but the same IP address.
address user mapping was updated by a new IP address user mapping
that had a different username but the same IP address.
## PAN-216054 ## PAN-216054
Fixed an issue that caused the firewall's fan speed to increase while Fixed an issue that caused the firewall's fan speed to increase while it was idle.
it was idle.
## PAN-214430 ## PAN-214430
Fixed an issue where some commands did not have executable Fixed an issue where some commands did not have executable permissions.
permissions.
## PAN-212197 ## PAN-212197
Fixed an issue where you were able to create local administrator Fixed an issue where you were able to create local administrator usernames that contained only numbers.
usernames that contained only numbers.
## PAN-207972 ## PAN-207972
Fixed an issue on the web interface where the BGP routing table did Fixed an issue on the web interface where the BGP routing table did not display advertised routes.
not display advertised routes.
## PAN-193285 ## PAN-193285
Fixed an issue where the policy optimizer feature did not add entries Fixed an issue where the policy optimizer feature did not add entries back to the mongodb database after removing them during an upgrade or downgrade.
back to the mongodb database after
removing them during an upgrade or downgrade.
web/data/issues/PAN-OS/addressed/11.1.4-h15.md
+12 -30
View File
@@ -6,24 +6,19 @@ version: 11.1.4-h15
## PAN-282236 ## PAN-282236
Fixed an issue where large IPv6 packets were reassembled on the Fixed an issue where large IPv6 packets were reassembled on the firewall when the packets arrived fragmented over an IPv4 tunnel.
firewall when the packets arrived fragmented over an IPv4
tunnel.
## PAN-280471 ## PAN-280471
Fixed an issue where navigating PanoramaMonitorLogs was slower than expected. Fixed an issue where navigating **Panorama** > **Monitor** > **Logs** was slower than expected.
## PAN-279746 ## PAN-279746
Fixed an issue where SMTP packets were not sent out when the Client Fixed an issue where SMTP packets were not sent out when the Client Hello arrived at the firewall in multiple out-of-order segments and the traffic was not subject to SSL decryption.
Hello arrived at the firewall in multiple out-of-order segments and
the traffic was not subject to SSL decryption.
## PAN-279191 ## PAN-279191
Fixed an issue where a GlobalProtect gateway stopped responding when Fixed an issue where a GlobalProtect gateway stopped responding when handling HTTP/1.1 traffic with web inspection enabled.
handling HTTP/1.1 traffic with web inspection enabled.
## PAN-278684 ## PAN-278684
@@ -31,45 +26,32 @@ handling HTTP/1.1 traffic with web inspection enabled.
PA-445 firewalls only PA-445 firewalls only
``` ```
Fixed an issue where the firewall Fixed an issue where the firewall did not properly power cycle during a reboot.
did not properly power cycle during a reboot.
## PAN-275905 ## PAN-275905
Fixed an issue where the Panorama web interface was slower than Fixed an issue where the Panorama web interface was slower than expected and Elasticsearch CPU usage was high.
expected and Elasticsearch CPU usage was high.
## PAN-275032 ## PAN-275032
Fixed an issue where the Elasticsearch cluster certificate (CC) Fixed an issue where the Elasticsearch cluster certificate (CC) status displayed with a past expiration date, which caused all shards to be unassigned.
status displayed with a past expiration date, which caused all
shards to be unassigned.
## PAN-273141 ## PAN-273141
Fixed an issue where GlobalProtect clients experienced slow file Fixed an issue where GlobalProtect clients experienced slow file transfer download throughput when passing through an IPSec tunnel.
transfer download throughput when passing through an IPSec
tunnel.
## PAN-272085 ## PAN-272085
Fixed an issue where the firewall might crash and reboot when DoH is Fixed an issue where the firewall might crash and reboot when DoH is enabled for DNS Security and multiple DoH transactions are sent in a single HTTP/1 connection.
enabled for DNS Security and multiple DoH transactions are sent in a
single HTTP/1 connection.
## PAN-270744 ## PAN-270744
Fixed an issue where API calls to Panorama failed with the error Fixed an issue where API calls to Panorama failed with the error Server error : Timed out while getting config lock. Please try again.
Server error : Timed out while getting config
lock. Please try again.
## PAN-268279 ## PAN-268279
Fixed an issue where autocommits failed if the management IPv6 Fixed an issue where autocommits failed if the management IPv6 gateway was the same as the dataplane interface IP address.
gateway was the same as the dataplane interface IP address.
## PAN-242130 ## PAN-242130
Fixed an issue where the firewall displayed the speed and duplex of Fixed an issue where the firewall displayed the speed and duplex of its dataplane interfaces as **Unknown** even though the link was up.
its dataplane interfaces as Unknown even
though the link was up.
web/data/issues/PAN-OS/addressed/11.1.4-h16.md
+1 -2
View File
@@ -6,5 +6,4 @@ version: 11.1.4-h16
## PAN-282022 ## PAN-282022
Fixed the support limitation for the Panorama M-600 and M-700 Fixed the support limitation for the Panorama M-600 and M-700 appliances.
appliances.
web/data/issues/PAN-OS/addressed/11.1.4-h17.md
+24 -67
View File
@@ -6,38 +6,27 @@ version: 11.1.4-h17
## PAN-282022 ## PAN-282022
Fixed the support limitation for the Panorama M-600 and M-700 Fixed the support limitation for the Panorama M-600 and M-700 appliances.
appliances.
## PAN-281885 ## PAN-281885
Fixed an issue where, when exporting and importing CSV files, the Fixed an issue where, when exporting and importing CSV files, the hash values of pre-shared key variables set at template and template stack levels changed inconsistently, which resulted in both variables displaying the same hash value.
hash values of pre-shared key variables set at template and template
stack levels changed inconsistently, which resulted in both
variables displaying the same hash value.
## PAN-280505 ## PAN-280505
Fixed an issue where the web interface did not display a message to Fixed an issue where the web interface did not display a message to commit prior changes before attempting a partial configuration load.
commit prior changes before attempting a partial configuration load.
## PAN-280243 ## PAN-280243
Fixed an issue where the firewall lost the pre-shared key Fixed an issue where the firewall lost the pre-shared key configuration assigned from a PSK variable when an unrelated device group configuration was loaded.
configuration assigned from a PSK variable when an unrelated device
group configuration was loaded.
## PAN-279336 ## PAN-279336
Fixed an issue where the CLI did not display a message to commit Fixed an issue where the CLI did not display a message to commit prior changes before loading a partial configuration.
prior changes before loading a partial configuration.
## PAN-279176 ## PAN-279176
Fixed an issue where the configuration audit displayed inaccurate Fixed an issue where the configuration audit displayed inaccurate information after partially loading the configuration via the CLI, which caused the audit to flag the configuration as deleted or changed.
information after partially loading the configuration via the CLI,
which caused the audit to flag the configuration as deleted or
changed.
## PAN-277762 ## PAN-277762
@@ -45,47 +34,31 @@ changed.
VM-Series firewalls only VM-Series firewalls only
``` ```
Fixed an issue where unexpected Fixed an issue where unexpected failovers occurred on firewalls running PAN-OS 11.2.2-h2.
failovers occurred on firewalls running PAN-OS 11.2.2-h2.
## PAN-275713 ## PAN-275713
Fixed an issue where the dscd process stopped responding Fixed an issue where the dscd process stopped responding when **Endpoint Serial Number** was enabled, which resulted in the **Active Directory** returning a list of serial numbers for a specific firewall from the Cloud Identity Engine.
when Endpoint Serial Number was enabled,
which resulted in the Active Directory
returning a list of serial numbers for a specific firewall from the
Cloud Identity Engine.
## PAN-275077 ## PAN-275077
Fixed an issue where DNS Security intermittently logs malicious Fixed an issue where DNS Security intermittently logs malicious domain URLs as Alert instead of taking a Sinkhole action, even when configured to Sinkhole malicious DNS domains.
domain URLs as Alert instead of taking a Sinkhole action, even when
configured to Sinkhole malicious DNS domains.
## PAN-274750 ## PAN-274750
Fixed an issue where the detailed log view in Panorama did not Fixed an issue where the detailed log view in Panorama did not display all packet details for traffic logs received from the cloud.
display all packet details for traffic logs received from the cloud.
## PAN-273694 ## PAN-273694
Fixed an issue where the firewall rebooted due to an out-of-bounds Fixed an issue where the firewall rebooted due to an out-of-bounds memory access that occurred as a result of the SIP content length value being split across packets.
memory access that occurred as a result of the SIP content length
value being split across packets.
## PAN-272538 ## PAN-272538
Fixed an issue where the configd process stopped Fixed an issue where the configd process stopped responding during a commit-all validation when there were uncommitted changes and share-unused-objects-with-devices was set to off.
responding during a commit-all validation when there were
uncommitted changes and
share-unused-objects-with-devices
was set to off.
## PAN-272171 ## PAN-272171
Fixed an issue where the firewall dropped the AAAA DNS server Fixed an issue where the firewall dropped the AAAA DNS server response and caused delays in traffic from Ubuntu or Linux clients when DNS Security was enabled.
response and caused delays in traffic from Ubuntu or Linux clients
when DNS Security was enabled.
## PAN-270607 ## PAN-270607
@@ -93,13 +66,11 @@ when DNS Security was enabled.
Firewalls in active/passive HA configurations only Firewalls in active/passive HA configurations only
``` ```
Fixed Fixed an issue where OSPF failed to establish after a failover from the active firewall to the passive firewall.
an issue where OSPF failed to establish after a failover from the
active firewall to the passive firewall.
## PAN-271351 ## PAN-271351
A fix was made to address CVE-2025-0116. A fix was made to address [CVE-2025-0116](https://security.paloaltonetworks.com/CVE-2025-0116).
## PAN-267091 ## PAN-267091
@@ -107,50 +78,36 @@ Fixed an issue on Panorama where Elasticsearch repeatedly restarted.
## PAN-264678 ## PAN-264678
Fixed an issue where Preview Changes did not Fixed an issue where **Preview Changes** did not display configuration changes in **Commit and push > Push Scope**.
display configuration changes in Commit and push > Push
Scope.
## PAN-262511 ## PAN-262511
Fixed an issue on firewalls in HA configurations where OSPF neighbors Fixed an issue on firewalls in HA configurations where OSPF neighbors were not established after an HA failover.
were not established after an HA failover.
## PAN-261825 ## PAN-261825
Fixed an issue where traffic was dropped when Data Loss Prevention or Fixed an issue where traffic was dropped when Data Loss Prevention or Advanced URL Filtering were enabled. This occurred when the payload size was greater than 3.5 KB.
Advanced URL Filtering were enabled. This occurred when the payload
size was greater than 3.5 KB.
## PAN-259706 ## PAN-259706
Fixed an issue on Panorama where the web interface was slower than Fixed an issue on Panorama where the web interface was slower than expected or unresponsive when monitoring definitions were added in the Kubernetes plugin.
expected or unresponsive when monitoring definitions were added in
the Kubernetes plugin.
## PAN-257183 ## PAN-257183
Fixed an issue where the firewall dropped DNS traffic when using DNS Fixed an issue where the firewall dropped DNS traffic when using DNS Security.
Security.
## PAN-254174 ## PAN-254174
A fix was made to address CVE-2025-0115. A fix was made to address [CVE-2025-0115](https://security.paloaltonetworks.com/CVE-2025-0115).
## PAN-248762 ## PAN-248762
Fixed an issue where, when the Advanced Routing Engine was configured Fixed an issue where, when the Advanced Routing Engine was configured with OSPF, the firewall stopped responding when attempting to connect to the neighbor while exchanging route maps.
with OSPF, the firewall stopped responding when attempting to
connect to the neighbor while exchanging route maps.
## PAN-239201 ## PAN-239201
Fixed an issue where partial commit or partial validation operations Fixed an issue where partial commit or partial validation operations failed for non-super user administrators with the error <device-group-name> is invalid. meta data not found for dg <device-group-name>.
failed for non-super user administrators with the error
<device-group-name> is invalid. meta data not
found for dg <device-group-name>.
## PAN-235733 ## PAN-235733
Fixed an issue where the displayed NTP information was incorrect if Fixed an issue where the displayed NTP information was incorrect if the DNS servers timed out.
the DNS servers timed out.
web/data/issues/PAN-OS/addressed/11.1.4-h18.md
+10 -31
View File
@@ -6,52 +6,35 @@ version: 11.1.4-h18
## PAN-286255 ## PAN-286255
Fixed an issue where, when the firewall received an unexpected Fixed an issue where, when the firewall received an unexpected termination request for SSL sessions, the dataplane experienced a slow buffer resource leak.
termination request for SSL sessions, the dataplane experienced a
slow buffer resource leak.
## PAN-282069 ## PAN-282069
Fixed an issue on Panorama where Security policy rules were removed Fixed an issue on Panorama where Security policy rules were removed from device groups when you cloned or edited Security policy rules that used more than 63 characters.
from device groups when you cloned or edited Security policy rules
that used more than 63 characters.
## PAN-280942 ## PAN-280942
Fixed an issue where the logrcvr process stopped Fixed an issue where the logrcvr process stopped responding.
responding.
## PAN-273949 ## PAN-273949
Fixed an issue where the firewall generated the following error Fixed an issue where the firewall generated the following error message in the snmpd logs: pan_get_keystr_from_cryptod(pan_snmpinterface.c:181): Key X2F1dGhfa2V5 import from cryptod failed.
message in the snmpd logs:
pan_get_keystr_from_cryptod(pan_snmpinterface.c:181):
Key X2F1dGhfa2V5 import from cryptod failed.
## PAN-271273 ## PAN-271273
Fixed an issue where dynamic update downloads failed when Fixed an issue where dynamic update downloads failed when **IPv6 firewalling** was enabled on the firewall and both IPv4 and IPv6 were configured on the management interface.
IPv6 firewalling was enabled on the
firewall and both IPv4 and IPv6 were configured on the management
interface.
## PAN-270193 ## PAN-270193
Fixed an issue where the Panorama management server changed its Fixed an issue where the Panorama management server changed its certificate authority (CA) unexpectedly, which caused managed firewalls to disconnect.
certificate authority (CA) unexpectedly, which caused managed
firewalls to disconnect.
## PAN-268614 ## PAN-268614
Fixed an issue on the web interface where, when all rules were Fixed an issue on the web interface where, when all rules were highlighted when a read-only admin user clicked the **Highlight Unused Rules** checkbox.
highlighted when a read-only admin user clicked the
Highlight Unused Rules checkbox.
## PAN-265621 ## PAN-265621
Fixed an issue where the restart option for Fixed an issue where the **restart** option for IPSec tunnels was greyed out when you attempted to restart the tunnel from **Network** > **IPSec Tunnels** > **IKE Info**.
IPSec tunnels was greyed out when you attempted to restart the
tunnel from NetworkIPSec TunnelsIKE Info.
## PAN-260300 ## PAN-260300
@@ -59,12 +42,8 @@ tunnel from NetworkIPSec TunnelsIKE Info.
PA-5410, PA-5420, PA-5430, PA-5440 and PA-5445 firewalls only PA-5410, PA-5420, PA-5430, PA-5440 and PA-5445 firewalls only
``` ```
Fixed an issue related to the Fixed an issue related to the all_pktproc process where DPC slot 3 stopped responding.
all_pktproc process where DPC slot 3 stopped
responding.
## PAN-259535 ## PAN-259535
Fixed an issue where the firewall failed to boot up after running Fixed an issue where the firewall failed to boot up after running power cycle tests due to ehmon process heartbeat failures.
power cycle tests due to ehmon process heartbeat
failures.
web/data/issues/PAN-OS/addressed/11.1.4-h25.md
+15 -48
View File
@@ -6,82 +6,53 @@ version: 11.1.4-h25
## PAN-292261 ## PAN-292261
Fixed an issue where the firewall repeatedly reported an unreachable Fixed an issue where the firewall repeatedly reported an unreachable syslog server as back online when the server remained unavailable. This resulted in misleading alternating connection status messages in the system logs.
syslog server as back online when the
server remained unavailable. This resulted in misleading alternating
connection status messages in the system logs.
## PAN-287423 ## PAN-287423
Fixed an issue where content loading issues occurred on IPv6 websites Fixed an issue where content loading issues occurred on IPv6 websites due to the firewall incorrectly setting the IPv6 header flow label to 0.
due to the firewall incorrectly setting the IPv6 header flow label
to 0.
## PAN-286255 ## PAN-286255
Fixed an issue where, when the firewall received an unexpected Fixed an issue where, when the firewall received an unexpected termination request for SSL sessions, the dataplane experienced a slow buffer resource leak.
termination request for SSL sessions, the dataplane experienced a
slow buffer resource leak.
## PAN-282069 ## PAN-282069
Fixed an issue on Panorama where Security policy rules were removed Fixed an issue on Panorama where Security policy rules were removed from device groups when you cloned or edited Security policy rules that used more than 63 characters.
from device groups when you cloned or edited Security policy rules
that used more than 63 characters.
## PAN-280942 ## PAN-280942
Fixed an issue where the logrcvr process stopped Fixed an issue where the logrcvr process stopped responding.
responding.
## PAN-280698 ## PAN-280698
Fixed an issue where the firewall removed the TCP timestamp from Fixed an issue where the firewall removed the TCP timestamp from client hello messages that did not fit in a single packet, which resulted in connection issues.
client hello messages that did not fit in a single packet, which
resulted in connection issues.
## PAN-279901 ## PAN-279901
An issue was fixed where the firewall dropped fragmented TLS An issue was fixed where the firewall dropped fragmented TLS ClientHello packets, which blocked access to certain websites. This occurred because the packets arrived truncated, in varying sizes and orders, and the firewall's heuristics failed to handle them correctly.
ClientHello packets, which blocked access to certain websites. This
occurred because the packets arrived truncated, in varying sizes and
orders, and the firewall's heuristics failed to handle them
correctly.
To enable this fix, run: debug dataplane set ssl-decrypt To enable this fix, run: debug dataplane set ssl-decrypt accumulate-client-hello disjoined yes.
accumulate-client-hello disjoined yes.
## PAN-273949 ## PAN-273949
Fixed an issue where the firewall generated the following error Fixed an issue where the firewall generated the following error message in the snmpd logs: pan_get_keystr_from_cryptod(pan_snmpinterface.c:181): Key X2F1dGhfa2V5 import from cryptod failed.
message in the snmpd logs:
pan_get_keystr_from_cryptod(pan_snmpinterface.c:181):
Key X2F1dGhfa2V5 import from cryptod failed.
## PAN-271273 ## PAN-271273
Fixed an issue where dynamic update downloads failed when Fixed an issue where dynamic update downloads failed when **IPv6 firewalling** was enabled on the firewall and both IPv4 and IPv6 were configured on the management interface.
IPv6 firewalling was enabled on the
firewall and both IPv4 and IPv6 were configured on the management
interface.
## PAN-270193 ## PAN-270193
Fixed an issue where the Panorama management server changed its Fixed an issue where the Panorama management server changed its certificate authority (CA) unexpectedly, which caused managed firewalls to disconnect.
certificate authority (CA) unexpectedly, which caused managed
firewalls to disconnect.
## PAN-268614 ## PAN-268614
Fixed an issue on the web interface where, when all rules were Fixed an issue on the web interface where, when all rules were highlighted when a read-only admin user clicked the **Highlight Unused Rules** checkbox.
highlighted when a read-only admin user clicked the
Highlight Unused Rules checkbox.
## PAN-265621 ## PAN-265621
Fixed an issue where the restart option for Fixed an issue where the **restart** option for IPSec tunnels was greyed out when you attempted to restart the tunnel from **Network** > **IPSec Tunnels** > **IKE Info**.
IPSec tunnels was greyed out when you attempted to restart the
tunnel from NetworkIPSec TunnelsIKE Info.
## PAN-260300 ## PAN-260300
@@ -89,12 +60,8 @@ tunnel from NetworkIPSec TunnelsIKE Info.
PA-5410, PA-5420, PA-5430, PA-5440 and PA-5445 firewalls only PA-5410, PA-5420, PA-5430, PA-5440 and PA-5445 firewalls only
``` ```
Fixed an issue related to the Fixed an issue related to the all_pktproc process where DPC slot 3 stopped responding.
all_pktproc process where DPC slot 3 stopped
responding.
## PAN-259535 ## PAN-259535
Fixed an issue where the firewall failed to boot up after running Fixed an issue where the firewall failed to boot up after running power cycle tests due to ehmon process heartbeat failures.
power cycle tests due to ehmon process heartbeat
failures.
web/data/issues/PAN-OS/addressed/11.1.4-h27.md
+12 -17
View File
@@ -10,29 +10,27 @@ Fixed an issue on Log Collectors where the Elasticsearch process fluctuated inte
## PAN-292159 ## PAN-292159
A fix was made to address CVE-2025-4615. A fix was made to address [CVE-2025-4615](https://security.paloaltonetworks.com/CVE-2025-4615).
## PAN-271216
A fix was made to address [CVE-2025-4615](https://security.paloaltonetworks.com/CVE-2025-4615).
## PAN-291661 ## PAN-291661
Fixed an issue on Panorama appliances and Log Collectors where, after Fixed an issue on Panorama appliances and Log Collectors where, after an upgrade, Elasticsearch intermittently entered into a Red state before automatically recovering.
an upgrade, Elasticsearch intermittently entered into a Red state
before automatically recovering.
## PAN-286164 ## PAN-286164
A fix was made to address CVE-2025-4614. A fix was made to address [CVE-2025-4614](https://security.paloaltonetworks.com/CVE-2025-4614).
## PAN-282093 ## PAN-282093
Enhanced the CLI command request legacy Enhanced the CLI command request legacy reset to delete the legacy certificate files that were being used to connect with the secondary Panorama appliance.
reset to delete the legacy certificate files that
were being used to connect with the secondary Panorama appliance.
## PAN-278296 ## PAN-278296
Fixed an issue where the system MAC address of the aggregate Fixed an issue where the system MAC address of the aggregate interface was the same on the active firewall and the passive firewall after an upgrade.
interface was the same on the active firewall and the passive
firewall after an upgrade.
## PAN-272539 ## PAN-272539
@@ -40,15 +38,12 @@ firewall after an upgrade.
Panorama appliances on Microsoft Azure environments only Panorama appliances on Microsoft Azure environments only
``` ```
Fixed an issue where user to IP address mapping was missing for some Fixed an issue where user to IP address mapping was missing for some users connected to specific Prisma Access gateways, which caused the collection layer Azure firewall to not form the mapping.
users connected to specific Prisma Access gateways, which caused the
collection layer Azure firewall to not form the mapping.
## PAN-271221 ## PAN-271221
A fix was made to address CVE-2025-4615. A fix was made to address [CVE-2025-4615](https://security.paloaltonetworks.com/CVE-2025-4615).
## PAN-251715 ## PAN-251715
Fixed an issue where the firewall closed the SSL connection to the Fixed an issue where the firewall closed the SSL connection to the user ID agent.
user ID agent.
web/data/issues/PAN-OS/addressed/11.1.4-h4.md
+56 -146
View File
@@ -6,92 +6,67 @@ version: 11.1.4-h4
## PAN-265963 ## PAN-265963
Fixed an issue where the escd process caused a memory Fixed an issue where the escd process caused a memory leak when session resiliency was enabled on the firewall.
leak when session resiliency was enabled on the firewall.
## PAN-265349 ## PAN-265349
Fixed an issue where multiple segments of HTTP proxy connect messages Fixed an issue where multiple segments of HTTP proxy connect messages were not handled correctly by proxy.
were not handled correctly by proxy.
## PAN-264421 ## PAN-264421
Fixed an issue on Panorama where Push Scope Fixed an issue on Panorama where **Push Scope** did not populate automatically after changing the device group configuration.
did not populate automatically after changing the device group
configuration.
## PAN-263987 ## PAN-263987
Fixed an issue on the firewall where, when a NAT transversal IPSec Fixed an issue on the firewall where, when a NAT transversal IPSec tunnel was terminated, and the NAT rule that was applied to the NAT-T IPSec tunnel was on the same firewall, traffic flowing through the tunnel was not correctly translated.
tunnel was terminated, and the NAT rule that was applied to the
NAT-T IPSec tunnel was on the same firewall, traffic flowing through
the tunnel was not correctly translated.
## PAN-263559 ## PAN-263559
Fixed an issue where the dataplane stopped responding and the Fixed an issue where the dataplane stopped responding and the firewall unexpectedly rebooted due to multiple process restarts.
firewall unexpectedly rebooted due to multiple process restarts.
## PAN-263226 ## PAN-263226
Fixed an issue where, when SSL decryption was enabled and Client Fixed an issue where, when SSL decryption was enabled and Client Hello messages spanned multiple TCP segments, some SSL decrypted sessions failed.
Hello messages spanned multiple TCP segments, some SSL decrypted
sessions failed.
## PAN-262593 ## PAN-262593
Fixed an issue where traffic to websites failed on the Google Chrome Fixed an issue where traffic to websites failed on the Google Chrome web browser on Secure Web Gateway (SWG) nodes.
web browser on Secure Web Gateway (SWG) nodes.
## PAN-262340 ## PAN-262340
Fixed an issue where FQDN resolution failed for address objects, and Fixed an issue where FQDN resolution failed for address objects, and all FQDN traffic was denied by the interzone-default policy rule.
all FQDN traffic was denied by the interzone-default policy
rule.
## PAN-262287 ## PAN-262287
Fixed an issue where dereferencing a NULL pointer that occurred when Fixed an issue where dereferencing a NULL pointer that occurred when App-ID stopped responding caused the firewall to restart.
App-ID stopped responding caused the firewall to restart.
## PAN-261991 ## PAN-261991
Fixed an issue where traffic that did not match a decryption policy Fixed an issue where traffic that did not match a decryption policy rule, or matched a no-decrypt policy rule, failed when accumulation proxy was enabled and a Zone Protection profile was configured with syn-cookies enabled.
rule, or matched a no-decrypt policy rule, failed when accumulation
proxy was enabled and a Zone Protection profile was configured with
syn-cookies enabled.
## PAN-261917 ## PAN-261917
Fixed an issue where websites with a no-decrypt policy rule were Fixed an issue where websites with a no-decrypt policy rule were decrypted in traffic log when using a Google Chrome browser with PQC enabled.
decrypted in traffic log when using a Google Chrome browser with PQC
enabled.
## PAN-261909 ## PAN-261909
Fixed an issue where the GlobalProtect client did not display the Fixed an issue where the GlobalProtect client did not display the dialog box for an MFA verification code.
dialog box for an MFA verification code.
## PAN-261489 ## PAN-261489
Fixed an issue where an out-of-memory (OOM) condition caused a Fixed an issue where an out-of-memory (OOM) condition caused a firewall outage.
firewall outage.
## PAN-261484 ## PAN-261484
Fixed an issue on the firewall where DPDK allocated twice the amount Fixed an issue on the firewall where DPDK allocated twice the amount of memory as requested for pre-allocation.
of memory as requested for pre-allocation.
## PAN-261001 ## PAN-261001
Fixed an issue where GlobalProtect users were unable to switch Fixed an issue where GlobalProtect users were unable to switch gateways after upgrading to GlobalProtect version 6.2.3.
gateways after upgrading to GlobalProtect version 6.2.3.
## PAN-260974 ## PAN-260974
Fixed an issue where the Cloud Identity Engine (CIE) user context did Fixed an issue where the Cloud Identity Engine (CIE) user context did not correctly redistribute user/IP address port mapping to on-premises firewalls.
not correctly redistribute user/IP address port mapping to
on-premises firewalls.
## PAN-259997 ## PAN-259997
@@ -99,35 +74,23 @@ on-premises firewalls.
PA-3410, PA-3420, and PA-3430 firewalls only PA-3410, PA-3420, and PA-3430 firewalls only
``` ```
Fixed an Fixed an issue where the install failed when upgrading from PAN-OS 10.2.3-h3 and later 10.2 releases to PAN-OS 10.2.10 due to the number of configured vsys zones exceeding the zone limit in PAN-OS 10.2.10.
issue where the install failed when upgrading from PAN-OS 10.2.3-h3
and later 10.2 releases to PAN-OS 10.2.10 due to the number of
configured vsys zones exceeding the zone limit in PAN-OS
10.2.10.
## PAN-259769 ## PAN-259769
Fixed an issue where the GlobalProtect portal was not accessible via Fixed an issue where the GlobalProtect portal was not accessible via a web browser and displayed the error ERR_EMPTY_RESPONSE.
a web browser and displayed the error
ERR_EMPTY_RESPONSE.
## PAN-259151 ## PAN-259151
Fixed an issue where unused objects were pushed to the firewall, Fixed an issue where unused objects were pushed to the firewall, which caused configuration pushes to fail with the error Number of address groups exceed platform capacity.
which caused configuration pushes to fail with the error
Number of address groups exceed platform
capacity.
## PAN-258736 ## PAN-258736
Fixed an issue where policy rule configurations pushed from Panorama Fixed an issue where policy rule configurations pushed from Panorama were not reflected on the firewall if the rule had 63 characters.
were not reflected on the firewall if the rule had 63
characters.
## PAN-258225 ## PAN-258225
Fixed an issue on the Panorama web interface where Security policy Fixed an issue on the Panorama web interface where Security policy rules loaded more slowly than expected.
rules loaded more slowly than expected.
## PAN-257957 ## PAN-257957
@@ -135,8 +98,7 @@ rules loaded more slowly than expected.
Firewalls and Panorama appliances in FIPS-CC mode only Firewalls and Panorama appliances in FIPS-CC mode only
``` ```
Fixed an issue where the authd process restarted if RADIUS Fixed an issue where the *authd*process restarted if RADIUS PAP/CHAP authentication was used.
PAP/CHAP authentication was used.
## PAN-257925 ## PAN-257925
@@ -144,22 +106,15 @@ PAP/CHAP authentication was used.
CN-Series firewalls only CN-Series firewalls only
``` ```
Fixed an issue where the CLI Fixed an issue where the CLI command show system setting ctd state did not work as expected.
command show system setting ctd state did not
work as expected.
## PAN-256725 ## PAN-256725
Fixed an issue on the Panorama interface where Fixed an issue on the Panorama interface where **Traffic** and **Unified** event details loaded more slowly than expected.
Traffic and
Unified event details loaded more slowly
than expected.
## PAN-256666 ## PAN-256666
Fixed an issue where the configdprocess stopped responding Fixed an issue where the *configd*process stopped responding when **Commit and Push**operations were performed on multiple device groups.
when Commit and Push operations were performed on multiple
device groups.
## PAN-256385 ## PAN-256385
@@ -167,17 +122,11 @@ device groups.
CN-Series firewalls only CN-Series firewalls only
``` ```
Fixed an issue where Fixed an issue where communication was broken between the management plane and the dataplane when anti-spyware profiles were configured in a Security policy rule.
communication was broken between the management plane and the
dataplane when anti-spyware profiles were configured in a Security
policy rule.
## PAN-256350 ## PAN-256350
Fixed an issue where, when you cloned an admin role or an LDAP server Fixed an issue where, when you cloned an admin role or an LDAP server profile and then changed the name of the clone, the configuration change was not reflected on the managed firewall after pushing the configuration from Panorama.
profile and then changed the name of the clone, the configuration
change was not reflected on the managed firewall after pushing the
configuration from Panorama.
## PAN-256320 ## PAN-256320
@@ -185,103 +134,79 @@ configuration from Panorama.
Firewalls in active/passive HA configurations only Firewalls in active/passive HA configurations only
``` ```
Fixed Fixed an issue where GTP sessions remained as allocated sessions on the passive firewall even when there were no active sessions.
an issue where GTP sessions remained as allocated sessions on the
passive firewall even when there were no active sessions.
## PAN-255930 ## PAN-255930
Fixed an issue where persistent DIPP NAT entries were deleted even Fixed an issue where persistent DIPP NAT entries were deleted even when being used during an active session.
when being used during an active session.
## PAN-255266 ## PAN-255266
Fixed an issue where you were unable to clone a template stack with Fixed an issue where you were unable to clone a template stack with the Pre-Shared Key variable.
the Pre-Shared Key variable.
## PAN-254826 ## PAN-254826
Fixed an issue where the firewall stopped responding when processing Fixed an issue where the firewall stopped responding when processing traffic.
traffic.
## PAN-254671 ## PAN-254671
Fixed an issue where excessive Timed out while getting Fixed an issue where excessive Timed out while getting config lock error messages were generated when making bulk changes via XML API.
config lock error messages were generated when
making bulk changes via XML API.
## PAN-254423 ## PAN-254423
Fixed an issue on Panorama where custom role-based admin users with Fixed an issue on Panorama where custom role-based admin users with read only access were able to make changes to configurations.
read only access were able to make changes to configurations.
## PAN-253626 ## PAN-253626
Fixed an issue on Panorama where unused objects were pushed to the Fixed an issue on Panorama where unused objects were pushed to the firewall, which caused the push operations to intermittently fail.
firewall, which caused the push operations to intermittently fail.
## PAN-253213 ## PAN-253213
Fixed an issue where the firewall sent HIP notifications every time Fixed an issue where the firewall sent HIP notifications every time it received a HIP report instead of every two hours.
it received a HIP report instead of every two hours.
## PAN-252300 ## PAN-252300
Fixed an issue where you were unable to select device groups in the Fixed an issue where you were unable to select device groups in the push scope for user accounts.
push scope for user accounts.
## PAN-251676 ## PAN-251676
Fixed an issue on Panorama appliances in large-scale deployments Fixed an issue on Panorama appliances in large-scale deployments where configd process core files consumed more space in the /opt/panlogs partition than was available.
where configd process core files consumed more space in
the /opt/panlogs partition than was available.
## PAN-251655 ## PAN-251655
Fixed an issue where the firewall stopped forwarding files to the Fixed an issue where the firewall stopped forwarding files to the WildFire cloud and a restart of the varrcvr process was required.
WildFire cloud and a restart of the varrcvr process was
required.
## PAN-250787 ## PAN-250787
Fixed an issue where network issues between the firewall and the log Fixed an issue where network issues between the firewall and the log collector caused logrcvr process memory exhaustion.
collector caused logrcvr process memory exhaustion.
## PAN-250419 ## PAN-250419
Fixed an issue where XML API explorer inserted a plus (+) character Fixed an issue where XML API explorer inserted a plus (+) character in the Xpath when a space was used in the object name.
in the Xpath when a space was used in the object name.
## PAN-250062 ## PAN-250062
Fixed an issue where device telemetry failed after upgrading due to Fixed an issue where device telemetry failed after upgrading due to bundle generation failure.
bundle generation failure.
## PAN-249266 ## PAN-249266
Fixed an issue where the config process virtual memory Fixed an issue where the config process virtual memory was exceeded due to delays in post-commit processing.
was exceeded due to delays in post-commit processing.
## PAN-249011 ## PAN-249011
Fixed an issue where the firewall became unresponsive when committing Fixed an issue where the firewall became unresponsive when committing a configuration change with a large number of uncommitted changes in the replay database.
a configuration change with a large number of uncommitted changes in
the replay database.
## PAN-247099 ## PAN-247099
Fixed an issue where the firewall decrypted traffic unexpectedly when Fixed an issue where the firewall decrypted traffic unexpectedly when the client hello was spread across multiple packets.
the client hello was spread across multiple packets.
## PAN-246304 ## PAN-246304
Fixed an issue on Panorama where commits failed due to a timeout in Fixed an issue on Panorama where commits failed due to a timeout in the sysd process during decryption.
the sysd process during decryption.
## PAN-246220 ## PAN-246220
Fixed an issue where a dynamic peer connection was rejected when Fixed an issue where a dynamic peer connection was rejected when using an FQDN for the peer address.
using an FQDN for the peer address.
## PAN-244039 ## PAN-244039
@@ -289,55 +214,40 @@ using an FQDN for the peer address.
PA-5450 firewalls only PA-5450 firewalls only
``` ```
Fixed an issue where the firewall Fixed an issue where the firewall dropped packets when attempting to reuse a TCP session.
dropped packets when attempting to reuse a TCP session.
## PAN-243098 ## PAN-243098
Fixed an issue with corrupted images when SSL decryption and Security Fixed an issue with corrupted images when SSL decryption and Security profiles were configured.
profiles were configured.
## PAN-241781 ## PAN-241781
Fixed an issue where partial commit and commit-all operations took Fixed an issue where partial commit and commit-all operations took more time than expected to create the job ID.
more time than expected to create the job ID.
## PAN-241044 ## PAN-241044
Fixed an issue where traffic was denied by the interzone-default Fixed an issue where traffic was denied by the interzone-default policy rule when a Security policy rule with an FQDN destination was configured.
policy rule when a Security policy rule with an FQDN destination was
configured.
## PAN-234560 ## PAN-234560
Fixed an issue where the daily summary report displayed IPv6 Fixed an issue where the daily summary report displayed IPv6 addresses instead of IPv4 addresses.
addresses instead of IPv4 addresses.
## PAN-233727 ## PAN-233727
Fixed an issue on the web interface where the following error message Fixed an issue on the web interface where the following error message was incorrectly displayed for an IKE gateway with a valid configuration: ikev2->pq-ppk->negotiation-mode is invalid.
was incorrectly displayed for an IKE gateway with a valid
configuration: ikev2->pq-ppk->negotiation-mode is
invalid.
## PAN-237582 ## PAN-237582
Fixed an issue where logs were intermittently missing on the log Fixed an issue where logs were intermittently missing on the log collector due to missing aliases for some indices
collector due to missing aliases for some indices
## PAN-234094 ## PAN-234094
Fixed an issue on Panorama where Deploy Master Keyresulted in Fixed an issue on Panorama where **Deploy Master Key**resulted in the error message Failed to communicate with device due to a low connection timeout value.
the error message Failed to communicate with device due to a low
connection timeout value.
## PAN-232214 ## PAN-232214
Fixed an issue where GlobalProtect clients remained in the connecting Fixed an issue where GlobalProtect clients remained in the connecting state during portal pre-login when Kerberos single sign-on (SSO) was enabled.
state during portal pre-login when Kerberos single sign-on (SSO) was
enabled.
## PAN-230825 ## PAN-230825
Fixed an issue where link flaps occurred on Panorama appliances in HA Fixed an issue where link flaps occurred on Panorama appliances in HA configurations.
configurations.
web/data/issues/PAN-OS/addressed/11.1.4-h7.md
+20 -48
View File
@@ -6,18 +6,15 @@ version: 11.1.4-h7
## PAN-272809 ## PAN-272809
A fix was made to address CVE-2024-0012 (PAN-SA-2024-0015) and A fix was made to address [CVE-2024-0012](https://security.paloaltonetworks.com/CVE-2024-0012) ([PAN-SA-2024-0015](https://security.paloaltonetworks.com/PAN-SA-2024-0015)) and [CVE-2024-9474](https://security.paloaltonetworks.com/CVE-2024-9474).
CVE-2024-9474.
## PAN-268823 ## PAN-268823
Fixed an issue where MonitorLog Display did not display all logs when you applied a Fixed an issue where **Monitor** > **Log Display** did not display all logs when you applied a filter.
filter.
## PAN-265785 ## PAN-265785
Fixed an issue where the firewall rebooted due to a sysd Fixed an issue where the firewall rebooted due to a sysd variable being modified before it was created.
variable being modified before it was created.
## PAN-264883 ## PAN-264883
@@ -25,15 +22,11 @@ variable being modified before it was created.
PA-7080 appliances with LPCs only PA-7080 appliances with LPCs only
``` ```
Fixed an issue where Fixed an issue where syslog forwarding over TCP stopped after upgrading.
syslog forwarding over TCP stopped after upgrading.
## PAN-263369 ## PAN-263369
Fixed an issue where commits from Panorama to Panorama virtual Fixed an issue where commits from Panorama to Panorama virtual appliances failed with the error message Internal error during commit processing. Commit/Validate failed after upgrading Panorama.
appliances failed with the error message Internal
error during commit processing. Commit/Validate
failed after upgrading Panorama.
## PAN-261673 ## PAN-261673
@@ -41,10 +34,7 @@ failed after upgrading Panorama.
VM-Series firewalls on Microsoft Azure environments only VM-Series firewalls on Microsoft Azure environments only
``` ```
Fixed an issue where, when Accelerated Networking was enabled, Fixed an issue where, when Accelerated Networking was enabled, traffic was dropped because of the flow_parse_ip_hdr counter related to an Nvidia driver issue.
traffic was dropped because of the
flow_parse_ip_hdr counter related
to an Nvidia driver issue.
## PAN-261371 ## PAN-261371
@@ -52,9 +42,7 @@ to an Nvidia driver issue.
PA-5410 firewalls in active/passive high availability (HA) configurations only PA-5410 firewalls in active/passive high availability (HA) configurations only
``` ```
Fixed an issue where the Fixed an issue where the reportd process restarted, which caused the firewall to reboot.
reportd process restarted, which caused the
firewall to reboot.
## PAN-261209 ## PAN-261209
@@ -62,28 +50,23 @@ firewall to reboot.
Firewalls in active/active HA configuration only Firewalls in active/active HA configuration only
``` ```
Fixed an Fixed an issue where the firewall displayed the HA2 status as down when the HSCI port was used for both HA2 and HA3.
issue where the firewall displayed the HA2 status as down when the
HSCI port was used for both HA2 and HA3.
## PAN-260905 ## PAN-260905
Fixed an issue where the HS: Fiber Port Eth1/2 did not come up on a Fixed an issue where the HS: Fiber Port Eth1/2 did not come up on a cold boot and remained in an incorrect state.
cold boot and remained in an incorrect state.
## PAN-260316 ## PAN-260316
Fixed an issue where the all_task process stopped Fixed an issue where the all_task process stopped responding and the firewall rebooted.
responding and the firewall rebooted.
## PAN-259351 ## PAN-259351
A fix was made to address CVE-2024-3393. A fix was made to address [CVE-2024-3393](https://security.paloaltonetworks.com/CVE-2024-5921).
## PAN-259002 ## PAN-259002
Fixed an issue where frequent external dynamic list updates caused Fixed an issue where frequent external dynamic list updates caused the configd process to restart.
the configd process to restart.
## PAN-257601 ## PAN-257601
@@ -91,43 +74,32 @@ the configd process to restart.
PA-5450 firewalls only PA-5450 firewalls only
``` ```
Fixed an issue where Networking Fixed an issue where Networking Cards (NC) experienced an internal link fault which caused path monitoring failure on the Dataplane Processing Card (DPC).
Cards (NC) experienced an internal link fault which caused path
monitoring failure on the Dataplane Processing Card (DPC).
## PAN-257327 ## PAN-257327
Fixed an issue where a failover event occurred unexpectedly on the Fixed an issue where a failover event occurred unexpectedly on the firewall.
firewall.
## PAN-256223 ## PAN-256223
Fixed an issue where device telemetry log collection filled the root Fixed an issue where device telemetry log collection filled the root partition.
partition.
## PAN-254794 ## PAN-254794
Fixed an issue where the Panorama management server stopped Fixed an issue where the Panorama management server stopped responding.
responding.
## PAN-249384 ## PAN-249384
Fixed an issue on Panorama where configuration locks were observed Fixed an issue on Panorama where configuration locks were observed during a partial rulebase commit.
during a partial rulebase commit.
## PAN-243240 ## PAN-243240
Fixed an issue where the using QoS caused packet buffer utilization Fixed an issue where the using QoS caused packet buffer utilization to increase exponentially and the PKI POOL DFLT pool depleted until a reboot was performed.
to increase exponentially and the PKI POOL
DFLT pool depleted until a reboot was
performed.
## PAN-242479 ## PAN-242479
Fixed an issue where a high number of packets caused high packet Fixed an issue where a high number of packets caused high packet descriptors on the firewall when handling EtherIP traffic.
descriptors on the firewall when handling EtherIP traffic.
## PAN-230893 ## PAN-230893
Added a CLI command to address an issue where system lock files Added a CLI command to address an issue where system lock files blocked authentication.
blocked authentication.
web/data/issues/PAN-OS/addressed/11.1.4-h9.md
+45 -111
View File
@@ -6,24 +6,19 @@ version: 11.1.4-h9
## PAN-273215 ## PAN-273215
Fixed an issue where a syntax error in the index generation script Fixed an issue where a syntax error in the index generation script caused a high management plane CPU load after upgrading.
caused a high management plane CPU load after upgrading.
## PAN-271912 ## PAN-271912
Fixed an issue on Panorama where the *configd* process stopped Fixed an issue on Panorama where the *configd* process stopped responding when filtering in the configuration audit window after upgrading to PAN-OS 11.1.3.
responding when filtering in the configuration audit window after
upgrading to PAN-OS 11.1.3.
## PAN-271613 ## PAN-271613
Fixed an issue where configuration pushes from Panorama to the Fixed an issue where configuration pushes from Panorama to the firewall failed due to an OOXML commit error.
firewall failed due to an OOXML commit error.
## PAN-271314 ## PAN-271314
Fixed an issue where pushing changes to a prefix list used for BGP Fixed an issue where pushing changes to a prefix list used for BGP from Panorama affected OSPF routes.
from Panorama affected OSPF routes.
## PAN-270224 ## PAN-270224
@@ -31,56 +26,43 @@ Fixed an issue where indices were not opened after a query.
## PAN-269956 ## PAN-269956
Fixed an issue where the all_pktproc process stopped Fixed an issue where the all_pktproc process stopped responding, which caused internal path monitor failures.
responding, which caused internal path monitor failures.
## PAN-269899 ## PAN-269899
Fixed an issue where the Panorama web interface was slower than Fixed an issue where the Panorama web interface was slower than expected when querying for device tags.
expected when querying for device tags.
## PAN-269673 ## PAN-269673
Fixed an issue where ElasticSearch was not set up after an Fixed an issue where ElasticSearch was not set up after an upgrade.
upgrade.
## PAN-269000 ## PAN-269000
Fixed an issue where the firewall stopped responding due to a NULL Fixed an issue where the firewall stopped responding due to a NULL pointer dereference when path monitoring failed.
pointer dereference when path monitoring failed.
## PAN-268972 ## PAN-268972
Fixed an issue where Panorama was slower than expected when using a Fixed an issue where Panorama was slower than expected when using a high number of device group tags in a non-shared context.
high number of device group tags in a non-shared context.
## PAN-268501 ## PAN-268501
Fixed an issue where the firewall was unable to generate a TSF file Fixed an issue where the firewall was unable to generate a TSF file due to a full root partition.
due to a full root partition.
## PAN-266639 ## PAN-266639
Fixed an issue where administrators were unable to edit or add Fixed an issue where administrators were unable to edit or add virtual router configurations when a filter was applied to the viewer.
virtual router configurations when a filter was applied to the
viewer.
## PAN-266114 ## PAN-266114
Fixed an issue where, when a new set of URL logs came in, the content Fixed an issue where, when a new set of URL logs came in, the content of the earlier URL and traffic logs were lost.
of the earlier URL and traffic logs were lost.
## PAN-265973 ## PAN-265973
Fixed an issue where administrator sessions were logged out with an Fixed an issue where administrator sessions were logged out with an ERR_CONNECTION_REFUSED error on the browser.
ERR_CONNECTION_REFUSED error on the
browser.
## PAN-265742 ## PAN-265742
Fixed an issue on the Panorama web interface where the Fixed an issue on the Panorama web interface where the **OK** button on the GlobalProtect gateway configuration dialog box was not clickable.
OK button on the GlobalProtect gateway
configuration dialog box was not clickable.
## PAN-265219 ## PAN-265219
@@ -88,19 +70,15 @@ configuration dialog box was not clickable.
VM-Series firewalls only VM-Series firewalls only
``` ```
Fixed an issue where GRE traffic Fixed an issue where GRE traffic did not work properly.
did not work properly.
## PAN-264871 ## PAN-264871
Fixed an issue on Panorama where the configd process Fixed an issue on Panorama where the configd process stopped responding when viewing IP addresses on dynamic address groups with a large number of IP addresses.
stopped responding when viewing IP addresses on dynamic address
groups with a large number of IP addresses.
## PAN-264249 ## PAN-264249
Fixed an issue on the firewall where SNMP queries timed out when Fixed an issue on the firewall where SNMP queries timed out when using SNMP.
using SNMP.
## PAN-263973 ## PAN-263973
@@ -108,9 +86,7 @@ Fixed an issue where log collectors had a low incoming log rate.
## PAN-263287 ## PAN-263287
The PAN-COMMON-MIB.my file was updated to support new object The PAN-COMMON-MIB.my file was updated to support new object identifiers (OID) to poll interface use via SNMP with table identifiers.
identifiers (OID) to poll interface use via SNMP with table
identifiers.
## PAN-263208 ## PAN-263208
@@ -118,59 +94,43 @@ identifiers.
PA-5440 and PA-5445 firewalls only PA-5440 and PA-5445 firewalls only
``` ```
Fixed an issue where Fixed an issue where interrupts were generated at a certain packet rate, and dataplane processes missed heartbeats, which caused the dataplane to go down.
interrupts were generated at a certain packet rate, and dataplane
processes missed heartbeats, which caused the dataplane to go
down.
## PAN-263017 ## PAN-263017
Fixed an issue where the firewall was unable to mount a disk Fixed an issue where the firewall was unable to mount a disk partition due to a corrupted filesystem.
partition due to a corrupted filesystem.
## PAN-261485 ## PAN-261485
Fixed an issue where the firewall dropped the Real Time Transport Fixed an issue where the firewall dropped the Real Time Transport Protocol (RTP) session for the second SIP call on Persistent-DIPP connections when the source port of the client device was reset.
Protocol (RTP) session for the second SIP call on Persistent-DIPP
connections when the source port of the client device was reset.
## PAN-260604 ## PAN-260604
Fixed an issue where the firewall displayed inaccurate throughput Fixed an issue where the firewall displayed inaccurate throughput utilization stats in NetFlow analyzer tools.
utilization stats in NetFlow analyzer tools.
## PAN-260512 ## PAN-260512
Fixed an issue where accessing the IP address of the device address Fixed an issue where accessing the IP address of the device address group objects from the user interface caused the configd process to stop responding.
group objects from the user interface caused the
configd process to stop responding.
## PAN-260461 ## PAN-260461
Fixed an issue where traffic logs showed a non-zero destination port Fixed an issue where traffic logs showed a non-zero destination port number on ICMP echo sessions through the firewall.
number on ICMP echo sessions through the firewall.
## PAN-260417 ## PAN-260417
Fixed an issue on Panorama where Fixed an issue on Panorama where UpdateLicDB was triggered every few minutes when firewalls with PAYG licenses were onboarded.
UpdateLicDB was triggered every few
minutes when firewalls with PAYG licenses were onboarded.
## PAN-260235 ## PAN-260235
Fixed an issue where the firewall sent Threat logs and URL logs to an Fixed an issue where the firewall sent Threat logs and URL logs to an external syslog server without Security profile settings when Enhanced Application Logging was enabled.
external syslog server without Security profile settings when
Enhanced Application Logging was enabled.
## PAN-259910 ## PAN-259910
Fixed an issue where the firewall reported the same value over Fixed an issue where the firewall reported the same value over consecutive SNMP polls when asynchronous mode was enabled.
consecutive SNMP polls when asynchronous mode was enabled.
## PAN-259881 ## PAN-259881
Fixed an issue on Panorama where traffic log details were not Fixed an issue on Panorama where traffic log details were not displayed under **detailed log view**.
displayed under detailed log view.
## PAN-259802 ## PAN-259802
@@ -178,86 +138,63 @@ displayed under detailed log view.
Panorama appliances in high availability (HA) clusters only Panorama appliances in high availability (HA) clusters only
``` ```
Fixed an issue where, after replacing a secondary Fixed an issue where, after replacing a secondary Panorama appliance in a Panorama HA cluster, the ElasticSearch cluster was unable to establish SSL tunnels due to SSLHandshakeException errors.
Panorama appliance in a Panorama HA cluster, the ElasticSearch
cluster was unable to establish SSL tunnels due to
SSLHandshakeException errors.
## PAN-259078 ## PAN-259078
Fixed an issue where WildFire Analysis reports were not generated and Fixed an issue where WildFire Analysis reports were not generated and the following error message was displayed: Error 500: Internal Server Error.
the following error message was displayed: Error 500:
Internal Server Error.
## PAN-258799 ## PAN-258799
Fixed an issue where, when updating a Security Policy Fixed an issue where, when updating a Security Policy **Policy Optimizer**, the web interface stopped responding.
Policy Optimizer, the web interface
stopped responding.
## PAN-257961 ## PAN-257961
Fixed an issue on Panorama where Test Security Policy Fixed an issue on Panorama where **Test Security Policy Match** failed when the **From** or **To** zone fields were populated.
Match failed when the From or
To zone fields were populated.
## PAN-255915 ## PAN-255915
Fixed an issue where a memory leak in the sslmgr process Fixed an issue where a memory leak in the sslmgr process caused the firewall to restart.
caused the firewall to restart.
## PAN-254904 ## PAN-254904
Fixed an issue on Panorama where a core file was generated by Fixed an issue on Panorama where a core file was generated by /usr/local/bin/logd during a restart.
/usr/local/bin/logd during a restart.
## PAN-254577 ## PAN-254577
Fixed an issue where a core file was created on the Log Forwarding Fixed an issue where a core file was created on the Log Forwarding Card (LFC) due to a third-party software issue.
Card (LFC) due to a third-party software issue.
## PAN-253829 ## PAN-253829
Fixed an issue where the CLI command show running Fixed an issue where the CLI command show running security-policy timed out when the Security policy was large.
security-policy timed out when the Security
policy was large.
## PAN-252381 ## PAN-252381
Fixed an issue where the Panorama web interface was slower than Fixed an issue where the Panorama web interface was slower than expected when opening interfaces, virtual routers, and zones in a template or template stack.
expected when opening interfaces, virtual routers, and zones in a
template or template stack.
## PAN-250394 ## PAN-250394
Fixed an issue where a large amount of group data caused Fixed an issue where a large amount of group data caused serialization errors and prevented synchronization.
serialization errors and prevented synchronization.
## PAN-249581 ## PAN-249581
Fixed an issue where stale BGP routes were advertised to peers even Fixed an issue where stale BGP routes were advertised to peers even when they were not present in the local RIB table.
when they were not present in the local RIB table.
## PAN-246699 ## PAN-246699
Fixed an issue on Panorama where the Rule Fixed an issue on Panorama where the **Rule Usage** and **Apps Seen** under Security policy rules stopped incrementing.
Usage and Apps Seen under
Security policy rules stopped incrementing.
## PAN-246567 ## PAN-246567
Fixed an issue where a firewall with a copper SFP transceiver Fixed an issue where a firewall with a copper SFP transceiver (PAN-SFP-CG) flapped during a commit.
(PAN-SFP-CG) flapped during a commit.
## PAN-242331 ## PAN-242331
Fixed an issue where Prisma Access remote network firewalls Fixed an issue where Prisma Access remote network firewalls intermittently created incorrect user-to-IP-address mappings.
intermittently created incorrect user-to-IP-address mappings.
## PAN-241004 ## PAN-241004
Fixed an issue where DNS Proxy dropped client requests of the type Fixed an issue where DNS Proxy dropped client requests of the type ns for a root domain.
ns for a root domain.
## PAN-235808 ## PAN-235808
@@ -265,11 +202,8 @@ ns for a root domain.
Panorama appliances in Log Collector mode only Panorama appliances in Log Collector mode only
``` ```
Fixed an Fixed an issue where an unnamed core file was generated after a reboot.
issue where an unnamed core file was generated after a reboot.
## PAN-233197 ## PAN-233197
Fixed an issue where the CLI command to set the FEC parameter for the Fixed an issue where the CLI command to set the FEC parameter for the front panel ports was not supported on platforms supporting 25G and 100G.
front panel ports was not supported on platforms supporting 25G and
100G.
web/data/issues/PAN-OS/addressed/11.1.4.md
+4 -9
View File
@@ -30,13 +30,11 @@ Fixed an issue where SNMP failed to respond to multiple Object Identifier (OID)
## PAN-251639 ## PAN-251639
Fixed an issue where an out of memory condition might occur due to a Fixed an issue where an out of memory condition might occur due to a memory leak in the varrcvr process when a Wildfire Analysis security profile is enabled.
memory leak in the varrcvr process when a Wildfire
Analysis security profile is enabled.
## PAN-250597 ## PAN-250597
Fixed an issue where Global Find for a Panorama pushed shared address object displayed Others in the results. Fixed an issue where Global Find for a Panorama pushed shared address object displayed **Others** in the results.
## PAN-250270 ## PAN-250270
@@ -44,8 +42,7 @@ Fixed an issue where partial commits did not merge changes when the complete rul
## PAN-249814 ## PAN-249814
Fixed an issue where multiple all_task processes stopped responding, which caused Fixed an issue where multiple all_task processes stopped responding, which caused the dataplane to fail.
the dataplane to fail.
## PAN-249292 ## PAN-249292
@@ -53,9 +50,7 @@ the dataplane to fail.
VM-Series firewalls on Microsoft Azure environments only VM-Series firewalls on Microsoft Azure environments only
``` ```
Fixed an issue where CPU usage was higher than expected after a Fixed an issue where CPU usage was higher than expected after a hotplug event when Accelerated Networking was enabled for the management interface.
hotplug event when Accelerated Networking was enabled for the
management interface.
## PAN-245157 ## PAN-245157
web/data/issues/PAN-OS/addressed/11.1.5-h1.md
+1 -2
View File
@@ -6,5 +6,4 @@ version: 11.1.5-h1
## PAN-272809 ## PAN-272809
A fix was made to address CVE-2024-0012 (PAN-SA-2024-0015) and A fix was made to address [CVE-2024-0012](https://security.paloaltonetworks.com/CVE-2024-0012) ([PAN-SA-2024-0015](https://security.paloaltonetworks.com/PAN-SA-2024-0015)) and [CVE-2024-9474](https://security.paloaltonetworks.com/CVE-2024-9474).
CVE-2024-9474.
web/data/issues/PAN-OS/addressed/11.1.5.md
+68 -108
View File
@@ -6,7 +6,7 @@ version: 11.1.5
## PAN-268823 ## PAN-268823
Fixed an issue where Monitor > Log Display did not display all logs when you applied a filter. Fixed an issue where **Monitor > Log Display** did not display all logs when you applied a filter.
## PAN-265963 ## PAN-265963
@@ -22,7 +22,7 @@ Fixed an issue where you were unable to download PDFs when connected via a Clien
## PAN-265344 ## PAN-265344
Fixed an issue where Import GlobalProtect Client Package did not work after clicking OK after selecting a valid package under Device > GlobalProtect Client > Upload). Fixed an issue where **Import GlobalProtect Client Package** did not work after clicking **OK** after selecting a valid package under **Device > GlobalProtect Client > Upload**).
## PAN-265287 ## PAN-265287
@@ -38,7 +38,7 @@ Fixed an issue where the firewall was unable to validate or commit a configurati
## PAN-264369 ## PAN-264369
Fixed an issue where the 7 Day Threat Report was empty in the scheduled reports sent via email. Fixed an issue where the **7 Day Threat Report** was empty in the scheduled reports sent via email.
## PAN-264249 ## PAN-264249
@@ -54,7 +54,7 @@ Fixed an issue on the firewall where, when a NAT transversal IPSec tunnel was te
PA-440 firewalls only PA-440 firewalls only
``` ```
Fixed an issue where a firewall running PAN-OS 11.1.2-h3 only displayed the Auto option for the interface duplex setting. Fixed an issue where a firewall running PAN-OS 11.1.2-h3 only displayed the **Auto** option for the interface duplex setting.
## PAN-263505 ## PAN-263505
@@ -90,11 +90,11 @@ Fixed an issue where traffic to websites failed on the Google Chrome web browser
## PAN-262415 ## PAN-262415
Fixed an issue where a partial configuration load failed for configuration files that contained regenerate-hostkeys. Fixed an issue where a partial configuration load failed for configuration files that contained **regenerate-hostkeys**.
## PAN-262410 ## PAN-262410
Fixed an issue where the App Scope graph did not display for all days when selecting Last 60 days or Last 90 days. Fixed an issue where the **App Scope** graph did not display for all days when selecting **Last 60 days** or **Last 90 days**.
## PAN-262340 ## PAN-262340
@@ -170,7 +170,7 @@ Fixed an issue where the firewall did not autocommit after a reboot when the cel
## PAN-261019 ## PAN-261019
Fixed an issue where Evasive Empire C2 Traffic Detection generated benign verdicts and max latency timeout logs simultaneously when the MICA ATP action was configured as reset-both. Fixed an issue where Evasive Empire C2 Traffic Detection generated benign verdicts and max latency timeout logs simultaneously when the MICA ATP action was configured as **reset-both**.
## PAN-260974 ## PAN-260974
@@ -214,7 +214,7 @@ Fixed an issue where BGP Aggregate Advertise filters did not work as expected wh
## PAN-260193 ## PAN-260193
Fixed an issue where GlobalProtect on macOS clients did not connect when using a client certificate and the X.509 policy was set to Use System Default. Fixed an issue where GlobalProtect on macOS clients did not connect when using a client certificate and the X.509 policy was set to **Use System Default**.
## PAN-260132 ## PAN-260132
@@ -234,7 +234,7 @@ Fixed an issue where the firewalls behind an Amazon Web Services (AWS) Gateway L
## PAN-259881 ## PAN-259881
Fixed an issue on Panorama where traffic log details were not displayed under detailed log view. Fixed an issue on Panorama where traffic log details were not displayed under **detailed log view**.
## PAN-259802 ## PAN-259802
@@ -258,21 +258,19 @@ Fixed an issue where the firewall failed to boot up after running power cycle te
## PAN-259370 ## PAN-259370
Fixed an issue on the web interface where Correlation Log Detail > Match Evidence did not populate. Fixed an issue on the web interface where **Correlation Log Detail > Match Evidence** did not populate.
## PAN-259351 ## PAN-259351
A fix was made to address CVE-2024-3393. A fix was made to address [CVE-2024-3393](https://security.paloaltonetworks.com/CVE-2024-5921).
## PAN-259344 ## PAN-259344
Fixed an issue where performing a configuration commit on a firewall locally or from Panorama Fixed an issue where performing a configuration commit on a firewall locally or from Panorama caused a memory leak related to the configd process and resulted in an OOM condition.
caused a memory leak related to the configd process and
resulted in an OOM condition.
## PAN-259200 ## PAN-259200
Fixed an issue where the firewall displayed truncated zone names in the Block IP List log when a zone name contained more than 14 characters. Fixed an issue where the firewall displayed truncated zone names in the **Block IP List** log when a zone name contained more than 14 characters.
## PAN-259151 ## PAN-259151
@@ -316,7 +314,7 @@ Fixed an issue on the Panorama web interface where Security policy rules loaded
## PAN-258188 ## PAN-258188
Fixed an issue on Panorama Template where the virtual wire subinterface page did not display all fields and the OK button did not work. Fixed an issue on Panorama Template where the virtual wire subinterface page did not display all fields and the **OK** button did not work.
## PAN-258166 ## PAN-258166
@@ -328,7 +326,7 @@ Fixed an issue where the root partition frequently reached 100%.
## PAN-257961 ## PAN-257961
Fixed an issue on Panorama where Test Security Policy Match failed when the From or To zone fields were populated. Fixed an issue on Panorama where **Test Security Policy Match** failed when the **From** or **To** zone fields were populated.
## PAN-257957 ## PAN-257957
@@ -372,7 +370,7 @@ Fixed an issue where the firewall web interface was blank after logging in.
## PAN-257619 ## PAN-257619
Fixed an issue on Panorama where the Task Manager took longer than expected to display managed FW report tasks details when its empty Fixed an issue on Panorama where the **Task Manager** took longer than expected to display managed FW report tasks details when its empty
## PAN-257601 ## PAN-257601
@@ -428,7 +426,7 @@ Fixed an issue where firewalls entered a non-functional state and displayed the
## PAN-257021 ## PAN-257021
"Fixed an issue on the web interface where Match Evidence log details for Monitor > Correlated events did not populate." "Fixed an issue on the web interface where **Match Evidence** log details for **Monitor > Correlated events** did not populate."
## PAN-256960 ## PAN-256960
@@ -448,7 +446,7 @@ Fixed an issue where BGP routes from the active firewall were lost when the pass
## PAN-256725 ## PAN-256725
Fixed an issue on the Panorama interface where Traffic and Unified event details loaded more slowly than expected. Fixed an issue on the Panorama interface where **Traffic** and **Unified** event details loaded more slowly than expected.
## PAN-256669 ## PAN-256669
@@ -456,7 +454,7 @@ Fixed an issue where the memory usage reported by SNMP did not match the memory
## PAN-256666 ## PAN-256666
Fixed an issue where the configd process stopped responding when Commit and Push operations were performed on multiple device groups. Fixed an issue where the configd process stopped responding when **Commit and Push** operations were performed on multiple device groups.
## PAN-256652 ## PAN-256652
@@ -496,7 +494,7 @@ Fixed an issue where the logd process repeatedly restarted due to a buffer overf
## PAN-256249 ## PAN-256249
Fixed an issue on the web interface that occurred when changing the pre-shared key to a variable (Network > Network Profiles > IKE Gateways). Fixed an issue on the web interface that occurred when changing the pre-shared key to a variable (**Network > Network Profiles > IKE Gateways**).
## PAN-256223 ## PAN-256223
@@ -504,7 +502,7 @@ Fixed an issue where device telemetry log collection filled the root partition.
## PAN-256115 ## PAN-256115
Fixed an issue where, after replacing a Panorama appliance or log collector, the secondary Panorama appliance or log collector displayed a disconnected status for the inter-log collector connection. Fixed an issue where, after replacing a Panorama appliance or log collector, the secondary Panorama appliance or log collector displayed a **disconnected** status for the inter-log collector connection.
## PAN-256051 ## PAN-256051
@@ -516,7 +514,7 @@ Fixed an issue where persistent DIPP NAT entries were deleted even when being us
## PAN-255895 ## PAN-255895
Fixed an issue where Panorama administrators with the Panorama Administrator dynamic administrator type were not able to create or modify BGP timer profiles or BGP dampening profiles. Fixed an issue where Panorama administrators with the **Panorama Administrator** dynamic administrator type were not able to create or modify BGP timer profiles or BGP dampening profiles.
## PAN-255820 ## PAN-255820
@@ -524,11 +522,11 @@ Fixed an issue where the WildFire signature generation check box in Panorama did
## PAN-255773 ## PAN-255773
Fixed an issue where errors related to applications in Content-preview caused commit failures. Fixed an issue where errors related to applications in **Content-preview** caused commit failures.
## PAN-255711 ## PAN-255711
Fixed an issue where the firewall displayed a malformed request error when selecting a custom format and clicking OK on the configuration window due to the log type Correlation incorrectly being displayed (Device > Log Setting - Correlation > Syslog Server Profile > Custom Log Format > Correlation). Fixed an issue where the firewall displayed a malformed request error when selecting a custom format and clicking **OK** on the configuration window due to the log type **Correlation** incorrectly being displayed (**Device > Log Setting - Correlation > Syslog Server Profile > Custom Log Format > Correlation**).
## PAN-255660 ## PAN-255660
@@ -544,8 +542,7 @@ Fixed an issue where the path monitor displayed as up even when routes to the de
PA-7500 Series firewalls and Panorama appliances only PA-7500 Series firewalls and Panorama appliances only
``` ```
Fixed an issue where dataplane logs were displayed after a Fixed an issue where dataplane logs were displayed after a delay.
delay.
## PAN-255396 ## PAN-255396
@@ -561,9 +558,7 @@ Fixed an issue where the firewall booted into maintenance mode when there was no
## PAN-255285 ## PAN-255285
Fixed an issue where, when only the HSCI-A link was connected on Fixed an issue where, when only the HSCI-A link was connected on firewall cluster nodes, and the management interface went down, a split brain condition occurred.
firewall cluster nodes, and the management interface went down, a
split brain condition occurred.
## PAN-255282 ## PAN-255282
@@ -587,9 +582,7 @@ Fixed an issue where the system database key that stored the configuration statu
## PAN-255116 ## PAN-255116
Fixed an issue where, when QoS was enabled, traffic on an NGFW Fixed an issue where, when QoS was enabled, traffic on an NGFW cluster node that went from an MC-LAG interface to a destination stopped when a member of the MC-LAG went down.
cluster node that went from an MC-LAG interface to a destination
stopped when a member of the MC-LAG went down.
## PAN-254901 ## PAN-254901
@@ -605,9 +598,7 @@ Fixed an issue where the firewall rebooted unexpectedly due to multiple all_task
## PAN-254827 ## PAN-254827
Fixed an issue where, when you changed an IP address on a management Fixed an issue where, when you changed an IP address on a management interface on an NGFW cluster node, commit-all operations did not push the updated IP address.
interface on an NGFW cluster node, commit-all operations did not
push the updated IP address.
## PAN-254826 ## PAN-254826
@@ -651,9 +642,7 @@ Fixed an issue where the firewall required a restart when an SD-WAN policy rule
## PAN-254351 ## PAN-254351
Fixed an issue where an NGFW cluster node remained in a suspended Fixed an issue where an NGFW cluster node remained in a suspended state when GRE tunnel termination was used with keepalive enabled on both ends.
state when GRE tunnel termination was used with keepalive enabled on
both ends.
## PAN-254301 ## PAN-254301
@@ -685,7 +674,7 @@ Fixed an issue where the CLI command show running security-policy timed out when
## PAN-253819 ## PAN-253819
Fixed an issue where a User Activity Report was not generated by Run Now or not emailed through the Email Schedule when the locale setting was not English. Fixed an issue where a **User Activity Report** was not generated by **Run Now** or not emailed through the **Email Schedule** when the locale setting was not English.
## PAN-253626 ## PAN-253626
@@ -697,9 +686,7 @@ Fixed an issue where ikemgr process unexpectedly stopped due to a memory mapping
## PAN-253557 ## PAN-253557
Fixed an issue where, after a cluster manager restart on the leader Fixed an issue where, after a cluster manager restart on the leader node of an NGFW cluster, traffic stopped due to only the state machine transitioning to unknown and not the leader.
node of an NGFW cluster, traffic stopped due to only the state
machine transitioning to unknown and not the leader.
## PAN-253452 ## PAN-253452
@@ -707,9 +694,7 @@ Fixed an issue where GlobalProtect users were unable to connect to the GlobalPro
## PAN-253466 ## PAN-253466
Fixed an issue where, on NFGW cluster nodes, an expected packet Fixed an issue where, on NFGW cluster nodes, an expected packet buffer leak occurred with FTP/SIP traffic over an extended period of time.
buffer leak occurred with FTP/SIP traffic over an extended period of
time.
## PAN-253250 ## PAN-253250
@@ -737,7 +722,7 @@ Fixed an issue where multiple SSHD process restarts triggered a firewall reboot
## PAN-252801 ## PAN-252801
Fixed an issue where the LSVPN tunnel monitoring status displayed as No data available after re-key events. Fixed an issue where the LSVPN tunnel monitoring status displayed as **No data available** after re-key events.
## PAN-252411 ## PAN-252411
@@ -745,7 +730,7 @@ Fixed an issue where, when log files were purged from the rollup summary logs, t
## PAN-252370 ## PAN-252370
Fixed an issue where services with the reserved keyword application-default were allowed. Fixed an issue where services with the reserved keyword **application-default** were allowed.
## PAN-252270 ## PAN-252270
@@ -801,8 +786,7 @@ Fixed an issue where enabling lockless QoS caused traffic disruptions.
## PAN-251501 ## PAN-251501
Fixed an issue where, after a reboot, NGFW cluster nodes failed to Fixed an issue where, after a reboot, NGFW cluster nodes failed to rejoin a cluster due to a timing issue.
rejoin a cluster due to a timing issue.
## PAN-251372 ## PAN-251372
@@ -822,12 +806,11 @@ Fixed an issue where, when creating a Security policy rule via the CLI, validati
## PAN-250756 ## PAN-250756
Fixed an issue where querying threat logs using the threat name, such as Fixed an issue where querying threat logs using the threat name, such as generic:<site> did not work.
generic:<site> did not work.
## PAN-250716 ## PAN-250716
Fixed an issue where Panorama > Push to Devices displayed device group and template entries that had been changed by other administrators. Fixed an issue where **Panorama > Push to Devices** displayed device group and template entries that had been changed by other administrators.
## PAN-250703 ## PAN-250703
@@ -883,7 +866,7 @@ Fixed an issue on the web interface where templates incorrectly showed that tele
## PAN-250127 ## PAN-250127
Fixed an issue where commits failed with the error message set is not allowed when default originate was enabled with a route map that included a set action. Fixed an issue where commits failed with the error message set is not allowed when **default originate** was enabled with a route map that included a set action.
## PAN-250062 ## PAN-250062
@@ -891,13 +874,11 @@ Fixed an issue where device telemetry failed after upgrading due to bundle gener
## PAN-250043 ## PAN-250043
Fixed an issue where, on an NGFW cluster node, operations failed when Fixed an issue where, on an NGFW cluster node, operations failed when QoS interfaces were configured with an egress max that exceeded 68,000 Mbps.
QoS interfaces were configured with an egress max that exceeded
68,000 Mbps.
## PAN-250021 ## PAN-250021
Fixed an issue where Change Summary and Preview Changes displayed inconsistent information when changing an admin user password. Fixed an issue where **Change Summary** and **Preview Changes** displayed inconsistent information when changing an admin user password.
## PAN-250005 ## PAN-250005
@@ -909,10 +890,7 @@ Fixed an issue where the firewall dropped the active source of the Multicast sou
## PAN-249727 ## PAN-249727
Fixed an issue where, on an NGFW cluster node, the Fixed an issue where, on an NGFW cluster node, the **Custom/Pre-defined** URL category was not in the session flow data, which caused it to be excluded from the promoted session after a failover.
Custom/Pre-defined URL category was not
in the session flow data, which caused it to be excluded from the
promoted session after a failover.
## PAN-249548 ## PAN-249548
@@ -920,7 +898,7 @@ Fixed an issue where the firewall stopped responding during a high availability
## PAN-249533 ## PAN-249533
Fixed an issue where an internal error message was displayed when you selected Exclude video traffic from the tunnel (Windows and macOS only). Fixed an issue where an internal error message was displayed when you selected **Exclude video traffic from the tunnel (Windows and macOS only)**.
## PAN-249404 ## PAN-249404
@@ -936,17 +914,15 @@ Fixed an issue where SaaS quality profile probes were dropped on the SD-WAN hub.
## PAN-249132 ## PAN-249132
Fixed an issue on Panorama DG where the address group object created with Disable Override property in Parent DG was overridden by child DG via CLI. Fixed an issue on Panorama DG where the address group object created with **Disable Override** property in Parent DG was overridden by child DG via CLI.
## PAN-249072 ## PAN-249072
Fixed an issue where content upgrade installation failed with the error Error: Fixed an issue where content upgrade installation failed with the error Error: can't find cert <cert> when using cloud interfaces.
can't find cert <cert> when using cloud
interfaces.
## PAN-248945 ## PAN-248945
Fixed an issue where commits failed when you committed a configuration to advertise the default route (0.0.0.0/0) as a BGP network statement (Advanced Routing > BGP settings). Fixed an issue where commits failed when you committed a configuration to advertise the default route (0.0.0.0/0) as a BGP network statement (**Advanced Routing > BGP settings**).
## PAN-248841 ## PAN-248841
@@ -954,9 +930,7 @@ Fixed an issue where the SSL response time was not displayed in the GlobalProtec
## PAN-248762 ## PAN-248762
Fixed an issue where, when the Advanced Routing Engine was configured Fixed an issue where, when the Advanced Routing Engine was configured with OSPF, the firewall stopped responding when attempting to connect to the neighbor while exchanging route maps.
with OSPF, the firewall stopped responding when attempting to
connect to the neighbor while exchanging route maps.
## PAN-248618 ## PAN-248618
@@ -988,7 +962,7 @@ Fixed an issue on the firewall where a dataplane process restarted when updating
## PAN-247754 ## PAN-247754
Fixed an issue where successful Commit and Push operations performed by SAML authenticated users were not reflected on the firewall. Fixed an issue where successful **Commit and Push** operations performed by SAML authenticated users were not reflected on the firewall.
## PAN-247230 ## PAN-247230
@@ -1044,7 +1018,7 @@ Fixed an issue where the firewall displayed a message that the license was inval
## PAN-245682 ## PAN-245682
Fixed an issue on Panorama where Commit and Push progress displayed over 100%. Fixed an issue on Panorama where **Commit and Push** progress displayed over 100%.
## PAN-245545 ## PAN-245545
@@ -1064,8 +1038,7 @@ Fixed an issue where the GlobalProtect VPN connection inactivity TTL value becam
## PAN-244262 ## PAN-244262
Fixed an issue where interface settings were not saved when the template was overridden in the Fixed an issue where interface settings were not saved when the template was overridden in the candidate configuration while enabling DNS settings.
candidate configuration while enabling DNS settings.
## PAN-244035 ## PAN-244035
@@ -1093,7 +1066,7 @@ Fixed an issue where custom object import for spyware got stuck on uploading pag
## PAN-243816 ## PAN-243816
Fixed an issue where new users were unable to change their password during the first login when the Max session count was set to 1 and Require Password Change on First Login was enabled. Fixed an issue where new users were unable to change their password during the first login when the **Max session count** was set to 1 and **Require Password Change on First Login** was enabled.
## PAN-243787 ## PAN-243787
@@ -1133,7 +1106,7 @@ Fixed an issue with corrupted images when SSL decryption and Security profiles w
## PAN-242960 ## PAN-242960
Fixed an issue where the firewall did not honor the peer Desired Minimum Tx Interval when in a BFD INIT state. Fixed an issue where the firewall did not honor the peer **Desired Minimum Tx Interval** when in a BFD INIT state.
## PAN-242958 ## PAN-242958
@@ -1141,7 +1114,7 @@ Fixed an issue where the firewall intermittently logged connect-agent-failure me
## PAN-242957 ## PAN-242957
Fixed an issue where the Rule usage columns of overridden default policy rules on the Security policy page stopped responding. Fixed an issue where the **Rule usage** columns of overridden default policy rules on the Security policy page stopped responding.
## PAN-242826 ## PAN-242826
@@ -1165,7 +1138,7 @@ Fixed an issue where Prisma Access remote network firewalls intermittently creat
## PAN-242130 ## PAN-242130
Fixed an issue where the firewall displayed the speed and duplex of its dataplane interfaces as Unknown even though the link was up. Fixed an issue where the firewall displayed the speed and duplex of its dataplane interfaces as **Unknown** even though the link was up.
## PAN-241871 ## PAN-241871
@@ -1173,7 +1146,7 @@ Fixed an issue where the firewall was unable to create new IPSec tunnels when th
## PAN-241821 ## PAN-241821
Fixed an issue where Global Search did not show results past the second level. Fixed an issue where **Global Search** did not show results past the second level.
## PAN-241781 ## PAN-241781
@@ -1185,11 +1158,11 @@ Fixed an issue where, when TLSv1.3 was used, an incorrect error message invalid
## PAN-241655 ## PAN-241655
Fixed an issue where the firewall incorrectly categorized URLs as phishing due to machine learning analysis MLAV incorrectly marking the URLs as malicious. Fixed an issue where the firewall incorrectly categorized URLs as **phishing** due to machine learning analysis MLAV incorrectly marking the URLs as malicious.
## PAN-241536 ## PAN-241536
Fixed an issue on Panorama where admin users with the Custom Panorama Admin role were unable to add, edit, or delete route filters under Routing Profiles Fixed an issue on Panorama where admin users with the Custom Panorama Admin role were unable to add, edit, or delete route filters under **Routing Profiles**
## PAN-241519 ## PAN-241519
@@ -1245,10 +1218,7 @@ Fixed an issue where the CLI command debug user-id dump hip-based-profile-databa
## PAN-239201 ## PAN-239201
Fixed an issue where partial commit or partial validation operations failed for non-super user Fixed an issue where partial commit or partial validation operations failed for non-super user administrators with the error <device-group-name> is invalid. meta data not found for dg <device-group-name>.
administrators with the error <device-group-name>
is invalid. meta data not found for dg
<device-group-name>.
## PAN-239165 ## PAN-239165
@@ -1256,7 +1226,7 @@ Fixed an issue where adding an interface in a route filter resulted in an OSPF L
## PAN-239143 ## PAN-239143
Fixed an issue with accessing websites when URL filtering profiles were configured with the block-continue action and the server used HTTP/2. Fixed an issue with accessing websites when URL filtering profiles were configured with the **block-continue** action and the server used HTTP/2.
## PAN-239138 ## PAN-239138
@@ -1308,7 +1278,7 @@ Fixed an issue where, when you committed the first configuration change after bo
## PAN-236830 ## PAN-236830
Fixed an issue where traffic that was correctly detected on the firewall as the threat category DNS was detected on Panorama as the threat category N/A. Fixed an issue where traffic that was correctly detected on the firewall as the threat category **DNS** was detected on Panorama as the threat category **N/A**.
## PAN-236574 ## PAN-236574
@@ -1336,7 +1306,7 @@ Fixed an issue where an unnamed core file was generated after a reboot.
## PAN-235529 ## PAN-235529
Fixed an issue where the Active Directory IP-address-to-user mappings were not updated on Mappings & Tags on the Cloud Identity Engine. Fixed an issue where the Active Directory IP-address-to-user mappings were not updated on **Mappings & Tags** on the Cloud Identity Engine.
## PAN-235110 ## PAN-235110
@@ -1348,8 +1318,7 @@ Fixed an issue where the web interface did not load after an upgrade.
## PAN-234461 ## PAN-234461
Fixed an issue where excess distributord process memory use caused processes to Fixed an issue where excess distributord process memory use caused processes to restart due to OOM conditions.
restart due to OOM conditions.
## PAN-234272 ## PAN-234272
@@ -1377,7 +1346,7 @@ Fixed an issue where the following error message displayed for IoT trial license
## PAN-232792 ## PAN-232792
Fixed an issue on the Panorama where the web interface did not display the Scheduled Config Push page. Fixed an issue on the Panorama where the web interface did not display the **Scheduled Config Push** page.
## PAN-232594 ## PAN-232594
@@ -1401,15 +1370,11 @@ Fixed an issue where multiple processes stopped responding due to a traffic outa
## PAN-231065 ## PAN-231065
Fixed an issue on Panorama where the CLI command show applications list Fixed an issue on Panorama where the CLI command show applications list <Application-group/application filters> device-group <name of device-group> returned incomplete result.
<Application-group/application filters> device-group <name
of device-group> returned incomplete result.
## PAN-230934 ## PAN-230934
Fixed an issue where HTTP/S, SSH, and PING were enabled on the AUX port by default even when Fixed an issue where HTTP/S, SSH, and PING were enabled on the AUX port by default even when these administrative management services were not enabled on the interface.
these administrative management services were not enabled on the
interface.
## PAN-230902 ## PAN-230902
@@ -1429,8 +1394,7 @@ Fixed an issue where GlobalProtect logs returned no data when using the filter (
## PAN-227978 ## PAN-227978
Fixed an issue where the web interface did not accurately list the Fixed an issue where the web interface did not accurately list the status of the port when NGFW clustering was enabled.
status of the port when NGFW clustering was enabled.
## PAN-226789 ## PAN-226789
@@ -1450,7 +1414,7 @@ Fixed an issue where the ConfigPushScheduler REST API failed when the target dev
## PAN-226125 ## PAN-226125
Fixed an issue where the Management Interface Telnet Service was disabled but the service was still allowed. Fixed an issue where the **Management Interface Telnet Service** was disabled but the service was still allowed.
## PAN-225806 ## PAN-225806
@@ -1458,7 +1422,7 @@ Fixed an issue where LACP packets did not reach the dataplane, which caused the
## PAN-225228 ## PAN-225228
Fixed an issue where filtering threat logs using any value under THREAT ID/NAME displayed the error Invalid term. Fixed an issue where filtering threat logs using any value under **THREAT ID/NAME** displayed the error **Invalid term**.
## PAN-224729 ## PAN-224729
@@ -1506,11 +1470,7 @@ Fixed an issue where the management server access log file did not rotate, which
## PAN-164885 ## PAN-164885
Fixed an issue on Panorama where Commit and Fixed an issue on Panorama where **Commit and Push** or **Push to Devices** operations failed when an external dynamic list was configured to check for updates every 5 minutes due to the commit and external dynamic fetch processes overlapping.
Push or Push to Devices
operations failed when an external dynamic list was configured to
check for updates every 5 minutes due to the commit and external
dynamic fetch processes overlapping.
## PAN-76904 ## PAN-76904
web/data/issues/PAN-OS/addressed/11.1.6-h1.md
+6 -6
View File
@@ -14,11 +14,11 @@ Fixed an issue where a session lost the PBF rule mapping after a configuration c
## PAN-273994 ## PAN-273994
A fix was made to address CVE-2025-0111. A fix was made to address [CVE-2025-0111](https://security.paloaltonetworks.com/CVE-2025-0111).
## PAN-273971 ## PAN-273971
A fix was made to address CVE-2025-0108. A fix was made to address [CVE-2025-0108](https://security.paloaltonetworks.com/CVE-2025-0108).
## PAN-273300 ## PAN-273300
@@ -26,7 +26,7 @@ Fixed an issue on Panorama where upgrading to PAN-OS 11.0.4-h2 failed with a val
## PAN-273278 ## PAN-273278
A fix was made to address CVE-2025-0109. A fix was made to address [CVE-2025-0109](https://security.paloaltonetworks.com/CVE-2025-0109).
## PAN-273245 ## PAN-273245
@@ -38,7 +38,7 @@ Fixed an issue where upgrading an HA firewall pair from PAN-OS 10.2.11-h1 to PAN
## PAN-273129 ## PAN-273129
Fixed an issue on the web interface where the negate option was visible when you clicked on the rule name, but not when you viewed the target options from the rulebase attribute. Fixed an issue on the web interface where the **negate** option was visible when you clicked on the rule name, but not when you viewed the target options from the **rulebase** attribute.
## PAN-273085 ## PAN-273085
@@ -142,7 +142,7 @@ Fixed an issue with firewalls in active/passive HA configurations where the the
## PAN-267781 ## PAN-267781
Fixed an issue where Panorama did not display the Source Dynamic Address Group. Fixed an issue where Panorama did not display the **Source Dynamic Address Group**.
## PAN-267762 ## PAN-267762
@@ -258,7 +258,7 @@ Fixed an issue where the firewall did not perform MSS clamping when GWLB endpoin
## PAN-246699 ## PAN-246699
Fixed an issue on Panorama where Rule Usage and Apps Seen under Security policy rules stopped incrementing. Fixed an issue on Panorama where **Rule Usage** and **Apps Seen** under Security policy rules stopped incrementing.
## PAN-233647 ## PAN-233647
web/data/issues/PAN-OS/addressed/11.1.6-h10.md
+6 -6
View File
@@ -26,7 +26,7 @@ Fixed an issue where, after an upgrade, the SNMP polled values for IF-MIB::ifInE
Firewalls in HA configurations only Firewalls in HA configurations only
``` ```
Fixed an issue where, after an upgrade, the mac receive error counter in receive incoming errors increased, which resulted in SNMP alerts. Fixed an issue where, after an upgrade, the **mac receive error** counter in **receive incoming errors** increased, which resulted in SNMP alerts.
## PAN-283467 ## PAN-283467
@@ -82,7 +82,7 @@ Fixed an issue where the firewall redirected the user to the first application i
Firewalls with DPDK enabled in Azure, GCP, AWS, and KVM environments only Firewalls with DPDK enabled in Azure, GCP, AWS, and KVM environments only
``` ```
Fixed an issue where, after an upgrade to PAN-OS 11.1.4, the mac receive error counter increased without an error even though traffic was not impacted. Fixed an issue where, after an upgrade to PAN-OS 11.1.4, the **mac receive error**counter increased without an error even though traffic was not impacted.
## PAN-264982 ## PAN-264982
@@ -102,7 +102,7 @@ Fixed an issue where the show auth radius-require-msg-authentic command CLI disp
## PAN-254524 ## PAN-254524
Fixed an issue on Panorama where, when the Commit and Push button was clicked during a selective Commit and Push operation, the window stopped responding, which caused the operation to be delayed. Fixed an issue on Panorama where, when the **Commit and Push** button was clicked during a selective **Commit and Push** operation, the window stopped responding, which caused the operation to be delayed.
## PAN-284116 ## PAN-284116
@@ -154,7 +154,7 @@ Fixed an issue where the root partition reached 100% which caused the system to
## PAN-273422 ## PAN-273422
Fixed an issue where traffic failed when Inline cloud analysis (Advanced Threat Prevention) was enabled in the Anti-Spyware profile with the action set to anything other than allow or alert and the maximum latency condition was reached. Fixed an issue where traffic failed when Inline cloud analysis (Advanced Threat Prevention) was enabled in the Anti-Spyware profile with the action set to anything other than **allow** or **alert** and the maximum latency condition was reached.
## PAN-272812 ## PAN-272812
@@ -226,7 +226,7 @@ Fixed an issue where HA path monitoring using VWire did not work as expected aft
## PAN-257442 ## PAN-257442
A fix was made to address CVE-2025-0123. A fix was made to address [CVE-2025-0123](https://security.paloaltonetworks.com/CVE-2025-0123).
## PAN-245064 ## PAN-245064
@@ -234,4 +234,4 @@ A fix was made to address CVE-2025-0123.
Multi-vsys firewalls only Multi-vsys firewalls only
``` ```
Fixed an issue where commits failed on the firewall after selecting Export or push device config bundle on Panorama and a force push was required. Fixed an issue where commits failed on the firewall after selecting **Export or push device config bundle** on Panorama and a force push was required.
web/data/issues/PAN-OS/addressed/11.1.6-h14.md
+6 -6
View File
@@ -50,7 +50,7 @@ Fixed an issue where sessions timed out sooner than expected due to the pan_prox
## PAN-287734 ## PAN-287734
Fixed an issue where Scan ERR: Internal Err 1002 messages were unexpectedly generated when WIF shared memory use was high. Fixed an issue where **Scan ERR: Internal Err 1002** messages were unexpectedly generated when WIF shared memory use was high.
## PAN-287621 ## PAN-287621
@@ -66,7 +66,7 @@ Fixed an issue where a large number of logs caused the logrcvr process to stop r
## PAN-287002 ## PAN-287002
A fix was made to address CVE-2025-0133. A fix was made to address [CVE-2025-0133](https://security.paloaltonetworks.com/CVE-2025-0133).
## PAN-286857 ## PAN-286857
@@ -122,7 +122,7 @@ Fixed an issue where the configd process intermittently restarted, which caused
## PAN-283331 ## PAN-283331
Fixed an issue where selective pushes to managed devices failed when the User ID Master Device was configured. Fixed an issue where selective pushes to managed devices failed when the **User ID Master Device** was configured.
## PAN-282359 ## PAN-282359
@@ -172,7 +172,7 @@ Fixed an issue where the firewall removed the Authentication Key Identifier (AKI
## PAN-277751 ## PAN-277751
Fixed an issue where a policy-based forwarding (PBF) rule with an action of no-pbf and a service of TCP-22 did not match traffic after upgrading to PAN-OS 11.1.5-h1. As a result, traffic was matched by a lower rule with a service of any and an action of forward. Fixed an issue where a policy-based forwarding (PBF) rule with an action of **no-pbf** and a service of TCP-22 did not match traffic after upgrading to PAN-OS 11.1.5-h1. As a result, traffic was matched by a lower rule with a service of **any** and an action of **forward**.
## PAN-276920 ## PAN-276920
@@ -230,7 +230,7 @@ Fixed an issue where the firewall was unable to decrypt SSL traffic when using f
## PAN-271215 ## PAN-271215
A fix was made to address CVE-2025-4230. A fix was made to address [CVE-2025-4230](https://security.paloaltonetworks.com/CVE-2025-4230).
## PAN-269700 ## PAN-269700
@@ -278,7 +278,7 @@ Fixed an issue on the firewall where ICMP ping loss occurred after installing a
## PAN-265549 ## PAN-265549
A fix was made to address CVE-2025-0137. A fix was made to address [CVE-2025-0137](https://security.paloaltonetworks.com/CVE-2025-0137).
## PAN-265014 ## PAN-265014
web/data/issues/PAN-OS/addressed/11.1.6-h17.md
+12 -12
View File
@@ -30,7 +30,7 @@ Fixed an issue where the logrcvr process stopped responding due to memory alloca
## PAN-294488 ## PAN-294488
Fixed an issue where certificate data was missing in decryption logs for No decrypt policy rules and TLS1.2 traffic after upgrading, and the Subject Common Name, Issuer Common Name, Certificate Start Date, Certificate End Date, Certificate Serial Number, and Certificate Fingerprint fields were blank in the decryption logs. Fixed an issue where certificate data was missing in decryption logs for **No decrypt** policy rules and TLS1.2 traffic after upgrading, and the **Subject Common Name**, **Issuer Common Name**, **Certificate Start Date**, **Certificate End Date**, **Certificate Serial Number**, and **Certificate Fingerprint** fields were blank in the decryption logs.
## PAN-294436 ## PAN-294436
@@ -42,7 +42,7 @@ Fixed an issue on Panorama where commit versions did not display correct data in
## PAN-293985 ## PAN-293985
Fixed an issue with the Panorama web interface where admin users were unable to log in and received the error message 504: Gateway Timeout. Fixed an issue with the Panorama web interface where admin users were unable to log in and received the error message **504: Gateway Timeout**.
## PAN-293877 ## PAN-293877
@@ -168,7 +168,7 @@ Fixed an issue where the comm process stopped responding due to missing heartbea
## PAN-287688 ## PAN-287688
Fixed an issue where the firewall failed to connect to the Palo Alto Networks update server when using a customized service route with the source interface as MGT. Fixed an issue where the firewall failed to connect to the Palo Alto Networks update server when using a customized service route with the source interface as **MGT**.
## PAN-287601 ## PAN-287601
@@ -192,11 +192,11 @@ Fixed an issue where the firewall double-freed shared memory when the shared mem
## PAN-286475 ## PAN-286475
Fixed an issue where the option to sort sequence numbers was missing from Filters prefix list in the advanced routing filters. Fixed an issue where the option to sort sequence numbers was missing from **Filters prefix list** in the advanced routing filters.
## PAN-286299 ## PAN-286299
Fixed an issue on firewalls running PAN-OS 11.1 releases where, after being offboarded from Panorama, the firewall XML configuration file retained template information from the previous Panorama configuration. As a result, when the firewall and its configuration were imported to another Panorama appliance, all configurations in the Network and Device tab became read-only. Fixed an issue on firewalls running PAN-OS 11.1 releases where, after being offboarded from Panorama, the firewall XML configuration file retained template information from the previous Panorama configuration. As a result, when the firewall and its configuration were imported to another Panorama appliance, all configurations in the **Network** and **Device** tab became read-only.
## PAN-286231 ## PAN-286231
@@ -244,11 +244,11 @@ Fixed an issue where searching configuration logs for an audit_uuid did not retu
## PAN-281096 ## PAN-281096
Fixed an issue on HA clusters where, when link and path monitoring was configured and the failover condition was set to all, disconnecting and reconnecting monitored ethernet ports caused the firewall to switch to a nonfunctional role, which resulted in all interfaces except the HA interface going down. Fixed an issue on HA clusters where, when link and path monitoring was configured and the failover condition was set to **all**, disconnecting and reconnecting monitored ethernet ports caused the firewall to switch to a nonfunctional role, which resulted in all interfaces except the HA interface going down.
## PAN-279901 ## PAN-279901
Fixed an issue where the firewall dropped client hello packets when decryption was enabled, which prevented access to certain websites. This occurred when the client hello packet was truncated, the accumulation proxy assumed that the first packet contains at least 5 bytes, or out-of-order packets were waiting in L4 TCP. An issue was fixed where the firewall dropped fragmented TLS ClientHello packets, which blocked access to certain websites. This occurred because the packets arrived truncated, in varying sizes and orders, and the firewall's heuristics failed to handle them correctly.
To enable this fix, run: debug dataplane set ssl-decrypt accumulate-client-hello disjoined yes To enable this fix, run: debug dataplane set ssl-decrypt accumulate-client-hello disjoined yes
@@ -262,7 +262,7 @@ Fixed an issue where NAT pool leaks occurred during a test when RTSP traffic hit
M-600 appliances only M-600 appliances only
``` ```
Fixed an issue where Panorama did not update all `panreplay` database entries after performing a commit and full push to all devices. Fixed an issue where Panorama did not update all panreplay database entries after performing a commit and full push to all devices.
## PAN-279690 ## PAN-279690
@@ -274,7 +274,7 @@ Fixed an issue where service routes configured to use a data plane interface inc
## PAN-279400 ## PAN-279400
Fixed an issue where, when Restrict Certificate Extensions was enabled on decryption profiles, the basic constraints extension was overwritten incorrectly. Fixed an issue where, when **Restrict Certificate Extensions** was enabled on decryption profiles, the basic constraints extension was overwritten incorrectly.
## PAN-279366 ## PAN-279366
@@ -282,7 +282,7 @@ Fixed an issue where the firewall used an unnecessary configuration lock when ru
## PAN-277234 ## PAN-277234
Fixed an issue where a device group import resulted in a Security policy rule being created with Application set to none. Fixed an issue where a device group import resulted in a Security policy rule being created with **Application** set to **none**.
## PAN-277178 ## PAN-277178
@@ -292,7 +292,7 @@ To use this fix, delete the original shared object after cloning it to a device
## PAN-276795 ## PAN-276795
Fixed an issue where the GlobalProtect client displayed an error message when you clicked Check Now and Preferred Releases and Base Releases were unchecked (Device > Software). Fixed an issue where the GlobalProtect client displayed an error message when you clicked **Check Now** and **Preferred Releases** and **Base Releases** were unchecked (**Device > Software**).
## PAN-275272 ## PAN-275272
@@ -330,7 +330,7 @@ Fixed an issue where an OOM condition occurred, which caused processes to stop r
## PAN-268522 ## PAN-268522
Fixed an issue where the firewall failed to connect to the update server with a customized service route when the source interface was set to MGT and the source address was set as IPv4. Fixed an issue where the firewall failed to connect to the update server with a customized service route when the source interface was set to **MGT** and the source address was set as IPv4.
## PAN-268002 ## PAN-268002
web/data/issues/PAN-OS/addressed/11.1.6-h19.md
+1 -1
View File
@@ -42,7 +42,7 @@ Fixed an issue where, after upgrading Panorama and Log Collectors, tunnel logs w
## PAN-294893 ## PAN-294893
Fixed an issue where firewalls with the Send handshake messages to CTD for inspection setting enabled caused incorrect security policy rules to be matched. Specifically, traffic not identified as openai-base or openai-chatgpt applications was incorrectly matched by the ALLOW-OPEN-AI-FULL-ACCESS-URLS-ALERTS rule. Additionally, the expected response page for blocked URLs was not displayed. Fixed an issue where firewalls with the **Send handshake messages to CTD for inspection** setting enabled caused incorrect security policy rules to be matched. Specifically, traffic not identified as openai-base or openai-chatgpt applications was incorrectly matched by the ALLOW-OPEN-AI-FULL-ACCESS-URLS-ALERTS rule. Additionally, the expected response page for blocked URLs was not displayed.
## PAN-294524 ## PAN-294524
web/data/issues/PAN-OS/addressed/11.1.6-h20.md
+2 -2
View File
@@ -54,7 +54,7 @@ Fixed an issue where, after an EDL certificate update or repository migration, a
## PAN-287693 ## PAN-287693
Fixed an issue where Panorama did not use the configured proxy settings to check WildFire private cloud content and instead connected directly to the WildFire device using the management interface. This occurred even when Use Proxy Settings for Private Cloud was enabled. Fixed an issue where Panorama did not use the configured proxy settings to check WildFire private cloud content and instead connected directly to the WildFire device using the management interface. This occurred even when **Use Proxy Settings for Private Cloud** was enabled.
## PAN-284872 ## PAN-284872
@@ -62,7 +62,7 @@ Fixed an issue where ENA (Elastic Network Adapter) extended statistics (conntrac
## PAN-277682 ## PAN-277682
Fixed an issue where moving an address object from a device group to shared and renaming it did not reflect in the address group, which caused commits to fail. Fixed an issue where moving an address object from a device group to **shared** and renaming it did not reflect in the address group, which caused commits to fail.
## PAN-262444 ## PAN-262444
web/data/issues/PAN-OS/addressed/11.1.6-h21.md
+3 -3
View File
@@ -14,11 +14,11 @@ Fixed an issue where, when the Network Packet Broker feature was enabled, forwar
## PAN-297782 ## PAN-297782
Fixed an issue on Panorama where reassociating a vsys from one device group to another in a multi-vsys environment resulted in another vsys from the same firewall being removed from the original device group. This resulted in the device being moved into the no device groups attached group, a superuser was required to manually reattach the device. Fixed an issue on Panorama where reassociating a vsys from one device group to another in a multi-vsys environment resulted in another vsys from the same firewall being removed from the original device group. This resulted in the device being moved into the **no device groups attached** group, a superuser was required to manually reattach the device.
## PAN-297775 ## PAN-297775
Fixed an issue where, after upgrading to an affected PAN-OS release, the Visible Virtual Systems field started to reference the vsys name instead of the vsys ID, which caused inter-vsys routing to fail. This occurred when a vsys display name matched one of the vsys IDs. Fixed an issue where, after upgrading to an affected PAN-OS release, the **Visible Virtual Systems** field started to reference the vsys name instead of the vsys ID, which caused inter-vsys routing to fail. This occurred when a vsys display name matched one of the vsys IDs.
## PAN-296752 ## PAN-296752
@@ -58,7 +58,7 @@ Fixed an issue where, after upgrading Panorama in a High Availability (HA) pair,
## PAN-288930 ## PAN-288930
Fixed an issue where traffic from cloud applications intermittently matched an incorrect cloud-apps policy rule when ACE (App-ID Cloud Engine) was enabled. Fixed an issue where traffic from cloud applications intermittently matched an incorrect **cloud-apps** policy rule when ACE (App-ID Cloud Engine) was enabled.
## PAN-288761 ## PAN-288761
web/data/issues/PAN-OS/addressed/11.1.6-h23.md
+2 -2
View File
@@ -6,7 +6,7 @@ version: 11.1.6-h23
## PAN-306502 ## PAN-306502
Fixed an issue where TLS connection failure occurred when traffic was over TLS1.2 or below, header insertion was enabled on the firewall, send TLS handshake to CTD was enabled, and traffic hit a decryption policy rule configured with the no-decrypt action. Fixed an issue where TLS connection failure occurred when traffic was over TLS1.2 or below, header insertion was enabled on the firewall, **send TLS handshake to CTD** was enabled, and traffic hit a decryption policy rule configured with the **no-decrypt** action.
## PAN-304636 ## PAN-304636
@@ -98,7 +98,7 @@ Fixed an issue where commit all operations failed when the application openair-p
## PAN-257616 ## PAN-257616
Fixed an issue where selective push operations from Panorama to managed firewalls failed with the error message Failed to generate selective push configuration. Schema validation failed. Please try a full push. Fixed an issue where selective push operations from Panorama to managed firewalls failed with the error message **Failed to generate selective push configuration. Schema validation failed. Please try a full push**.
## PAN-257362 ## PAN-257362
web/data/issues/PAN-OS/addressed/11.1.6-h25.md
+4 -6
View File
@@ -130,10 +130,8 @@ Fixed an issue where the firewall displayed the following error message: critica
## PAN-185731 ## PAN-185731
Fixed an issue where the firewall was unable to parse the URL path and host when the host header was located in a different packet, which resulted in the firewall not logging the URL path in the first packet. The fix is disabled by default. The following CLI commands can be used to enable/disable the feature: set system setting ctd url-crosspkt-host-path-caching enableset system setting ctd url-crosspkt-host-path-caching disableset system setting ctd url-crosspkt-host-path-caching default Fixed an issue where the firewall was unable to parse the URL path and host when the host header was located in a different packet, which resulted in the firewall not logging the URL path in the first packet. The fix is disabled by default. The following CLI commands can be used to enable/disable the feature:
set system setting ctd url-crosspkt-host-path-caching enable - set system setting ctd url-crosspkt-host-path-caching enable
- set system setting ctd url-crosspkt-host-path-caching disable
set system setting ctd url-crosspkt-host-path-caching disable - set system setting ctd url-crosspkt-host-path-caching default
set system setting ctd url-crosspkt-host-path-caching default
web/data/issues/PAN-OS/addressed/11.1.6-h4.md
+1 -1
View File
@@ -10,7 +10,7 @@ Fixed an issue where large IPv6 packets were reassembled on the firewall when th
## PAN-280471 ## PAN-280471
Fixed an issue where navigating PanoramaMonitorLogs was slower than expected. Fixed an issue where navigating **Panorama** > **Monitor** > **Logs** was slower than expected.
## PAN-279746 ## PAN-279746
web/data/issues/PAN-OS/addressed/11.1.6-h6.md
+7 -7
View File
@@ -42,7 +42,7 @@ Fixed an issue where the configuration audit displayed inaccurate information af
## PAN-279065 ## PAN-279065
Fixed an issue where the firewall sent logs with connection succeeded to the syslog server every time a connection was established, which resulted in excessive logs. Fixed an issue where the firewall sent logs with **connection succeeded** to the syslog server every time a connection was established, which resulted in excessive logs.
## PAN-278296 ## PAN-278296
@@ -66,7 +66,7 @@ Fixed an issue where Panorama stopped forwarding logs to a Syslog server after u
## PAN-275713 ## PAN-275713
Fixed an issue where the dscd process stopped responding when Endpoint Serial Number was enabled, which resulted in the Active Directory returning a list of serial numbers for a specific firewall from the Cloud Identity Engine. Fixed an issue where the dscd process stopped responding when **Endpoint Serial Number** was enabled, which resulted in the **Active Directory** returning a list of serial numbers for a specific firewall from the Cloud Identity Engine.
## PAN-275077 ## PAN-275077
@@ -106,7 +106,7 @@ Fixed an issue where decrypted traffic repeatedly failed and frequent reboots we
## PAN-271351 ## PAN-271351
A fix was made to address CVE-2025-0116. A fix was made to address [CVE-2025-0116](https://security.paloaltonetworks.com/CVE-2025-0116).
## PAN-270193 ## PAN-270193
@@ -146,7 +146,7 @@ Fixed an issue where the firewall displayed 0 for the physical port counters rea
## PAN-261597 ## PAN-261597
Fixed an issue where the all_pktproc process stopped responding, which caused the firewall to become unavailable. Fixed an issue where the **all_pktproc** process stopped responding, which caused the firewall to become unavailable.
## PAN-261312 ## PAN-261312
@@ -154,11 +154,11 @@ Fixed an issue where a commit for a policy and configuration dump overlapped, wh
## PAN-260059 ## PAN-260059
Fixed an issue where Device Telemetry Regions did not show up with the latest content due to content files not being parsed for the region list when Telemetry was turned off. Fixed an issue where **Device Telemetry Regions** did not show up with the latest content due to content files not being parsed for the region list when Telemetry was turned off.
## PAN-259767 ## PAN-259767
Fixed an issue where GlobalProtect users were unable to connect when the option Block sessions if the certificate was not issued to the authenticating device was enabled in the certificate profile. Fixed an issue where GlobalProtect users were unable to connect when the option **Block sessions if the certificate was not issued to the authenticating device** was enabled in the certificate profile.
## PAN-258743 ## PAN-258743
@@ -198,4 +198,4 @@ Fixed an issue where the firewall took an incorrect action for overlapping custo
## PAN-212889 ## PAN-212889
Fixed an issue on Panorama where different threat names were used when querying a threat under Threat Monitor (Monitor > App Scope) and the ACC. This resulted in the ACC displaying no data after clicking a threat name in Threat Monitor and filtering it in the global filters. Fixed an issue on Panorama where different threat names were used when querying a threat under **Threat Monitor** (**Monitor > App Scope**) and the ACC. This resulted in the ACC displaying no data after clicking a threat name in **Threat Monitor** and filtering it in the global filters.
web/data/issues/PAN-OS/addressed/11.1.6-h7.md
+3 -3
View File
@@ -30,7 +30,7 @@ Fixed an issue on Panorama where a memory leak occurred after cloning a template
## PAN-282206 ## PAN-282206
Fixed an issue where configuring Secure Web Gateway (SWG) in no-auth mode led to latency when no decryption policy rules or No-decrypt policy rules were present. Fixed an issue where configuring Secure Web Gateway (SWG) in **no-auth** mode led to latency when no decryption policy rules or **No-decrypt** policy rules were present.
## PAN-282069 ## PAN-282069
@@ -66,7 +66,7 @@ Fixed an issue where Advanced Services, App-ID Cloud Engine (ACE), and Enhanced
## PAN-271273 ## PAN-271273
Fixed an issue where dynamic update downloads failed when IPv6 firewalling was enabled on the firewall and both IPv4 and IPv6 were configured on the management interface. Fixed an issue where dynamic update downloads failed when **IPv6 firewalling** was enabled on the firewall and both IPv4 and IPv6 were configured on the management interface.
## PAN-271175 ## PAN-271175
@@ -78,7 +78,7 @@ Fixed an issue related to external dynamic lists that caused commit times on the
## PAN-268614 ## PAN-268614
Fixed an issue on the web interface where, when all rules were highlighted when a read-only admin user clicked the Highlight Unused Rules checkbox. Fixed an issue on the web interface where, when all rules were highlighted when a read-only admin user clicked the **Highlight Unused Rules** checkbox.
## PAN-268118 ## PAN-268118
web/data/issues/PAN-OS/addressed/11.1.6.md
+10 -10
View File
@@ -34,15 +34,15 @@ Fixed an issue where traffic was dropped when the accumulation proxy was enabled
## PAN-268474 ## PAN-268474
Fixed an issue on the firewall where the PAN-DB URL Filtering license displayed as Valid even when the firewall did not have the license, which caused traffic to drop. Fixed an issue on the firewall where the PAN-DB URL Filtering license displayed as **Valid** even when the firewall did not have the license, which caused traffic to drop.
## PAN-268419 ## PAN-268419
Fixed an issue where Managed Devices > Summary displayed incorrect subcolumns. Fixed an issue where **Managed Devices > Summary** displayed incorrect subcolumns.
## PAN-268319 ## PAN-268319
Fixed an issue where Receive Time and Time Generated were not visible as attributes in the Filter Builder for system logs and URL filtering logs. Fixed an issue where **Receive Time** and **Time Generated** were not visible as attributes in the **Filter Builder** for system logs and URL filtering logs.
## PAN-268229 ## PAN-268229
@@ -50,7 +50,7 @@ Fixed an issue where the firewall stopped responding during session setup for EC
## PAN-268228 ## PAN-268228
Fixed an issue where Panorama administrators were unable to select Edit Selection when pushing changes to devices if they logged in using TACACS authentication. Fixed an issue where Panorama administrators were unable to select **Edit Selection** when pushing changes to devices if they logged in using TACACS authentication.
## PAN-267934 ## PAN-267934
@@ -62,7 +62,7 @@ Fixed a lock usage error that caused the ikemgr process to stop responding.
## PAN-267348 ## PAN-267348
Fixed an issue on the Panorama web interface where WildFire Activity by File Type in the ACC did not display the file type name. Fixed an issue on the Panorama web interface where **WildFire Activity by File Type** in the ACC did not display the file type name.
## PAN-267321 ## PAN-267321
@@ -78,7 +78,7 @@ Fixed an issue on Panorama where Elasticsearch repeatedly restarted.
## PAN-266900 ## PAN-266900
Fixed an issue on the Panorama web interface where you were unable to click OK after selecting an install package type and file from the dropdown and selecting a firewall. Fixed an issue on the Panorama web interface where you were unable to click **OK** after selecting an install package type and file from the dropdown and selecting a firewall.
## PAN-266639 ## PAN-266639
@@ -90,7 +90,7 @@ Fixed an issue where a failed SSL connection to a syslog server resulted in a /t
## PAN-266167 ## PAN-266167
Fixed an issue where the restart option for IPSec tunnels was greyed out (Network > IPSec Tunnels > IKE Info). Fixed an issue where the **restart** option for IPSec tunnels was greyed out (**Network > IPSec Tunnels > IKE Info**).
## PAN-266003 ## PAN-266003
@@ -98,7 +98,7 @@ Fixed an issue on the firewall where a configuration policy push caused both act
## PAN-265621 ## PAN-265621
Fixed an issue where the restart option for IPSec tunnels was greyed out when you attempted to restart the tunnel from Network > IPSec Tunnels > IKE Info. Fixed an issue where the **restart** option for IPSec tunnels was greyed out when you attempted to restart the tunnel from **Network > IPSec Tunnels > IKE Info**.
## PAN-265399 ## PAN-265399
@@ -126,11 +126,11 @@ Fixed an issue where syslog forwarding over TCP stopped after upgrading.
## PAN-264678 ## PAN-264678
Fixed an issue where Preview Changes did not display configuration changes in Commit and push > Push Scope. Fixed an issue where **Preview Changes** did not display configuration changes in **Commit and push** > **Push Scope**.
## PAN-264662 ## PAN-264662
Fixed an issue where HTTP POST requests were blocked for URLs that had the block-continue category configured. Fixed an issue where HTTP POST requests were blocked for URLs that had the **block-continue** category configured.
## PAN-263843 ## PAN-263843
web/data/issues/PAN-OS/addressed/11.1.7-h2.md
+15 -15
View File
@@ -74,7 +74,7 @@ Fixed an issue where, after an upgrade, the SNMP polled values for IF-MIB::ifInE
Firewalls in HA configurations only Firewalls in HA configurations only
``` ```
Fixed an issue where, after an upgrade, the mac receive error counter in receive incoming errors increased, which resulted in SNMP alerts. Fixed an issue where, after an upgrade, the **mac receive error** counter in **receive incoming errors** increased, which resulted in SNMP alerts.
## PAN-283467 ## PAN-283467
@@ -98,7 +98,7 @@ Fixed an issue where large IPv6 packets were reassembled incorrectly on the fire
## PAN-282206 ## PAN-282206
Fixed an issue where configuring Secure Web Gateway (SWG) in no-auth mode led to latency when no decryption policy rules or No-decrypt policy rules were present. Fixed an issue where configuring Secure Web Gateway (SWG) in **no-auth** mode led to latency when no decryption policy rules or **No-decrypt** policy rules were present.
## PAN-282069 ## PAN-282069
@@ -146,7 +146,7 @@ Fixed an issue on the web interface were you were unable to scroll up or down to
## PAN-280471 ## PAN-280471
Fixed an issue where navigating Panorama > Monitor > Logs was slower than expected. Fixed an issue where navigating **Panorama > Monitor > Logs** was slower than expected.
## PAN-280243 ## PAN-280243
@@ -158,7 +158,7 @@ Fixed an issue where the firewall lost the pre-shared key configuration assigned
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
Fixed an issue on the web interface where Enable Bonjour Reflector was not displayed (Network > Interfaces > Ethernet Interface). Fixed an issue on the web interface where **Enable Bonjour Reflector** was not displayed (**Network > Interfaces > Ethernet Interface**).
## PAN-279746 ## PAN-279746
@@ -190,7 +190,7 @@ Fixed an issue where the configuration audit displayed inaccurate information af
## PAN-279065 ## PAN-279065
Fixed an issue where the firewall sent logs with connection succeeded to the syslog server every time a connection was established, which resulted in excessive logs. Fixed an issue where the firewall sent logs with **connection succeeded** to the syslog server every time a connection was established, which resulted in excessive logs.
## PAN-278296 ## PAN-278296
@@ -230,7 +230,7 @@ Fixed an issue where Panorama stopped forwarding logs to a Syslog server after u
## PAN-275713 ## PAN-275713
Fixed an issue where the dscd process stopped responding when Endpoint Serial Number was enabled, which resulted in the Active Directory returning a list of serial numbers for a specific firewall from the Cloud Identity Engine. Fixed an issue where the dscd process stopped responding when **Endpoint Serial Number** was enabled, which resulted in the **Active Directory** returning a list of serial numbers for a specific firewall from the Cloud Identity Engine.
## PAN-275077 ## PAN-275077
@@ -290,11 +290,11 @@ Fixed an issue where restarting the firewall did not initiate an autocommit job,
## PAN-273422 ## PAN-273422
Fixed an issue where traffic failed when Inline cloud analysis (Advanced Threat Prevention) was enabled in the Anti-Spyware profile with the action set to anything other than allow or alert and the maximum latency condition was reached. Fixed an issue where traffic failed when Inline cloud analysis (Advanced Threat Prevention) was enabled in the Anti-Spyware profile with the action set to anything other than **allow** or **alert** and the maximum latency condition was reached.
## PAN-273308 ## PAN-273308
A fix was made to address CVE-2025-0130. A fix was made to address [CVE-2025-0130](https://security.paloaltonetworks.com/CVE-2025-0130).
## PAN-273141 ## PAN-273141
@@ -302,7 +302,7 @@ Fixed an issue where GlobalProtect clients experienced slow file transfer downlo
## PAN-273129 ## PAN-273129
Fixed an issue on the web interface where the negate option was visible when you clicked on the rule name, but not when you viewed the target options from the rulebase attribute. Fixed an issue on the web interface where the **negate** option was visible when you clicked on the rule name, but not when you viewed the target options from the **rulebase** attribute.
## PAN-273026 ## PAN-273026
@@ -374,7 +374,7 @@ Fixed an issue where decrypted traffic repeatedly failed and frequent reboots we
## PAN-271351 ## PAN-271351
A fix was made to address CVE-2025-0116. A fix was made to address [CVE-2025-0116](https://security.paloaltonetworks.com/CVE-2025-0116).
## PAN-271273 ## PAN-271273
@@ -454,7 +454,7 @@ Fixed an issue where traffic did not match the correct security policy when usin
## PAN-268614 ## PAN-268614
Fixed an issue on the web interface where, when all rules were highlighted when a read-only admin user clicked the Highlight Unused Rules checkbox. Fixed an issue on the web interface where, when all rules were highlighted when a read-only admin user clicked the **Highlight Unused Rules** checkbox.
## PAN-268279 ## PAN-268279
@@ -566,7 +566,7 @@ Fixed an issue where the management plane DNS cache size was lower than expected
## PAN-260059 ## PAN-260059
Fixed an issue where Device Telemetry Regions did not show up with the latest content due to content files not being parsed for the region list when Telemetry was turned off. Fixed an issue where **Device Telemetry Regions** did not show up with the latest content due to content files not being parsed for the region list when Telemetry was turned off.
## PAN-260015 ## PAN-260015
@@ -574,7 +574,7 @@ Fixed an issue on the firewall where the dataplane restarted due to insufficient
## PAN-259767 ## PAN-259767
Fixed an issue where GlobalProtect users were unable to connect when the option Block sessions if the certificate was not issued to the authenticating device was enabled in the certificate profile. Fixed an issue where GlobalProtect users were unable to connect when the option **Block sessions if the certificate was not issued to the authenticating device** was enabled in the certificate profile.
## PAN-259076 ## PAN-259076
@@ -606,7 +606,7 @@ Fixed an issue where the logrcvr process stopped responding while processing ses
## PAN-255914 ## PAN-255914
(VM-Series firewalls on Amazon Web Services (AWS) environments only) Fixed an issue where a newly bootstrapped firewall required a management server restart, relicensing, or license push from Panorama to invoke the device certificate. (**VM-Series firewalls on Amazon Web Services (AWS) environments only**) Fixed an issue where a newly bootstrapped firewall required a management server restart, relicensing, or license push from Panorama to invoke the device certificate.
## PAN-255619 ## PAN-255619
@@ -642,7 +642,7 @@ Fixed an issue where the firewall showed three different sets of name validation
Multi-vsys firewalls only Multi-vsys firewalls only
``` ```
Fixed an issue where commits failed on the firewall after selecting Export or push device config bundle on Panorama and a force push was required. Fixed an issue where commits failed on the firewall after selecting **Export or push device config bundle** on Panorama and a force push was required.
## PAN-235733 ## PAN-235733
web/data/issues/PAN-OS/addressed/11.1.7.md
+5 -5
View File
@@ -18,7 +18,7 @@ Fixed an issue where log forwarding to a UDP syslog server stopped when an unrea
## PAN-272538 ## PAN-272538
Fixed an issue where the configd process stopped responding during a commit-all validation when there were uncommitted changes and share-unused-objects-with-devices was set to off. Fixed an issue where the configd process stopped responding during a commit-all validation when there were uncommitted changes and **share-unused-objects-with-devices** was set to off.
## PAN-272006 ## PAN-272006
@@ -74,7 +74,7 @@ Fixed an issue with firewalls in active/passive HA configurations where the tota
## PAN-267781 ## PAN-267781
Fixed an issue where Panorama did not display the Source Dynamic Address Group. Fixed an issue where Panorama did not display the **Source Dynamic Address Group**.
## PAN-267097 ## PAN-267097
@@ -106,7 +106,7 @@ Fixed an issue where the firewall sent Threat logs and URL logs to an external s
## PAN-259078 ## PAN-259078
Fixed an issue where WildFire Analysis reports were not generated and the following error message was displayed: Error 500: Internal Server Error. Fixed an issue where WildFire Analysis reports were not generated and the following error message was displayed: **Error 500: Internal Server Error**.
## PAN-258149 ## PAN-258149
@@ -114,7 +114,7 @@ Fixed an issue where the firewall dropped the SYN-ACK when using the TCP Fast Op
## PAN-246699 ## PAN-246699
Fixed an issue on Panorama where Rule Usage and Apps Seen under Security policy rules stopped incrementing. Fixed an issue on Panorama where **Rule Usage** and **Apps Seen** under Security policy rules stopped incrementing.
## PAN-240529 ## PAN-240529
@@ -122,4 +122,4 @@ Fixed an issue where cloud application information was not displayed in the traf
## PAN-212889 ## PAN-212889
Fixed an issue on Panorama where different threat names were used when querying a threat under Threat Monitor (Monitor > App Scope) and the ACC. This resulted in the ACC displaying no data after clicking a threat name in Threat Monitor and filtering it in the global filters. Fixed an issue on Panorama where different threat names were used when querying a threat under **Threat Monitor** (**Monitor > App Scope**) and the ACC. This resulted in the ACC displaying no data after clicking a threat name in **Threat Monitor** and filtering it in the global filters.
web/data/issues/PAN-OS/addressed/11.1.8.md
+25 -25
View File
@@ -6,7 +6,7 @@ version: 11.1.8
## PAN-284490 ## PAN-284490
A fix was made to address CVE-2025-2182. A fix was made to address [CVE-2025-2182](https://security.paloaltonetworks.com/CVE-2025-2182).
## PAN-283493 ## PAN-283493
@@ -26,7 +26,7 @@ Fixed an issue where the web interface did not display a message to commit prior
## PAN-280471 ## PAN-280471
Fixed an issue where navigating Panorama > Monitor > Logs was slower than expected. Fixed an issue where navigating **Panorama > Monitor > Logs** was slower than expected.
## PAN-280243 ## PAN-280243
@@ -38,7 +38,7 @@ Fixed an issue where the firewall lost the pre-shared key configuration assigned
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
Fixed an issue on the web interface where Enable Bonjour Reflector was not displayed (Network > Interfaces > Ethernet Interface). Fixed an issue on the web interface where **Enable Bonjour Reflector** was not displayed (**Network > Interfaces > Ethernet Interface**).
## PAN-279746 ## PAN-279746
@@ -66,7 +66,7 @@ Fixed an issue where the firewall did not properly power cycle during a reboot.
## PAN-277751 ## PAN-277751
Fixed an issue where a policy-based forwarding (PBF) rule with an action of no-pbf and a service of TCP-22 did not match traffic after upgrading to PAN-OS 11.1.5-h1. As a result, traffic was matched by a lower rule with a service of any and an action of forward. Fixed an issue where a policy-based forwarding (PBF) rule with an action of **no-pbf** and a service of TCP-22 did not match traffic after upgrading to PAN-OS 11.1.5-h1. As a result, traffic was matched by a lower rule with a service of **any** and an action of **forward**.
## PAN-277631 ## PAN-277631
@@ -82,7 +82,7 @@ Fixed an issue where the packet buffer size increased significantly when WildFir
## PAN-276795 ## PAN-276795
Fixed an issue where the GlobalProtect client displayed an error message when you clicked Check Now and Preferred Releases and Base Releases were unchecked (Device > Software). Fixed an issue where the GlobalProtect client displayed an error message when you clicked **Check Now** and **Preferred Releases** and **Base Releases** were unchecked (**Device > Software**).
## PAN-276599 ## PAN-276599
@@ -166,11 +166,11 @@ Fixed an issue where the firewall rebooted continuously after upgrading to PAN-O
## PAN-274038 ## PAN-274038
Fixed an issue where you were unable to use the s_encrypted field in custom reports for the Panorama threat log database. Fixed an issue where you were unable to use the **s_encrypted** field in custom reports for the Panorama threat log database.
## PAN-273991 ## PAN-273991
Fixed an issue where the transmit power for a cable that was used on port 44 displayed as N/A. Fixed an issue where the transmit power for a cable that was used on port 44 displayed as **N/A**.
## PAN-273963 ## PAN-273963
@@ -190,7 +190,7 @@ Fixed an issue where packets were dropped initially when a SYN cookie with activ
## PAN-273597 ## PAN-273597
Fixed an issue where logs in the cloud database displayed in the Not-Resolved category but not in the local database. Fixed an issue where logs in the cloud database displayed in the **Not-Resolved** category but not in the local database.
## PAN-273589 ## PAN-273589
@@ -230,11 +230,11 @@ Fixed an issue where the firewall entered an unstable state after committing cha
## PAN-272743 ## PAN-272743
Fixed an issue where non-captive portal traffic was not visible under Traffic Logs when the traffic was denied by an authentication rule and the session was discarded. Fixed an issue where non-captive portal traffic was not visible under **Traffic Logs** when the traffic was denied by an authentication rule and the session was discarded.
## PAN-272726 ## PAN-272726
Fixed an issue on the web interface where the URL Filtering change category feature did not work. Fixed an issue on the web interface where the **URL Filtering** change category feature did not work.
## PAN-272605 ## PAN-272605
@@ -270,7 +270,7 @@ Fixed an issue where the push scope did not populate when attempting to push a p
## PAN-271774 ## PAN-271774
Fixed an issue where the firewall logs displayed the reason for data filtering action as FW Skipped: XXXX. Fixed an issue where the firewall logs displayed the reason for data filtering action as **FW Skipped: XXXX**.
## PAN-271700 ## PAN-271700
@@ -366,7 +366,7 @@ Fixed an issue threat reports were empty when generated from Panorama, but displ
## PAN-269716 ## PAN-269716
Fixed an issue where half-closed TCP sessions did not refresh the session timeout when continuously receiving data after setting the cfg.session.tcp-no-refresh-fin-rst option toTrue. Fixed an issue where half-closed TCP sessions did not refresh the session timeout when continuously receiving data after setting the cfg.session.tcp-no-refresh-fin-rst option to True.
## PAN-269624 ## PAN-269624
@@ -434,7 +434,7 @@ Fixed an issue where traffic did not match the correct security policy when usin
## PAN-268606 ## PAN-268606
Fixed an issue where GlobalProtect users with client certificates received an authentication failure message without entering a password and clicking connect or login. Fixed an issue where GlobalProtect users with client certificates received an authentication failure message without entering a password and clicking **connect** or **login**.
## PAN-268597 ## PAN-268597
@@ -458,7 +458,7 @@ Fixed an issue where autocommits failed if the management IPv6 gateway was the s
## PAN-268276 ## PAN-268276
Fixed an issue where GlobalProtect clients intermittently failed to connect to the gateway with the error message could not connect to gateway. Fixed an issue where GlobalProtect clients intermittently failed to connect to the gateway with the error message **could not connect to gateway**.
## PAN-268168 ## PAN-268168
@@ -474,7 +474,7 @@ Fixed an issue on firewalls in active/passive HA configurations where, after a f
## PAN-267912 ## PAN-267912
Fixed an issue on the Panorama web interface where Application and Category was not able to be selected under Test Policy Match. Fixed an issue on the Panorama web interface where **Application** and **Category** was not able to be selected under **Test Policy Match**.
## PAN-267660 ## PAN-267660
@@ -502,7 +502,7 @@ Fixed an issue where WildFire submission logs incorrectly reported allowed malic
Firewalls in HA configuration only Firewalls in HA configuration only
``` ```
Fixed an issue where the Network pre-negotiation enabled page did not display on the firewall dashboard. Fixed an issue where the **Network pre-negotiation enabled** page did not display on the firewall dashboard.
## PAN-267381 ## PAN-267381
@@ -526,7 +526,7 @@ Fixed an issue where multicast streams were unstable with ECMP and dropped every
## PAN-266905 ## PAN-266905
Fixed an issue where sessions ended with the message decrypt error in the logs for traffic that matched a no-decrypt policy. Fixed an issue where sessions ended with the message decrypt error in the logs for traffic that matched a **no-decrypt** policy.
## PAN-266800 ## PAN-266800
@@ -784,7 +784,7 @@ Fixed an issue where the firewall displayed incorrect statistics for mac_transmi
## PAN-261936 ## PAN-261936
Fixed an issue where WildFire submission logs were not displayed when filtered by Sender Address. Fixed an issue where WildFire submission logs were not displayed when filtered by **Sender Address**.
## PAN-261825 ## PAN-261825
@@ -840,11 +840,11 @@ Fixed an issue where the firewall dropped a retransmitted SYN packet when using
## PAN-261074 ## PAN-261074
Fixed an issue where the firewall delayed video file transfers over SMB when Exclude Video Traffic from the Tunnel feature was enabled and no applications were added to the list. Fixed an issue where the firewall delayed video file transfers over SMB when **Exclude Video Traffic** from the Tunnel feature was enabled and no applications were added to the list.
## PAN-260879 ## PAN-260879
Fixed an issue where the Panorama port 28270 did not adhere to the restricted TLS version and ciphers set in the Secure Communication Settings. Fixed an issue where the Panorama port 28270 did not adhere to the restricted TLS version and ciphers set in the **Secure Communication Settings**.
## PAN-260752 ## PAN-260752
@@ -892,11 +892,11 @@ Fixed an issue where the web interface stopped responding when configuring the G
## PAN-260059 ## PAN-260059
Fixed an issue where Device Telemetry Regions did not show up with the latest content due to content files not being parsed for the region list when Telemetry was turned off. Fixed an issue where **Device Telemetry Regions** did not show up with the latest content due to content files not being parsed for the region list when Telemetry was turned off.
## PAN-260003 ## PAN-260003
Fixed an issue where commits failed when you set Use Management interface for all and MGMT was configured for Data Services. Fixed an issue where commits failed when you set **Use Management interface for all** and **MGMT** was configured for **Data Services**.
## PAN-259870 ## PAN-259870
@@ -916,11 +916,11 @@ Fixed an issue where the firewall experienced high dataplane CPU usage when SSL
## PAN-259767 ## PAN-259767
Fixed an issue where GlobalProtect users were unable to connect when the option Block sessions if the certificate was not issued to the authenticating device was enabled in the certificate profile. Fixed an issue where GlobalProtect users were unable to connect when the option **Block sessions if the certificate was not issued to the authenticating device** was enabled in the certificate profile.
## PAN-259343 ## PAN-259343
Fixed an issue on the Panorama web interface where the Configuration tab did not accurately display changes made to URL filtering profiles. Fixed an issue on the Panorama web interface where the **Configuration** tab did not accurately display changes made to URL filtering profiles.
## PAN-259140 ## PAN-259140
@@ -988,7 +988,7 @@ Fixed an issue where scheduled email reports were sent without PDF attachments i
## PAN-256560 ## PAN-256560
Fixed an issue where exporting a Custom Report to CSV format did not display the full report if it contained non-ASCII characters. Fixed an issue where exporting a **Custom Report** to CSV format did not display the full report if it contained non-ASCII characters.
## PAN-256138 ## PAN-256138
web/data/issues/PAN-OS/addressed/11.1.9.md
+18 -14
View File
@@ -6,6 +6,10 @@ version: 11.1.9
## PAN-290996 ## PAN-290996
```caveat
This issue is now resolved. See PAN-OS 11.1.10-h1 Addressed Issues
```
When performing an SNMP walk, the Connections Per Second (CPS) counters incorrectly return a value of 0 for each virtual system (VSYS), despite the firewall actively processing connections. When performing an SNMP walk, the Connections Per Second (CPS) counters incorrectly return a value of 0 for each virtual system (VSYS), despite the firewall actively processing connections.
## PAN-286255 ## PAN-286255
@@ -30,11 +34,11 @@ Fixed an issue related to syslog forwarding that caused the logrcvr process stop
## PAN-282697 ## PAN-282697
Fixed an issue where traffic was delayed significantly when it used No Authentication Explicit Proxy and matched a decryption policy rule. Fixed an issue where traffic was delayed significantly when it used **No Authentication Explicit Proxy** and matched a decryption policy rule.
## PAN-282454 ## PAN-282454
Fixed an issue where, when you added the Virtual System Name column under Unified Logs, the column did not remain visible in the table if you closed and re-opened the tab. Fixed an issue where, when you added the **Virtual System Name** column under **Unified Logs**, the column did not remain visible in the table if you closed and re-opened the tab.
## PAN-282391 ## PAN-282391
@@ -46,7 +50,7 @@ Fixed an issue where the Panorama web interface was slower than expected.
## PAN-282206 ## PAN-282206
Fixed an issue where configuring Secure Web Gateway (SWG) in no-auth mode led to latency when no decryption policy rules or No-decrypt policy rules were present. Fixed an issue where configuring Secure Web Gateway (SWG) in **no-auth** mode led to latency when no decryption policy rules or **No-decrypt** policy rules were present.
## PAN-282069 ## PAN-282069
@@ -102,7 +106,7 @@ Fixed an issue where processes stopped responding when HTTPS Forward traffic was
## PAN-279400 ## PAN-279400
Fixed an issue where, when Restrict Certificate Extensions was enabled on decryption profiles, the basic constraints extension was overwritten incorrectly. Fixed an issue where, when **Restrict Certificate Extensions** was enabled on decryption profiles, the basic constraints extension was overwritten incorrectly.
## PAN-279209 ## PAN-279209
@@ -110,11 +114,11 @@ Fixed an issue where changes made to the management interface permitted IP addre
## PAN-279195 ## PAN-279195
Fixed an issue on Panorama where Device Health displayed the device memory as 0%. Fixed an issue on Panorama where **Device Health** displayed the device memory as 0%.
## PAN-279065 ## PAN-279065
Fixed an issue where the firewall sent logs with connection succeeded to the syslog server every time a connection was established, which resulted in excessive logs. Fixed an issue where the firewall sent logs with **connection succeeded** to the syslog server every time a connection was established, which resulted in excessive logs.
## PAN-278190 ## PAN-278190
@@ -142,11 +146,11 @@ Fixed an issue on the firewall where half-duplex settings on Ethernet was not vi
## PAN-276412 ## PAN-276412
Fixed an issue where you were unable to download XML files from Panorama > Summary > Backups. Fixed an issue where you were unable to download XML files from **Panorama > Summary > Backups**.
## PAN-274907 ## PAN-274907
Fixed an issue on Panorama where Config Audit Commit Date displayed the timestamp of the configuration edit instead of the commit time. Fixed an issue on Panorama where **Config Audit Commit Date** displayed the timestamp of the configuration edit instead of the commit time.
## PAN-274750 ## PAN-274750
@@ -174,7 +178,7 @@ Fixed an issue on the firewall where you were unable to local changes that were
## PAN-273422 ## PAN-273422
Fixed an issue where traffic failed when Inline cloud analysis (Advanced Threat Prevention) was enabled in the Anti-Spyware profile with the action set to anything other than allow or alert and the maximum latency condition was reached. Fixed an issue where traffic failed when Inline cloud analysis (Advanced Threat Prevention) was enabled in the Anti-Spyware profile with the action set to anything other than **allow** or **alert** and the maximum latency condition was reached.
## PAN-273141 ## PAN-273141
@@ -194,7 +198,7 @@ Fixed an issue where decrypted traffic repeatedly failed and frequent reboots we
## PAN-271273 ## PAN-271273
Fixed an issue where dynamic update downloads failed when IPv6 firewalling was enabled on the firewall and both IPv4 and IPv6 were configured on the management interface. Fixed an issue where dynamic update downloads failed when **IPv6 firewalling** was enabled on the firewall and both IPv4 and IPv6 were configured on the management interface.
## PAN-271175 ## PAN-271175
@@ -218,7 +222,7 @@ Fixed an intermittent issue where the firewall failed to process FTP traffic aft
## PAN-268614 ## PAN-268614
Fixed an issue on the web interface where, when all rules were highlighted when a read-only admin user clicked the Highlight Unused Rules checkbox. Fixed an issue on the web interface where, when all rules were highlighted when a read-only admin user clicked the **Highlight Unused Rules** checkbox.
## PAN-267936 ## PAN-267936
@@ -262,7 +266,7 @@ Fixed an issue where a newly bootstrapped firewall required a management server
## PAN-254524 ## PAN-254524
Fixed an issue on Panorama where, when the Commit and Push button was clicked during a selective Commit and Push operation, the window stopped responding, which caused the operation to be delayed. Fixed an issue on Panorama where, when the **Commit and Push** button was clicked during a selective **Commit and Push** operation, the window stopped responding, which caused the operation to be delayed.
## PAN-253127 ## PAN-253127
@@ -278,8 +282,8 @@ Fixed an issue where selective pushes failed due to a missing log collector refe
Multi-vsys firewalls only Multi-vsys firewalls only
``` ```
Fixed an issue where commits failed on the firewall after selecting Export or push device config bundle on Panorama and a force push was required. Fixed an issue where commits failed on the firewall after selecting **Export or push device config bundle** on Panorama and a force push was required.
## PAN-238208 ## PAN-238208
Fixed an issue where the firewall API returned inconsistent responses to a failed call using a valid API key. With this fix, the firewall returns the error Session is invalid if the session is not available for the cookie. Fixed an issue where the firewall API returned inconsistent responses to a failed call using a valid API key. With this fix, the firewall returns the error **Session is invalid** if the session is not available for the cookie.
web/data/issues/PAN-OS/known/11.1.0.md
+157 -154
View File
@@ -6,15 +6,27 @@ version: 11.1.0
## PAN-304756 ## PAN-304756
```caveat
This issue is now resolved. See PAN-OS 11.1.13-h1 Addressed Issues.
```
After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems. After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems.
## PAN-298505 ## PAN-298505
```caveat
This issue is now resolved. See PAN-OS 11.1.6-h20 Addressed Issues, PAN-OS 11.1.10-h7 Addressed Issues, and PAN-OS 11.1.12 Addressed Issues
```
After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing auto-commit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems managed by Panorama, and the vsys ID sequence breaks when unused virtual systems are deleted and the changes are pushed to the firewall. After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing auto-commit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems managed by Panorama, and the vsys ID sequence breaks when unused virtual systems are deleted and the changes are pushed to the firewall.
## PAN-294179 ## PAN-294179
On the Panorama Config Audit page, some commit versions might display incorrect or missing data. Fields such as, COMMITTED BY , COMMIT DATE , and OBJECT CHANGES might not be visible for some commit versions. Sometimes, commit versions can disappear after a refresh and the commit description field might display corrupted characters. ```caveat
This issue is now resolved. See PAN-OS 11.1.6-h17 Addressed Issues.
```
On the**Panorama Config Audit** page, some commit versions might display incorrect or missing data. Fields such as, **COMMITTED BY**, **COMMIT DATE**, and**OBJECT CHANGES** might not be visible for some commit versions. Sometimes, commit versions can disappear after a refresh and the commit description field might display corrupted characters.
## PAN-291288 ## PAN-291288
@@ -22,6 +34,10 @@ An active firewall might unexpectedly reboot due to a pan_task crash caused by a
## PAN-290088 ## PAN-290088
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
When pushing configurations from Panorama to a firewall, a memory leak might occur in the firewall's configd process, particularly when the configurations contain shared policies. Each configuration push causes the configd process to consume additional memory that is not released after the commit completes. When pushing configurations from Panorama to a firewall, a memory leak might occur in the firewall's configd process, particularly when the configurations contain shared policies. Each configuration push causes the configd process to consume additional memory that is not released after the commit completes.
## PAN-289383 ## PAN-289383
@@ -32,47 +48,42 @@ PA-800 series firewalls only
Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation. Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation.
Workaround: Enable auto-negotiation on the connected peer firewall. **Workaround:** Enable auto-negotiation on the connected peer firewall.
## PAN-288097 ## PAN-288097
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
Routed process may stop responding after changing MTU or any link parameters when OSPF and PIM are enabled on the same interface. Routed process may stop responding after changing MTU or any link parameters when OSPF and PIM are enabled on the same interface.
## PAN-286231 ## PAN-286231
When performing a partial Commit and Push on Panorama, there is a risk that unintended configuration changes might be pushed to a firewall. When performing a partial **Commit and Push** on Panorama, there is a risk that unintended configuration changes might be pushed to a firewall.
This issue is more likely to occur in the following scenarios:When you run Commit and Push operations as a single action.When you trigger multiple parallel commit-all jobs at the same time.Device groups and templates have different configuration synchronization versions. This issue is more likely to occur in the following scenarios:
When you run Commit and Push operations as a single action. - When you run **Commit and Push** operations as a single action.
- When you trigger multiple parallel commit-all jobs at the same time.
- Device groups and templates have different configuration synchronization versions.
When you run Commit and Push operations as a single action. **Workaround:** Perform one of the following steps:
When you trigger multiple parallel commit-all jobs at the same time. - Perform commit and push as two separate, sequential steps.
- Perform a full push instead of selective push.
When you trigger multiple parallel commit-all jobs at the same time.
Device groups and templates have different configuration synchronization versions.
Device groups and templates have different configuration synchronization versions.
Workaround: Perform one of the following steps:
Perform commit and push as two separate, sequential steps.
Perform a full push instead of selective push.
## PAN-285894 ## PAN-285894
If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots. If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots.
Workaround: Disable the Preserve Pre-NAT feature using the set deviceconfig setting preserve-prenat-feature no CLI command. **Workaround:** Disable the Preserve Pre-NAT feature using the `set deviceconfig setting preserve-prenat-feature no` CLI command.
## PAN-283429 ## PAN-283429
When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted. When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted.
Workaround: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates. **Workaround**: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates.
## PAN-281885 ## PAN-281885
@@ -80,33 +91,52 @@ When exporting and importing the CSV file, the hash values of pre-shared key (PS
## PAN-280532 ## PAN-280532
```caveat
This issue is now resolved. See PAN-OS 11.1.10 Addressed Issues.
```
When you use a single syslog server over TCP for log forwarding, and the connectivity to the syslog server breaks, syslog forwarding does not resume even after the connectivity to the server restores. When you use a single syslog server over TCP for log forwarding, and the connectivity to the syslog server breaks, syslog forwarding does not resume even after the connectivity to the server restores.
Workaround: Performing one of the following tasks: **Workaround:** Performing one of the following tasks:
Reboot the firewall. - Reboot the firewall.
- Temporarily, configure syslog to use UDP, commit the configuration, revert to TCP, and then commit.
Temporarily, configure syslog to use UDP, commit the configuration, revert to TCP, and then commit.
## PAN-280471 ## PAN-280471
When applying filters or searching for logs in the PanoramaMonitorLogs section, you might experience slow performance. When applying filters or searching for logs in the **Panorama** > **Monitor** > **Logs** section, you might experience slow performance.
## PAN-277417 ## PAN-277417
```caveat
This issue is now resolved. See PAN-OS 11.1.9 Addressed Issues.
```
Memory leak issues can occur during the parsing of server certificates used for SSL Inbound Inspection, preventing the firewall from completing inspection. Memory leak issues can occur during the parsing of server certificates used for SSL Inbound Inspection, preventing the firewall from completing inspection.
## PAN-277034 ## PAN-277034
```caveat
This issue is now resolved. See PAN-OS 11.1.10-h5 Addressed Issuesand PAN-OS 11.1.6-h19 Addressed Issues
```
WildFire reports might not fully display or be downloadable because some static resources fail to load. WildFire reports might not fully display or be downloadable because some static resources fail to load.
## PAN-275601 ## PAN-275601
When Panorama is not internet-connected and you try to upload images to the managed firewalls by using the Validate option, the upload fails with the following error: Failed to create multi-upload job. No valid software deploy targets found. ```caveat
This issue is now resolved. See PAN-OS 11.1.10 Addressed Issues
```
When Panorama is not internet-connected and you try to upload images to the managed firewalls by using the **Validate** option, the upload fails with the following error: `Failed to create multi-upload job. No valid software deploy targets found.`
## PAN-273300 ## PAN-273300
When upgrading Panorama from PAN-OS 10.2 or PAN-OS 11.0 to PAN-OS 11.1 or a later release, Panorama fails to upgrade if it is operating within a Collector Group. The following error appears:Error: Traceback (most recent call last):File "/opt/panrepo/releases/<PANOS release version>/validate"... (min ([dts['min'] for dts in 10g_type_intv_dir.values() if dts|'min']])-strftime ('%Y-%m-%d'), ```caveat
This issue is now resolved. See PAN-OS 11.1.6-h1 Addressed Issues
```
When upgrading Panorama from PAN-OS 10.2 or PAN-OS 11.0 to PAN-OS 11.1 or a later release, Panorama fails to upgrade if it is operating within a Collector Group. The following error appears:`Error: Traceback (most recent call last):File "/opt/panrepo/releases/<PANOS release version>/validate"... (min ([dts['min'] for dts in 10g_type_intv_dir.values() if dts|'min']])-strftime ('%Y-%m-%d'),`
## PAN-262556 ## PAN-262556
@@ -126,73 +156,85 @@ The links on the firewall's RJ-45 ports may go up and down additional times duri
## PAN-260851 ## PAN-260851
From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (ObjectsApplications) tag. From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (**Objects** > **Applications**) tag.
## PAN-257615 ## PAN-257615
```caveat
This issue is now resolved. See PAN-OS 11.1.2-h9 Addressed Issues.
```
The Panorama web interface intermittently displays logs or fails to display logs completely. The Panorama web interface intermittently displays logs or fails to display logs completely.
## PAN-259769 ## PAN-259769
GlobalProtect portal is not accessible via a web browser and the app displays the error ERR_EMPTY_RESPONSE. ```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues.
```
GlobalProtect portal is not accessible via a web browser and the app displays the error `ERR_EMPTY_RESPONSE`.
## PAN-250062 ## PAN-250062
```caveat
This issue is now resolved. See PAN-OS 11.1.4-h4 Addressed Issues.
```
Device telemetry might fail at configured intervals due to bundle generation issues. Device telemetry might fail at configured intervals due to bundle generation issues.
## PAN-243951 ## PAN-243951
On the Panorama management sever in an active/passive High Availability (HA) configuration, managed devices (PanoramaManaged DevicesSummary) display as out-of-sync on the passive HA peer when configuration changes are made to the SD-WAN (PanoramaSD-WAN) configuration on the active HA peer. ```caveat
This issue is now resolved. See PAN-OS 11.1.2-h3 Addressed Issues
```
Workaround: Manually synchronize the Panorama HA peers. On the Panorama management sever in an active/passive High Availability (HA) configuration, managed devices (**Panorama** > **Managed Devices** > **Summary**) display as `out-of-sync` on the passive HA peer when configuration changes are made to the SD-WAN (**Panorama** > **SD-WAN**) configuration on the active HA peer.
Log in to the Panorama web interface on the active HA peer. **Workaround:** Manually synchronize the Panorama HA peers.
Log in to the Panorama web interface on the active HA peer. 1. Log in to the [Panorama web interface](https://docs.paloaltonetworks.com/panorama/11-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface) on the active HA peer.
2. Select **Commit** and **Commit to Panorama** the SD-WAN configuration changes on the active HA peer.
Select Commit and Commit to Panorama the SD-WAN configuration changes on the active HA peer. On the passive HA peer, select PanoramaManaged DevicesSummary and observe that the managed devices are now out-of-sync. On the passive HA peer, select **Panorama** > **Managed Devices** > **Summary** and observe that the managed devices are now `out-of-sync`.
3. Log in to the primary HA peer [Panorama CLI](https://docs.paloaltonetworks.com/panorama/11-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli) and trigger a manual synchronization between the active and secondary HA peers.
Select Commit and Commit to Panorama the SD-WAN configuration changes on the active HA peer. *request high-availability sync-to-remote running-config*
4. Log back in to the active HA peer Panorama web interface and select **Commit** > **Push to Devices** and **Push**.
On the passive HA peer, select PanoramaManaged DevicesSummary and observe that the managed devices are now out-of-sync.
Log in to the primary HA peer Panorama CLI and trigger a manual synchronization between the active and secondary HA peers.request high-availability sync-to-remote running-config
Log in to the primary HA peer Panorama CLI and trigger a manual synchronization between the active and secondary HA peers.
request high-availability sync-to-remote running-config
Log back in to the active HA peer Panorama web interface and select CommitPush to Devices and Push.
Log back in to the active HA peer Panorama web interface and select CommitPush to Devices and Push.
## PAN-242910 ## PAN-242910
On the Panorama management server, Panorama administrators (PanoramaAdministrators) that are assigned a custom Panorama admin role (PanoramaAdmin Roles) with Push All Changes enabled are unable to push configuration changes to managed firewalls when Managed Devices and Push For Other Admins are disabled. On the Panorama management server, Panorama administrators (**Panorama** > **Administrators**) that are assigned a custom Panorama admin role (**Panorama** > **Admin Roles**) with **Push All Changes** enabled are unable to push configuration changes to managed firewalls when **Managed Devices** and **Push For Other Admins** are disabled.
## PAN-242561 ## PAN-242561
GlobalProtect tunnel might disconnect shortly after being established when SSL is used as a transport protocol. GlobalProtect tunnel might disconnect shortly after being established when SSL is used as a transport protocol.
Workaround: Disable Internet Protocol version 6 (TCP/IPv6) on the PANGP Virtual Network Adapter. **Workaround**: Disable Internet Protocol version 6 (TCP/IPv6) on the PANGP Virtual Network Adapter.
## PAN-241041 ## PAN-241041
On the Panorama management server exporting template or template stack variables (PanoramaTemplates) in CSV format results in an empty CSV file. ```caveat
This issue is now resolved. See PAN-OS 11.1.3 Addressed Issues
```
On the Panorama management server exporting template or template stack variables (**Panorama** > **Templates**) in CSV format results in an empty CSV file.
## PAN-237106 ## PAN-237106
```caveat
This issue is now resolved. See PAN-OS 11.1.8 Addressed Issues
```
LSVPN satellite certificates may be generated with serial numbers exceeding 40 hexadecimal characters. This causes certificate revocation and deletion operations to fail with the following error messages: LSVPN satellite certificates may be generated with serial numbers exceeding 40 hexadecimal characters. This causes certificate revocation and deletion operations to fail with the following error messages:
db-serialno can be at most 40 characters - `db-serialno can be at most 40 characters`
- `db-serialno is invalid`
db-serialno is invalid **Workaround:**
To resolve this issue, use the following CLI commands with the LSVPN satellite serial number to manually delete or revoke the affected certificates: To resolve this issue, use the following CLI commands with the LSVPN satellite serial number to manually delete or revoke the affected certificates:
Delete certificate information:delete sslmgr-store certificate-info portal name <name> serialno <satellite_serial> **Delete certificate information**:`delete sslmgr-store certificate-info portal name <name> serialno <satellite_serial>`
Revoke satellite certificates:delete sslmgr-store satellite-info-revoke-certificate portal <name> serialno <list_of_satellite_serials> **Revoke satellite certificates**:`delete sslmgr-store satellite-info-revoke-certificate portal <name> serialno <list_of_satellite_serials>`
## PAN-234408 ## PAN-234408
@@ -208,7 +250,7 @@ The X-Forwarded-For (XFF) value is not displayed in traffic logs.
PA-7500 firewalls only PA-7500 firewalls only
``` ```
The CLI commands show logging-status and show logging-status verbose yes do not display aggregate log forwarding statistics on the Management Plane. The CLI commands `show logging-status` and `show logging-status verbose yes` do not display aggregate log forwarding statistics on the Management Plane.
## PAN-228491 ## PAN-228491
@@ -218,33 +260,18 @@ On the AWS environment, the session failover takes up to 4 minutes.
On the Panorama management server, the configuration push to a multi-vsys firewall fails if you: On the Panorama management server, the configuration push to a multi-vsys firewall fails if you:
Create a Shared and vsys-specific device group configuration object with an indentical name. For example, a Shared address object called SharedAO1 and a vsys-specific address object also called SharedAO1. 1. Create a **Shared** and vsys-specific device group configuration object with an indentical name. For example, a **Shared** address object called `SharedAO1` and a vsys-specific address object also called `SharedAO1`.
2. Reference the **Shared** object in another **Shared** configuration. For example, reference the **Shared** address object (`SharedAO1`) in a **Shared** address group called `SharedAG1`.
3. Use the **Shared** configuration object with the reference in a vsys-specific configuration. For example, reference the **Shared** address group (`SharedAG1`) in a vsys-specific policy rule.
Create a Shared and vsys-specific device group configuration object with an indentical name. For example, a Shared address object called SharedAO1 and a vsys-specific address object also called SharedAO1. **Workaround:** Select **Panorama** > **Setup** > **Management** and edit the Panorama Settings to enable one of the following:
Reference the Shared object in another Shared configuration. For example, reference the Shared address object (SharedAO1) in a Shared address group called SharedAG1. - **Shared Unused Address and Service Objects with Devices**—This options pushes all **Shared** objects, along with device group specific objects, to managed firewalls.
This is a global setting and applies to all managed firewalls, and may result in pushing too many configuration objects to your managed firewalls.
- **Objects defined in ancestors will take higher precedence**—This option specifies that in the event of objects with the same name, ancestor object take precedence over descendent objects. In this case, the **Shared** objects take precedence over the vsys-specific object.
This is a global setting and applies to all managed firewalls. In the example above, if the IP address for the **Shared** `SharedAO1` object was `10.1.1.1` and the device group specific `SharedAO1` was `10.2.2.2`, the `10.1.1.1` IP address takes precedence.
Reference the Shared object in another Shared configuration. For example, reference the Shared address object (SharedAO1) in a Shared address group called SharedAG1. Alternatively, you can remove the duplicate address objects from the device group configuration to allow only the **Shared** objects in your configuration.
Use the Shared configuration object with the reference in a vsys-specific configuration. For example, reference the Shared address group (SharedAG1) in a vsys-specific policy rule.
Use the Shared configuration object with the reference in a vsys-specific configuration. For example, reference the Shared address group (SharedAG1) in a vsys-specific policy rule.
Workaround: Select PanoramaSetupManagement and edit the Panorama Settings to enable one of the following:
Shared Unused Address and Service Objects with Devices—This options pushes all Shared objects, along with device group specific objects, to managed firewalls.This is a global setting and applies to all managed firewalls, and may result in pushing too many configuration objects to your managed firewalls.
Shared Unused Address and Service Objects with Devices—This options pushes all Shared objects, along with device group specific objects, to managed firewalls.
This is a global setting and applies to all managed firewalls, and may result in pushing too many configuration objects to your managed firewalls.
Objects defined in ancestors will take higher precedence—This option specifies that in the event of objects with the same name, ancestor object take precedence over descendent objects. In this case, the Shared objects take precedence over the vsys-specific object.This is a global setting and applies to all managed firewalls. In the example above, if the IP address for the Shared SharedAO1 object was 10.1.1.1 and the device group specific SharedAO1 was 10.2.2.2, the 10.1.1.1 IP address takes precedence.
Objects defined in ancestors will take higher precedence—This option specifies that in the event of objects with the same name, ancestor object take precedence over descendent objects. In this case, the Shared objects take precedence over the vsys-specific object.
This is a global setting and applies to all managed firewalls. In the example above, if the IP address for the Shared SharedAO1 object was 10.1.1.1 and the device group specific SharedAO1 was 10.2.2.2, the 10.1.1.1 IP address takes precedence.
Alternatively, you can remove the duplicate address objects from the device group configuration to allow only the Shared objects in your configuration.
## PAN-224502 ## PAN-224502
@@ -256,35 +283,39 @@ The autocommit time of the VM-Series firewall running PAN-OS 11.1.0 might take l
PA-7500 firewall only PA-7500 firewall only
``` ```
The CLI command show running resource-monitor ingress-backlogs does not display the correct usage values. The CLI command `show running resource-monitor ingress-backlogs` does not display the correct usage values.
## PAN-220577 ## PAN-220577
With firewalls in AWS environment that are licensed with VM capacity and secure web proxy licenses, it is observed that the enablement of the web-proxy config fails. With firewalls in AWS environment that are licensed with VM capacity and secure web proxy licenses, it is observed that the enablement of the web-proxy config fails.
Workaround: Reboot the firewall after the web proxy license is applied. **Workaround:** Reboot the firewall after the web proxy license is applied.
## PAN-220180 ## PAN-220180
Configured botnet reports (MonitorBotnet) are not generated. Configured botnet reports (**Monitor** > **Botnet**) are not generated.
## PAN-217307 ## PAN-217307
The following Security policy rule (PoliciesSecurity) filters return no results: ```caveat
This issue is now resolved. See PAN-OS 11.1.3 Addressed Issues.
```
log-start eq no The following Security policy rule (**Policies** > **Security**) filters return no results:
log-end eq no `log-start eq no`
log-end eq yes `log-end eq no`
`log-end eq yes`
## PAN-208794 ## PAN-208794
In firewalls with transparent proxy, it is observed that a reboot is necessary to view the transit sessions. In firewalls with transparent proxy, it is observed that a reboot is necessary to view the transit sessions.
Workaround: Edit the virtual router settings with any minor change and commit again. Any changes to the network/interfaces or network/virtual routers usually fixes this issue. **Workaround**: Edit the virtual router settings with any minor change and commit again. Any changes to the network/interfaces or network/virtual routers usually fixes this issue.
Alternatively, you may try rebooting the firewall. This issue disappears following reboot after the swg is setup and configured. Alternatively, you may try rebooting the firewall. This issue disappears following reboot after the `swg` is setup and configured.
## PAN-207733 ## PAN-207733
@@ -296,21 +327,13 @@ When a DHCPv6 client is configured on HA Active/Passive firewalls, the Passive f
## PAN-207442 ## PAN-207442
For M-700 appliances in an active/passive high availability (PanoramaHigh Availability) configuration, the active-primary HA peer configuration sync to the secondary-passive HA peer may fail. When the config sync fails, the job Results is Successful (Tasks), however the sync status on the Dashboard displays as Out of Sync for both HA peers. For M-700 appliances in an active/passive high availability (**Panorama** > **High Availability**) configuration, the `active-primary` HA peer configuration sync to the `secondary-passive` HA peer may fail. When the config sync fails, the job Results is `Successful` (**Tasks**), however the sync status on the **Dashboard** displays as `Out of Sync` for both HA peers.
Workaround: Perform a local commit on the active-primary HA peer and then synchronize the HA configuration. **Workaround**: Perform a local commit on the `active-primary` HA peer and then synchronize the HA configuration.
Log in to the Panorama web interface of the active-primary HA peer. 1. [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface) of the `active-primary` HA peer.
2. Select **Commit** and **Commit to Panorama**.
Log in to the Panorama web interface of the active-primary HA peer. 3. In the `active-primary` HA peer **Dashboard**, click **Sync to Peer** in the High Availability widget.
Select Commit and Commit to Panorama.
Select Commit and Commit to Panorama.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
## PAN-207040 ## PAN-207040
@@ -318,37 +341,18 @@ If you disable Advanced Routing, remove logical routers, and downgrade from PAN-
## PAN-206909 ## PAN-206909
The Dedicated Log Collector is unable to reconnect to the Panorama management server if the configd process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection Status (PanoramaManaged Collector) displaying connected and the managed colletor Health status displaying as healthy. The Dedicated Log Collector is unable to reconnect to the Panorama management server if the `configd` process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection `Status` (**Panorama** > **Managed Collector**) displaying `connected` and the managed colletor `Health` status displaying as healthy.
This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted. This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted.
Workaround: Restart the mgmtsrvr process on the Dedicated Log Collector. **Workaround:** Restart the `mgmtsrvr` process on the Dedicated Log Collector.
Log in to the Dedicated Log Collector CLI. 1. [Log in to the Dedicated Log Collector CLI](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli).
2. Confirm the Dedicated Log Collector is disconnected from Panorama.
Log in to the Dedicated Log Collector CLI. `admin>``show panorama-status`
Verify the `Connected` status is `no`.
Confirm the Dedicated Log Collector is disconnected from Panorama.admin> show panorama-status Verify the Connected status is no. 3. Restart the `mgmtsrvr` process.
`admin>``debug software restart process management-server`
Confirm the Dedicated Log Collector is disconnected from Panorama.
admin> show panorama-status Verify the Connected status is no.
admin> show panorama-status
admin> show panorama-status
Verify the Connected status is no.
Restart the mgmtsrvr process.admin> debug software restart process management-server
Restart the mgmtsrvr process.
admin> debug software restart process management-server
admin> debug software restart process management-server
admin> debug software restart process management-server
## PAN-197588 ## PAN-197588
@@ -360,11 +364,11 @@ The PAN-OS ACC (Application Command Center) does not display a widget detailing
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, the power over Ethernet (PoE) ports do not display a Tag value. In **Network** > **Interface** > **Ethernet**, the power over Ethernet (PoE) ports do not display a **Tag** value.
## PAN-196758 ## PAN-196758
On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you Preview Changes (CommitPush to DevicesEdit Selections or CommitCommit and PushEdit Selections). On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you **Preview Changes** (**Commit** > **Push to Devices** > **Edit Selections** or **Commit** > **Commit and Push** > **Edit Selections**).
## PAN-195968 ## PAN-195968
@@ -380,23 +384,23 @@ When using the CLI to configure power over Ethernet (PoE) on a non-PoE port, the
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, hovering the mouse over a power over Ethernet (PoE) Link State icon does not display link speed and link duplex details. In **Network** > **Interface** > **Ethernet**, hovering the mouse over a power over Ethernet (PoE) **Link State** icon does not display link speed and link duplex details.
## PAN-187685 ## PAN-187685
On the Panorama management server, the Template Status displays no synchronization status (PanoramaManaged DevicesSummary) after a bootstrapped firewall is successfully added to Panorama. On the Panorama management server, the Template Status displays no synchronization status (**Panorama** > **Managed Devices** > **Summary**) after a bootstrapped firewall is successfully added to Panorama.
Workaround: After the bootstrapped firewall is successfully added to Panorama, log in to the Panorama web interface and select CommitPush to Devices. **Workaround:** After the bootstrapped firewall is successfully added to Panorama, [log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) and select **Commit** > **Push to Devices**.
## PAN-187407 ## PAN-187407
The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to Hold client request for category lookup and the action set to Reset-Both and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed. The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to **Hold client request for category lookup**and the action set to **Reset-Both** and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed.
## PAN-186283 ## PAN-186283
Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS. Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS.
Workaround: Use CommitPush to Devices to synchronize the templates. **Workaround**: Use **Commit** > **Push to Devices** to synchronize the templates.
## PAN-184708 ## PAN-184708
@@ -404,29 +408,24 @@ Workaround: Use CommitPush to Devices to synchronize the templates.
Panorama managed firewalls Panorama managed firewalls
``` ```
Scheduled report emails (MonitorPDF ReportsEmail Scheduler) are not emailed if: Scheduled report emails (**Monitor** > **PDF Reports** > **Email Scheduler**) are not emailed if:
A scheduled report email contains a Report Group (MonitorPDF ReportsReport Group) which includes a SaaS Application Usage report. - A scheduled report email contains a Report Group (**Monitor** > **PDF Reports** > **Report Group**) which includes a SaaS Application Usage report.
- A scheduled report contains only a SaaS Application Usage Report.
A scheduled report contains only a SaaS Application Usage Report. **Workaround:** To receive a scheduled report email for all other PDF report types:
Workaround: To receive a scheduled report email for all other PDF report types: 1. Select **Monitor** > **PDF Reports** > **Report Groups** and remove all SaaS Application Usage reports from all Report Groups.
2. Select **Monitor** > **PDF Reports** > **Email Scheduler** and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select **Disable** and click **OK**.
Select MonitorPDF ReportsReport Groups and remove all SaaS Application Usage reports from all Report Groups. Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
3. **Commit**.
Select MonitorPDF ReportsEmail Scheduler and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select Disable and click OK.Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report. () Select **Commit** > **Commit and Push**
Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
Commit.() Select CommitCommit and Push
() Select CommitCommit and Push
## PAN-184406 ## PAN-184406
Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash. Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash.
Workaround: Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance. **Workaround:** Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance.
## PAN-183404 ## PAN-183404
@@ -438,4 +437,8 @@ If you use multiple log forwarding cards (LFCs) on the PA-7000 series, all of th
## PAN-164885 ## PAN-164885
On the Panorama management server, pushes to managed firewalls (CommitPush to Devices or Commit and Push) may fail when an EDL (ObjectsExternal Dynamic Lists) is configured to Check for updates every 5 minutes due to the commit and EDL fetch processes overlapping. This is more likely to occur when multiple EDLs are configured to check for updates every 5 minutes. ```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
On the Panorama management server, pushes to managed firewalls (**Commit** > **Push to Devices** or **Commit and Push**) may fail when an EDL (**Objects** > **External Dynamic Lists**) is configured to **Check for updates** every 5 minutes due to the commit and EDL fetch processes overlapping. This is more likely to occur when multiple EDLs are configured to check for updates every 5 minutes.
web/data/issues/PAN-OS/known/11.1.1.md
+170 -147
View File
@@ -6,18 +6,38 @@ version: 11.1.1
## PAN-304756 ## PAN-304756
```caveat
This issue is now resolved. See PAN-OS 11.1.13-h1 Addressed Issues.
```
After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems. After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems.
## PAN-298505 ## PAN-298505
```caveat
This issue is now resolved. See PAN-OS 11.1.6-h20 Addressed Issues, PAN-OS 11.1.10-h7 Addressed Issues, and PAN-OS 11.1.12 Addressed Issues
```
After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing auto-commit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems managed by Panorama, and the vsys ID sequence breaks when unused virtual systems are deleted and the changes are pushed to the firewall. After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing auto-commit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems managed by Panorama, and the vsys ID sequence breaks when unused virtual systems are deleted and the changes are pushed to the firewall.
## PAN-294179
```caveat
This issue is now resolved. See PAN-OS 11.1.6-h17 Addressed Issues.
```
On the**Panorama Config Audit** page, some commit versions might display incorrect or missing data. Fields such as, **COMMITTED BY**, **COMMIT DATE**, and**OBJECT CHANGES** might not be visible for some commit versions. Sometimes, commit versions can disappear after a refresh and the commit description field might display corrupted characters.
## PAN-291288 ## PAN-291288
An active firewall might unexpectedly reboot due to a pan_task crash caused by a page allocation failure. This issue is observed after a period of runtime with traffic and telemetry collection. An active firewall might unexpectedly reboot due to a pan_task crash caused by a page allocation failure. This issue is observed after a period of runtime with traffic and telemetry collection.
## PAN-290088 ## PAN-290088
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
When pushing configurations from Panorama to a firewall, a memory leak might occur in the firewall's configd process, particularly when the configurations contain shared policies. Each configuration push causes the configd process to consume additional memory that is not released after the commit completes. When pushing configurations from Panorama to a firewall, a memory leak might occur in the firewall's configd process, particularly when the configurations contain shared policies. Each configuration push causes the configd process to consume additional memory that is not released after the commit completes.
## PAN-289383 ## PAN-289383
@@ -28,47 +48,46 @@ PA-800 series firewalls only
Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation. Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation.
Workaround: Enable auto-negotiation on the connected peer firewall. **Workaround:** Enable auto-negotiation on the connected peer firewall.
## PAN-288097 ## PAN-288097
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
Routed process may stop responding after changing MTU or any link parameters when OSPF and PIM are enabled on the same interface. Routed process may stop responding after changing MTU or any link parameters when OSPF and PIM are enabled on the same interface.
## PAN-286231 ## PAN-286231
When performing a partial Commit and Push on Panorama, there is a risk that unintended configuration changes might be pushed to a firewall. ```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
This issue is more likely to occur in the following scenarios:When you run Commit and Push operations as a single action.When you trigger multiple parallel commit-all jobs at the same time.Device groups and templates have different configuration synchronization versions. When performing a partial **Commit and Push** on Panorama, there is a risk that unintended configuration changes might be pushed to a firewall.
When you run Commit and Push operations as a single action. This issue is more likely to occur in the following scenarios:
When you run Commit and Push operations as a single action. - When you run **Commit and Push** operations as a single action.
- When you trigger multiple parallel commit-all jobs at the same time.
- Device groups and templates have different configuration synchronization versions.
When you trigger multiple parallel commit-all jobs at the same time. **Workaround:** Perform one of the following steps:
When you trigger multiple parallel commit-all jobs at the same time. - Perform commit and push as two separate, sequential steps.
- Perform a full push instead of selective push.
Device groups and templates have different configuration synchronization versions.
Device groups and templates have different configuration synchronization versions.
Workaround: Perform one of the following steps:
Perform commit and push as two separate, sequential steps.
Perform a full push instead of selective push.
## PAN-285894 ## PAN-285894
If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots. If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots.
Workaround: Disable the Preserve Pre-NAT feature using the set deviceconfig setting preserve-prenat-feature no CLI command. **Workaround:** Disable the Preserve Pre-NAT feature using the `set deviceconfig setting preserve-prenat-feature no` CLI command.
## PAN-283429 ## PAN-283429
When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted. When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted.
Workaround: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates. **Workaround**: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates.
## PAN-281885 ## PAN-281885
@@ -76,20 +95,27 @@ When exporting and importing the CSV file, the hash values of pre-shared key (PS
## PAN-280532 ## PAN-280532
```caveat
This issue is now resolved. See PAN-OS 11.1.10 Addressed Issues.
```
When you use a single syslog server over TCP for log forwarding, and the connectivity to the syslog server breaks, syslog forwarding does not resume even after the connectivity to the server restores. When you use a single syslog server over TCP for log forwarding, and the connectivity to the syslog server breaks, syslog forwarding does not resume even after the connectivity to the server restores.
Workaround: Performing one of the following tasks: **Workaround:** Performing one of the following tasks:
Reboot the firewall. - Reboot the firewall.
- Temporarily, configure syslog to use UDP, commit the configuration, revert to TCP, and then commit.
Temporarily, configure syslog to use UDP, commit the configuration, revert to TCP, and then commit.
## PAN-280471 ## PAN-280471
When applying filters or searching for logs in the PanoramaMonitorLogssection, you might experience slow performance. When applying filters or searching for logs in the **Panorama** > **Monitor** > **Logs**section, you might experience slow performance.
## PAN-279415 ## PAN-279415
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
Service routes configured for a data plane interface might incorrectly route traffic through the management plane interface instead. This issue impacts Syslog and CRL status traffic when the service route lacks a specific destination custom service route. Service routes configured for a data plane interface might incorrectly route traffic through the management plane interface instead. This issue impacts Syslog and CRL status traffic when the service route lacks a specific destination custom service route.
## PAN-278296 ## PAN-278296
@@ -98,22 +124,42 @@ The system MAC address of the aggregate interface is the same on both the active
## PAN-277417 ## PAN-277417
```caveat
This issue is now resolved. See PAN-OS 11.1.9 Addressed Issues.
```
Memory leak issues can occur during the parsing of server certificates used for SSL Inbound Inspection, preventing the firewall from completing inspection. Memory leak issues can occur during the parsing of server certificates used for SSL Inbound Inspection, preventing the firewall from completing inspection.
## PAN-277034 ## PAN-277034
```caveat
This issue is now resolved. See PAN-OS 11.1.10-h5 Addressed Issuesand PAN-OS 11.1.6-h19 Addressed Issues
```
WildFire reports might not fully display or be downloadable because some static resources fail to load. WildFire reports might not fully display or be downloadable because some static resources fail to load.
## PAN-275601 ## PAN-275601
When Panorama is not internet-connected and you try to upload images to the managed firewalls by using the Validate option, the upload fails with the following error: Failed to create multi-upload job. No valid software deploy targets found. ```caveat
This issue is now resolved. See PAN-OS 11.1.10 Addressed Issues
```
When Panorama is not internet-connected and you try to upload images to the managed firewalls by using the **Validate** option, the upload fails with the following error: `Failed to create multi-upload job. No valid software deploy targets found.`
## PAN-273300 ## PAN-273300
When upgrading Panorama from PAN-OS 10.2 or PAN-OS 11.0 to PAN-OS 11.1 or a later release, Panorama fails to upgrade if it is operating within a Collector Group. The following error appears:Error: Traceback (most recent call last):File "/opt/panrepo/releases/<PANOS release version>/validate"... (min ([dts['min'] for dts in 10g_type_intv_dir.values() if dts|'min']])-strftime ('%Y-%m-%d'), ```caveat
This issue is now resolved. See PAN-OS 11.1.6-h1 Addressed Issues
```
When upgrading Panorama from PAN-OS 10.2 or PAN-OS 11.0 to PAN-OS 11.1 or a later release, Panorama fails to upgrade if it is operating within a Collector Group. The following error appears:`Error: Traceback (most recent call last):File "/opt/panrepo/releases/<PANOS release version>/validate"... (min ([dts['min'] for dts in 10g_type_intv_dir.values() if dts|'min']])-strftime ('%Y-%m-%d'),`
## PAN-263987 ## PAN-263987
```caveat
This issue is now resolved. See PAN-OS 11.1.4-h4 Addressed Issues.
```
When a NAT traversal (NAT-T or UDP encapsulation) IPSec tunnel is terminated on a Palo Alto Networks firewall and the NAT rule applied to the NAT-T IPSec tunnel is also on the same firewall, then the data traffic flowing through the NAT-T IPSec tunnel can't be NATed correctly. When a NAT traversal (NAT-T or UDP encapsulation) IPSec tunnel is terminated on a Palo Alto Networks firewall and the NAT rule applied to the NAT-T IPSec tunnel is also on the same firewall, then the data traffic flowing through the NAT-T IPSec tunnel can't be NATed correctly.
## PAN-262556 ## PAN-262556
@@ -126,49 +172,52 @@ Dereferencing a NULL pointer that occurs might cause pan_task processes to crash
## PAN-260851 ## PAN-260851
From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (ObjectsApplications) tag. From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (**Objects** > **Applications**) tag.
## PAN-259769 ## PAN-259769
GlobalProtect portal is not accessible via a web browser and the app displays the error ERR_EMPTY_RESPONSE. ```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues.
```
GlobalProtect portal is not accessible via a web browser and the app displays the error `ERR_EMPTY_RESPONSE`.
## PAN-257615 ## PAN-257615
```caveat
This issue is now resolved. See PAN-OS 11.1.2-h9 Addressed Issues.
```
The Panorama web interface intermittently displays logs or fails to display logs completely. The Panorama web interface intermittently displays logs or fails to display logs completely.
## PAN-250062 ## PAN-250062
```caveat
This issue is now resolved. See PAN-OS 11.1.4-h4 Addressed Issues.
```
Device telemetry might fail at configured intervals due to bundle generation issues. Device telemetry might fail at configured intervals due to bundle generation issues.
## PAN-243951 ## PAN-243951
On the Panorama management sever in an active/passive High Availability (HA) configuration, managed devices (PanoramaManaged DevicesSummary) display as out-of-sync on the passive HA peer when configuration changes are made to the SD-WAN (PanoramaSD-WAN) configuration on the active HA peer. ```caveat
This issue is now resolved. See PAN-OS 11.1.2-h3 Addressed Issues
```
Workaround: Manually synchronize the Panorama HA peers. On the Panorama management sever in an active/passive High Availability (HA) configuration, managed devices (**Panorama** > **Managed Devices** > **Summary**) display as `out-of-sync` on the passive HA peer when configuration changes are made to the SD-WAN (**Panorama** > **SD-WAN**) configuration on the active HA peer.
Log in to the Panorama web interface on the active HA peer. **Workaround:** Manually synchronize the Panorama HA peers.
Log in to the Panorama web interface on the active HA peer. 1. Log in to the [Panorama web interface](https://docs.paloaltonetworks.com/panorama/11-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface) on the active HA peer.
2. Select **Commit** and **Commit to Panorama** the SD-WAN configuration changes on the active HA peer.
Select Commit and Commit to Panorama the SD-WAN configuration changes on the active HA peer. On the passive HA peer, select PanoramaManaged DevicesSummary and observe that the managed devices are now out-of-sync. On the passive HA peer, select **Panorama** > **Managed Devices** > **Summary** and observe that the managed devices are now `out-of-sync`.
3. Log in to the primary HA peer [Panorama CLI](https://docs.paloaltonetworks.com/panorama/11-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli) and trigger a manual synchronization between the active and secondary HA peers.
Select Commit and Commit to Panorama the SD-WAN configuration changes on the active HA peer. *request high-availability sync-to-remote running-config*
4. Log back in to the active HA peer Panorama web interface and select **Commit** > **Push to Devices** and **Push**.
On the passive HA peer, select PanoramaManaged DevicesSummary and observe that the managed devices are now out-of-sync.
Log in to the primary HA peer Panorama CLI and trigger a manual synchronization between the active and secondary HA peers.request high-availability sync-to-remote running-config
Log in to the primary HA peer Panorama CLI and trigger a manual synchronization between the active and secondary HA peers.
request high-availability sync-to-remote running-config
Log back in to the active HA peer Panorama web interface and select CommitPush to Devices and Push.
Log back in to the active HA peer Panorama web interface and select CommitPush to Devices and Push.
## PAN-242910 ## PAN-242910
On the Panorama management server, Panorama administrators (PanoramaAdministrators) that are assigned a custom Panorama admin role (PanoramaAdmin Roles) with Push All Changes enabled are unable to push configuration changes to managed firewalls when Managed Devices and Push For Other Admins are disabled. On the Panorama management server, Panorama administrators (**Panorama** > **Administrators**) that are assigned a custom Panorama admin role (**Panorama** > **Admin Roles**) with **Push All Changes** enabled are unable to push configuration changes to managed firewalls when **Managed Devices** and **Push For Other Admins** are disabled.
## PAN-242837 ## PAN-242837
@@ -178,21 +227,26 @@ Default login credentials and SSH fail after enabling FIPS-CC Mode on a firewall
GlobalProtect tunnel might disconnect shortly after being established when SSL is used as a transport protocol. GlobalProtect tunnel might disconnect shortly after being established when SSL is used as a transport protocol.
Workaround: Disable Internet Protocol version 6 (TCP/IPv6) on the PANGP Virtual Network Adapter. **Workaround**: Disable Internet Protocol version 6 (TCP/IPv6) on the PANGP Virtual Network Adapter.
## PAN-237106 ## PAN-237106
```caveat
This issue is now resolved. See PAN-OS 11.1.8 Addressed Issues
```
LSVPN satellite certificates may be generated with serial numbers exceeding 40 hexadecimal characters. This causes certificate revocation and deletion operations to fail with the following error messages: LSVPN satellite certificates may be generated with serial numbers exceeding 40 hexadecimal characters. This causes certificate revocation and deletion operations to fail with the following error messages:
db-serialno can be at most 40 characters - `db-serialno can be at most 40 characters`
- `db-serialno is invalid`
db-serialno is invalid **Workaround:**
To resolve this issue, use the following CLI commands with the LSVPN satellite serial number to manually delete or revoke the affected certificates: To resolve this issue, use the following CLI commands with the LSVPN satellite serial number to manually delete or revoke the affected certificates:
Delete certificate information:delete sslmgr-store certificate-info portal name <name> serialno <satellite_serial> **Delete certificate information**:`delete sslmgr-store certificate-info portal name <name> serialno <satellite_serial>`
Revoke satellite certificates:delete sslmgr-store satellite-info-revoke-certificate portal <name> serialno <list_of_satellite_serials> **Revoke satellite certificates**:`delete sslmgr-store satellite-info-revoke-certificate portal <name> serialno <list_of_satellite_serials>`
## PAN-238769 ## PAN-238769
@@ -200,7 +254,11 @@ FIPS-CC VM only. Upgrading to 10.1.10-h2 or 10.1.11 will change all locally crea
## PAN-241041 ## PAN-241041
On the Panorama management server exporting template or template stack variables (PanoramaTemplates) in CSV format results in an empty CSV file. ```caveat
This issue is now resolved. See PAN-OS 11.1.3 Addressed Issues
```
On the Panorama management server exporting template or template stack variables (**Panorama** > **Templates**) in CSV format results in an empty CSV file.
## PAN-234015 ## PAN-234015
@@ -208,35 +266,24 @@ The X-Forwarded-For (XFF) value is not displayed in traffic logs.
## PAN-225337 ## PAN-225337
```caveat
This issue is now resolved. See PAN-OS 11.1.2 Addressed Issues
```
On the Panorama management server, the configuration push to a multi-vsys firewall fails if you: On the Panorama management server, the configuration push to a multi-vsys firewall fails if you:
Create a Shared and vsys-specific device group configuration object with an indentical name. For example, a Shared address object called SharedAO1 and a vsys-specific address object also called SharedAO1. 1. Create a **Shared** and vsys-specific device group configuration object with an indentical name. For example, a **Shared** address object called `SharedAO1` and a vsys-specific address object also called `SharedAO1`.
2. Reference the **Shared** object in another **Shared** configuration. For example, reference the **Shared** address object (`SharedAO1`) in a **Shared** address group called `SharedAG1`.
3. Use the **Shared** configuration object with the reference in a vsys-specific configuration. For example, reference the **Shared** address group (`SharedAG1`) in a vsys-specific policy rule.
Create a Shared and vsys-specific device group configuration object with an indentical name. For example, a Shared address object called SharedAO1 and a vsys-specific address object also called SharedAO1. **Workaround:** Select **Panorama** > **Setup** > **Management** and edit the Panorama Settings to enable one of the following:
Reference the Shared object in another Shared configuration. For example, reference the Shared address object (SharedAO1) in a Shared address group called SharedAG1. - **Shared Unused Address and Service Objects with Devices**—This options pushes all **Shared** objects, along with device group specific objects, to managed firewalls.
This is a global setting and applies to all managed firewalls, and may result in pushing too many configuration objects to your managed firewalls.
- **Objects defined in ancestors will take higher precedence**—This option specifies that in the event of objects with the same name, ancestor object take precedence over descendent objects. In this case, the **Shared** objects take precedence over the vsys-specific object.
This is a global setting and applies to all managed firewalls. In the example above, if the IP address for the **Shared** `SharedAO1` object was `10.1.1.1` and the device group specific `SharedAO1` was `10.2.2.2`, the `10.1.1.1` IP address takes precedence.
Reference the Shared object in another Shared configuration. For example, reference the Shared address object (SharedAO1) in a Shared address group called SharedAG1. Alternatively, you can remove the duplicate address objects from the device group configuration to allow only the **Shared** objects in your configuration.
Use the Shared configuration object with the reference in a vsys-specific configuration. For example, reference the Shared address group (SharedAG1) in a vsys-specific policy rule.
Use the Shared configuration object with the reference in a vsys-specific configuration. For example, reference the Shared address group (SharedAG1) in a vsys-specific policy rule.
Workaround: Select PanoramaSetupManagement and edit the Panorama Settings to enable one of the following:
Shared Unused Address and Service Objects with Devices—This options pushes all Shared objects, along with device group specific objects, to managed firewalls.This is a global setting and applies to all managed firewalls, and may result in pushing too many configuration objects to your managed firewalls.
Shared Unused Address and Service Objects with Devices—This options pushes all Shared objects, along with device group specific objects, to managed firewalls.
This is a global setting and applies to all managed firewalls, and may result in pushing too many configuration objects to your managed firewalls.
Objects defined in ancestors will take higher precedence—This option specifies that in the event of objects with the same name, ancestor object take precedence over descendent objects. In this case, the Shared objects take precedence over the vsys-specific object.This is a global setting and applies to all managed firewalls. In the example above, if the IP address for the Shared SharedAO1 object was 10.1.1.1 and the device group specific SharedAO1 was 10.2.2.2, the 10.1.1.1 IP address takes precedence.
Objects defined in ancestors will take higher precedence—This option specifies that in the event of objects with the same name, ancestor object take precedence over descendent objects. In this case, the Shared objects take precedence over the vsys-specific object.
This is a global setting and applies to all managed firewalls. In the example above, if the IP address for the Shared SharedAO1 object was 10.1.1.1 and the device group specific SharedAO1 was 10.2.2.2, the 10.1.1.1 IP address takes precedence.
Alternatively, you can remove the duplicate address objects from the device group configuration to allow only the Shared objects in your configuration.
## PAN-224502 ## PAN-224502
@@ -244,17 +291,21 @@ The autocommit time of the VM-Series firewall running PAN-OS 11.1.0 might take l
## PAN-220180 ## PAN-220180
Configured botnet reports (MonitorBotnet) are not generated. Configured botnet reports (**Monitor** > **Botnet**) are not generated.
## PAN-217307 ## PAN-217307
The following Security policy rule (PoliciesSecurity) filters return no results: ```caveat
This issue is now resolved. See PAN-OS 11.1.3 Addressed Issues.
```
log-start eq no The following Security policy rule (**Policies** > **Security**) filters return no results:
log-end eq no `log-start eq no`
log-end eq yes `log-end eq no`
`log-end eq yes`
## PAN-207733 ## PAN-207733
@@ -266,21 +317,13 @@ When a DHCPv6 client is configured on HA Active/Passive firewalls, the Passive f
## PAN-207442 ## PAN-207442
For M-700 appliances in an active/passive high availability (PanoramaHigh Availability) configuration, the active-primary HA peer configuration sync to the secondary-passive HA peer may fail. When the config sync fails, the job Results is Successful (Tasks), however the sync status on the Dashboard displays as Out of Sync for both HA peers. For M-700 appliances in an active/passive high availability (**Panorama** > **High Availability**) configuration, the `active-primary` HA peer configuration sync to the `secondary-passive` HA peer may fail. When the config sync fails, the job Results is `Successful` (**Tasks**), however the sync status on the **Dashboard** displays as `Out of Sync` for both HA peers.
Workaround: Perform a local commit on the active-primary HA peer and then synchronize the HA configuration. **Workaround**: Perform a local commit on the `active-primary` HA peer and then synchronize the HA configuration.
Log in to the Panorama web interface of the active-primary HA peer. 1. [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface) of the `active-primary` HA peer.
2. Select **Commit** and **Commit to Panorama**.
Log in to the Panorama web interface of the active-primary HA peer. 3. In the `active-primary` HA peer **Dashboard**, click **Sync to Peer** in the High Availability widget.
Select Commit and Commit to Panorama.
Select Commit and Commit to Panorama.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
## PAN-207040 ## PAN-207040
@@ -288,37 +331,18 @@ If you disable Advanced Routing, remove logical routers, and downgrade from PAN-
## PAN-206909 ## PAN-206909
The Dedicated Log Collector is unable to reconnect to the Panorama management server if the configd process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection Status (PanoramaManaged Collector) displaying connected and the managed colletor Health status displaying as healthy. The Dedicated Log Collector is unable to reconnect to the Panorama management server if the `configd` process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection `Status` (**Panorama** > **Managed Collector**) displaying `connected` and the managed colletor `Health` status displaying as healthy.
This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted. This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted.
Workaround: Restart the mgmtsrvr process on the Dedicated Log Collector. **Workaround:** Restart the `mgmtsrvr` process on the Dedicated Log Collector.
Log in to the Dedicated Log Collector CLI. 1. [Log in to the Dedicated Log Collector CLI](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli).
2. Confirm the Dedicated Log Collector is disconnected from Panorama.
Log in to the Dedicated Log Collector CLI. `admin>``show panorama-status`
Verify the `Connected` status is `no`.
Confirm the Dedicated Log Collector is disconnected from Panorama.admin> show panorama-status Verify the Connected status is no. 3. Restart the `mgmtsrvr` process.
`admin>``debug software restart process management-server`
Confirm the Dedicated Log Collector is disconnected from Panorama.
admin> show panorama-status Verify the Connected status is no.
admin> show panorama-status
admin> show panorama-status
Verify the Connected status is no.
Restart the mgmtsrvr process.admin> debug software restart process management-server
Restart the mgmtsrvr process.
admin> debug software restart process management-server
admin> debug software restart process management-server
admin> debug software restart process management-server
## PAN-197588 ## PAN-197588
@@ -330,11 +354,11 @@ The PAN-OS ACC (Application Command Center) does not display a widget detailing
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, the power over Ethernet (PoE) ports do not display a Tag value. In **Network** > **Interface** > **Ethernet**, the power over Ethernet (PoE) ports do not display a **Tag** value.
## PAN-196758 ## PAN-196758
On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you Preview Changes (CommitPush to DevicesEdit Selections or CommitCommit and PushEdit Selections). On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you **Preview Changes** (**Commit** > **Push to Devices** > **Edit Selections** or **Commit** > **Commit and Push** > **Edit Selections**).
## PAN-195968 ## PAN-195968
@@ -350,23 +374,23 @@ When using the CLI to configure power over Ethernet (PoE) on a non-PoE port, the
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, hovering the mouse over a power over Ethernet (PoE) Link State icon does not display link speed and link duplex details. In **Network** > **Interface** > **Ethernet**, hovering the mouse over a power over Ethernet (PoE) **Link State** icon does not display link speed and link duplex details.
## PAN-187685 ## PAN-187685
On the Panorama management server, the Template Status displays no synchronization status (PanoramaManaged DevicesSummary) after a bootstrapped firewall is successfully added to Panorama. On the Panorama management server, the Template Status displays no synchronization status (**Panorama** > **Managed Devices** > **Summary**) after a bootstrapped firewall is successfully added to Panorama.
Workaround: After the bootstrapped firewall is successfully added to Panorama, log in to the Panorama web interface and select CommitPush to Devices. **Workaround:** After the bootstrapped firewall is successfully added to Panorama, [log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) and select **Commit** > **Push to Devices**.
## PAN-187407 ## PAN-187407
The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to Hold client request for category lookup and the action set to Reset-Both and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed. The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to **Hold client request for category lookup**and the action set to **Reset-Both** and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed.
## PAN-186283 ## PAN-186283
Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS. Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS.
Workaround: Use CommitPush to Devices to synchronize the templates. **Workaround**: Use **Commit** > **Push to Devices** to synchronize the templates.
## PAN-184708 ## PAN-184708
@@ -374,29 +398,24 @@ Workaround: Use CommitPush to Devices to synchronize the templates.
Panorama managed firewalls Panorama managed firewalls
``` ```
Scheduled report emails (MonitorPDF ReportsEmail Scheduler) are not emailed if: Scheduled report emails (**Monitor** > **PDF Reports** > **Email Scheduler**) are not emailed if:
A scheduled report email contains a Report Group (MonitorPDF ReportsReport Group) which includes a SaaS Application Usage report. - A scheduled report email contains a Report Group (**Monitor** > **PDF Reports** > **Report Group**) which includes a SaaS Application Usage report.
- A scheduled report contains only a SaaS Application Usage Report.
A scheduled report contains only a SaaS Application Usage Report. **Workaround:** To receive a scheduled report email for all other PDF report types:
Workaround: To receive a scheduled report email for all other PDF report types: 1. Select **Monitor** > **PDF Reports** > **Report Groups** and remove all SaaS Application Usage reports from all Report Groups.
2. Select **Monitor** > **PDF Reports** > **Email Scheduler** and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select **Disable** and click **OK**.
Select MonitorPDF ReportsReport Groups and remove all SaaS Application Usage reports from all Report Groups. Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
3. **Commit**.
Select MonitorPDF ReportsEmail Scheduler and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select Disable and click OK.Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report. () Select **Commit** > **Commit and Push**
Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
Commit.() Select CommitCommit and Push
() Select CommitCommit and Push
## PAN-184406 ## PAN-184406
Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash. Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash.
Workaround: Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance. **Workaround:** Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance.
## PAN-183404 ## PAN-183404
@@ -408,4 +427,8 @@ If you use multiple log forwarding cards (LFCs) on the PA-7000 series, all of th
## PAN-164885 ## PAN-164885
On the Panorama management server, pushes to managed firewalls (CommitPush to Devices or Commit and Push) may fail when an EDL (ObjectsExternal Dynamic Lists) is configured to Check for updates every 5 minutes due to the commit and EDL fetch processes overlapping. This is more likely to occur when multiple EDLs are configured to check for updates every 5 minutes. ```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
On the Panorama management server, pushes to managed firewalls (**Commit** > **Push to Devices** or **Commit and Push**) may fail when an EDL (**Objects** > **External Dynamic Lists**) is configured to **Check for updates** every 5 minutes due to the commit and EDL fetch processes overlapping. This is more likely to occur when multiple EDLs are configured to check for updates every 5 minutes.
web/data/issues/PAN-OS/known/11.1.10.md
+152 -134
View File
@@ -4,58 +4,80 @@ product: PAN-OS
version: 11.1.10 version: 11.1.10
--- ---
## PAN-308564
Packets are dropped on SD-WAN interfaces if they require fragmentation for an interface but have the **Don't Fragment (DF)** bit set. This results in unexpected packet drops. This affects client to server sessions when using SD-WAN for NGFW.
**Workaround:** Allow fragmenting packets with DF bit set (`debug dataplane set ip4-ignore-df yes`).
## PAN-307795 ## PAN-307795
```caveat
This issue affects PAN-OS 11.1.10-h7 through 11.1.10-h11. This issue is now resolved. See PAN-OS 11.1.10-h12 Addressed Issues.
```
On a standalone Panorama, the system incorrectly generates system logs indicating a lost connection to its peer even when High Availability is not configured. You can safely ignore these logs, as they do not affect operations. On a standalone Panorama, the system incorrectly generates system logs indicating a lost connection to its peer even when High Availability is not configured. You can safely ignore these logs, as they do not affect operations.
## PAN-306502 ## PAN-306502
```caveat
This issue is now resolved. See PAN-OS 11.1.10-h10 Addressed Issues.
```
TLS sessions using version 1.2 or earlier may fail when session traffic matches a decryption policy rule with the no-decrypt action under either of the following conditions: TLS sessions using version 1.2 or earlier may fail when session traffic matches a decryption policy rule with the no-decrypt action under either of the following conditions:
If both of these conditions are met, the session is guaranteed to fail. If both of these conditions are met, the session is guaranteed to fail.
If both of these conditions are met, the session is guaranteed to fail. - Both HTTP header insertion (**Objects** > **Security Profiles** > **URL Filtering** > **HTTP Header Insertion**) and SSL/TLS handshake inspection (**Device** > **Setup** > **Session** > **Decryption Settings** > **SSL Decryption Settings**) are enabled.
- **Log Successful SSL Handshake** is not enabled in the decryption policy rule and neither **Block sessions with expired certificates** nor **Block sessions with untrusted issuers** is enabled in the attached decryption profile.
If both of these conditions are met, the session is guaranteed to fail. **Workaround:** Perform one of the following tasks:
Both HTTP header insertion (ObjectsSecurity ProfilesURL FilteringHTTP Header Insertion) and SSL/TLS handshake inspection (DeviceSetupSessionDecryption SettingsSSL Decryption Settings) are enabled. - Enable **Log Successful SSL Handshake** in all no-decrypt decryption policy rules.
- Enable either **Block sessions with expired certificates** or **Block sessions with untrusted issuers** in the decryption profiles attached to the no-decrypt decryption policy rules.
Both HTTP header insertion (ObjectsSecurity ProfilesURL FilteringHTTP Header Insertion) and SSL/TLS handshake inspection (DeviceSetupSessionDecryption SettingsSSL Decryption Settings) are enabled.
Log Successful SSL Handshake is not enabled in the decryption policy rule and neither Block sessions with expired certificates nor Block sessions with untrusted issuers is enabled in the attached decryption profile.
Log Successful SSL Handshake is not enabled in the decryption policy rule and neither Block sessions with expired certificates nor Block sessions with untrusted issuers is enabled in the attached decryption profile.
Workaround: Perform one of the following tasks:
Enable Log Successful SSL Handshake in all no-decrypt decryption policy rules.
Enable Log Successful SSL Handshake in all no-decrypt decryption policy rules.
Enable either Block sessions with expired certificates or Block sessions with untrusted issuers in the decryption profiles attached to the no-decrypt decryption policy rules.
## PAN-305301 ## PAN-305301
```caveat
This issue is now resolved. See PAN-OS 11.1.10-h12 Addressed Issues.
```
The timing of GlobalProtect lifetime expiry or inactivity logout notifications used for GlobalProtect SSL tunnels may cause the pan_task process to stop responding and the dataplane to restart. The timing of GlobalProtect lifetime expiry or inactivity logout notifications used for GlobalProtect SSL tunnels may cause the pan_task process to stop responding and the dataplane to restart.
Workaround: Select Network > GlobalProtect > Gateways > <gateway-config> > Agent > <agent-config> > Connection Settings and change the value of both Notify Before Lifetime Expires (min) and Notify Before Inactivity Logout (min) to 0. **Workaround:** Select **Network > GlobalProtect > Gateways > <gateway-config> > Agent > <agent-config> > Connection Settings** and change the value of both **Notify Before Lifetime Expires (min)** and **Notify Before Inactivity Logout (min)** to 0.
## PAN-304756 ## PAN-304756
```caveat
This issue is now resolved. See PAN-OS 11.1.13-h1 Addressed Issues.
```
After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems. After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems.
## PAN-304576 ## PAN-304576
Traffic interruption may occur when inspection of HTTP/2 traffic is enabled. Traffic interruption may occur when inspection of HTTP/2 traffic is enabled.
Workaround: Disable HTTP/2 server push using the set deviceconfig setting http2 server-push no CLI command. **Workaround:** Disable HTTP/2 server push using the `set deviceconfig setting http2 server-push no` CLI command.
## PAN-303959 ## PAN-303959
Traffic that is incorrectly identified as unknown-tcp/unknown-udp eventually drops due to an App-ID resource limitation issue. Traffic that is incorrectly identified as unknown-tcp/unknown-udp eventually drops due to an App-ID resource limitation issue.
## PAN-303051
```caveat
This issue is now resolved. See PAN-OS 11.1.13 Addressed Issues
```
The reportd process experiences a memory leak because it retains memory that was temporarily used for report generation. Once a task is complete, the process fails to release this memory for reuse, leading to continuous accumulation and eventual memory exhaustion on the Panorama device.
## PAN-298505 ## PAN-298505
```caveat
This issue is now resolved. See PAN-OS 11.1.10-h7 Addressed Issuesand PAN-OS 11.1.12 Addressed Issues
```
After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing auto-commit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems managed by Panorama, and the vsys ID sequence breaks when unused virtual systems are deleted and the changes are pushed to the firewall. After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing auto-commit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems managed by Panorama, and the vsys ID sequence breaks when unused virtual systems are deleted and the changes are pushed to the firewall.
## PAN-297295 ## PAN-297295
@@ -64,32 +86,38 @@ After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vs
VM-Series firewalls on Microsoft Azure environments only VM-Series firewalls on Microsoft Azure environments only
``` ```
After upgrading to an affected release, the firewall restarts continuously because the brdagent process restarts multiple times and exhausts its restart limit, resulting in a segfault error. This issue occurs when a high burst of traffic is sent to the Azure PA-VM (Palo Alto Networks Virtual Machine), and impacts production environments due to the regular reboots. After upgrading to an affected release, the firewall restarts continuously because the **brdagent** process restarts multiple times and exhausts its restart limit, resulting in a segfault error. This issue occurs when a high burst of traffic is sent to the Azure PA-VM (Palo Alto Networks Virtual Machine), and impacts production environments due to the regular reboots.
Workaround: Migrate the VM instance to Dv5 instance type. On these instance types, SYN packets are not routed to the synthetic path, avoiding this condition. Suggested direct resizing paths are:D3_v2/DS3_v2 to D8ds_v5D4_v2/DS4_v2 to D8ds_v5D5_v2/DS5_v2 to D16ds_v5 Azure VMs with ephemeral storage can only be resized to another type with ephemeral storage. **Workaround**: Migrate the VM instance to Dv5 instance type. On these instance types, SYN packets are not routed to the synthetic path, avoiding this condition. Suggested direct resizing paths are:
D3_v2/DS3_v2 to D8ds_v5 - D3_v2/DS3_v2 to D8ds_v5
- D4_v2/DS4_v2 to D8ds_v5
D4_v2/DS4_v2 to D8ds_v5 - D5_v2/DS5_v2 to D16ds_v5
D5_v2/DS5_v2 to D16ds_v5
Azure VMs with ephemeral storage can only be resized to another type with ephemeral storage.
Azure VMs with ephemeral storage can only be resized to another type with ephemeral storage.
Azure VMs with ephemeral storage can only be resized to another type with ephemeral storage. Azure VMs with ephemeral storage can only be resized to another type with ephemeral storage.
## PAN-296977 ## PAN-296977
When you apply a filter in Network > Interfaces and then try to view Ethernet interface details using the web interface, the web interface becomes unresponsive. ```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
When you apply a filter in **Network > Interfaces** and then try to view **Ethernet** interface details using the web interface, the web interface becomes unresponsive.
## PAN-294179 ## PAN-294179
On the Panorama Config Audit page, some commit versions might display incorrect or missing data. Fields such as, COMMITTED BY , COMMIT DATE , and OBJECT CHANGES might not be visible for some commit versions. Sometimes, commit versions can disappear after a refresh and the commit description field might display corrupted characters. ```caveat
This issue is now resolved. See PAN-OS 11.1.10-h4 Addressed Issues.
```
On the**Panorama Config Audit** page, some commit versions might display incorrect or missing data. Fields such as, **COMMITTED BY**, **COMMIT DATE**, and**OBJECT CHANGES** might not be visible for some commit versions. Sometimes, commit versions can disappear after a refresh and the commit description field might display corrupted characters.
## PAN-293673 ## PAN-293673
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
When the firewall generates a high volume of logs and attempts to export these logs to an FTP server, it may consume excessive memory leading to all PAN-OS processes crashing. When the firewall generates a high volume of logs and attempts to export these logs to an FTP server, it may consume excessive memory leading to all PAN-OS processes crashing.
## PAN-292202 ## PAN-292202
@@ -104,14 +132,26 @@ Could not get parameters for double encryption. This occurred when the certifica
## PAN-290996 ## PAN-290996
```caveat
This issue is now resolved. See PAN-OS 11.1.10-h1 Addressed Issues and PAN-OS 11.1.11 Addressed Issues.
```
When performing an SNMP walk, the Connections Per Second (CPS) counters incorrectly return a value of 0 for each virtual system (VSYS), despite the firewall actively processing connections. When performing an SNMP walk, the Connections Per Second (CPS) counters incorrectly return a value of 0 for each virtual system (VSYS), despite the firewall actively processing connections.
## PAN-290235 ## PAN-290235
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues.
```
The dscd process crashes continuously on MIPS platforms (for example, PA-850 firewalls) due to a runtime error related to an invalid memory address or nil pointer dereference. This occurs when the golang library upgrade in CIE is not compatible with the MIPS platform. The dscd process crashes continuously on MIPS platforms (for example, PA-850 firewalls) due to a runtime error related to an invalid memory address or nil pointer dereference. This occurs when the golang library upgrade in CIE is not compatible with the MIPS platform.
## PAN-290088 ## PAN-290088
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
When pushing configurations from Panorama to a firewall, a memory leak might occur in the firewall's configd process, particularly when the configurations contain shared policies. Each configuration push causes the configd process to consume additional memory that is not released after the commit completes. When pushing configurations from Panorama to a firewall, a memory leak might occur in the firewall's configd process, particularly when the configurations contain shared policies. Each configuration push causes the configd process to consume additional memory that is not released after the commit completes.
## PAN-289383 ## PAN-289383
@@ -122,14 +162,22 @@ PA-800 series firewalls only
Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation. Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation.
Workaround: Enable auto-negotiation on the connected peer firewall. **Workaround:** Enable auto-negotiation on the connected peer firewall.
## PAN-288097 ## PAN-288097
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
Routed process may stop responding after changing MTU or any link parameters when OSPF and PIM are enabled on the same interface. Routed process may stop responding after changing MTU or any link parameters when OSPF and PIM are enabled on the same interface.
## PAN-287056 ## PAN-287056
```caveat
This issue is now resolved. See PAN-OS 11.1.10-h1 Addressed Issues and PAN-OS 11.1.11 Addressed Issues.
```
A BGP export policy rule that matches on a next hop fails to block the advertisement of static routes, and the firewall incorrectly matches the egress interface IP address instead of the original next-hop IP address of the static route, which causes the deny rule to fail. A BGP export policy rule that matches on a next hop fails to block the advertisement of static routes, and the firewall incorrectly matches the egress interface IP address instead of the original next-hop IP address of the static route, which causes the deny rule to fail.
## PAN-286848 ## PAN-286848
@@ -146,81 +194,83 @@ URL-continue and override continue selections will function like a general URL-b
## PAN-286306 ## PAN-286306
When getting transceiver information from ESCC for SFP 25G modules, the transceiver code incorrectly displays Unknown instead of 25GBase-SR. ```caveat
This issue is now resolved. See PAN-OS 11.1.10-h1 Addressed Issues and PAN-OS 11.1.11 Addressed Issues.
```
When getting transceiver information from ESCC for SFP 25G modules, the transceiver code incorrectly displays `Unknown` instead of `25GBase-SR`.
## PAN-286231 ## PAN-286231
When performing a partial Commit and Push on Panorama, there is a risk that unintended configuration changes might be pushed to a firewall. ```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
This issue is more likely to occur in the following scenarios:When you run Commit and Push operations as a single action.When you trigger multiple parallel commit-all jobs at the same time.Device groups and templates have different configuration synchronization versions. When performing a partial **Commit and Push** on Panorama, there is a risk that unintended configuration changes might be pushed to a firewall.
When you run Commit and Push operations as a single action. This issue is more likely to occur in the following scenarios:
When you run Commit and Push operations as a single action. - When you run **Commit and Push** operations as a single action.
- When you trigger multiple parallel commit-all jobs at the same time.
- Device groups and templates have different configuration synchronization versions.
When you trigger multiple parallel commit-all jobs at the same time. **Workaround:** Perform one of the following steps:
When you trigger multiple parallel commit-all jobs at the same time. - Perform commit and push as two separate, sequential steps.
- Perform a full push instead of selective push.
Device groups and templates have different configuration synchronization versions.
Device groups and templates have different configuration synchronization versions.
Workaround: Perform one of the following steps:
Perform commit and push as two separate, sequential steps.
Perform a full push instead of selective push.
## PAN-285894 ## PAN-285894
If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots. If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots.
Workaround: Disable the Preserve Pre-NAT feature using the set deviceconfig setting preserve-prenat-feature no CLI command. **Workaround:** Disable the Preserve Pre-NAT feature using the `set deviceconfig setting preserve-prenat-feature no` CLI command.
## PAN-283429 ## PAN-283429
When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted. When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted.
Workaround: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates. **Workaround**: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates.
## PAN-282854 ## PAN-282854
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
The Elasticsearch cluster fails to start after deploying dedicated log collectors in a multi-collector environment. The Elasticsearch cluster fails to start after deploying dedicated log collectors in a multi-collector environment.
**Workaround:** Restart all the involved log collectors.
## PAN-279901 ## PAN-279901
When decryption is enabled, segmented Client Hello packets can cause website access issues and memory leaks under the following conditions: When decryption is enabled, segmented Client Hello packets can cause website access issues and memory leaks under the following conditions:
The segmented Client Hello packets arrive out-of-order - The segmented Client Hello packets arrive out-of-order
- The segmented Client Hello packets arrive out-of-order and can be reassembled into a complete Client Hello when the first contiguous segment is formed by NGFW
- The first segment of the Client Hello packets is less than 5 bytes
- A decryption policy rule excludes this traffic from decryption and a Security policy rule (URL filtering) denies this session
The segmented Client Hello packets arrive out-of-order To enable this fix, run the CLI command `bug dataplane set ssl-decrypt accumulate-client-hello disjoined yes`
The segmented Client Hello packets arrive out-of-order and can be reassembled into a complete Client Hello when the first contiguous segment is formed by NGFW
The segmented Client Hello packets arrive out-of-order and can be reassembled into a complete Client Hello when the first contiguous segment is formed by NGFW
The first segment of the Client Hello packets is less than 5 bytes
The first segment of the Client Hello packets is less than 5 bytes
A decryption policy rule excludes this traffic from decryption and a Security policy rule (URL filtering) denies this session
A decryption policy rule excludes this traffic from decryption and a Security policy rule (URL filtering) denies this session
To enable this fix, run the CLI command bug dataplane set ssl-decrypt accumulate-client-hello disjoined yes
## PAN-279415 ## PAN-279415
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
Service routes configured for a data plane interface might incorrectly route traffic through the management plane interface instead. This issue impacts Syslog and CRL status traffic when the service route lacks a specific destination custom service route. Service routes configured for a data plane interface might incorrectly route traffic through the management plane interface instead. This issue impacts Syslog and CRL status traffic when the service route lacks a specific destination custom service route.
## PAN-277034 ## PAN-277034
```caveat
This issue is now resolved. See PAN-OS 11.1.10-h5 Addressed Issues
```
WildFire reports might not fully display or be downloadable because some static resources fail to load. WildFire reports might not fully display or be downloadable because some static resources fail to load.
## PAN-276920 ## PAN-276920
URL filtering response pages may load slowly or fail to display when users request websites that are blocked in the URL Filtering profile (site access for the corresponding URL category is block, continue, or override) attached to the matching Security policy rule. This occurs on an intermittent basis. URL filtering response pages may load slowly or fail to display when users request websites that are blocked in the URL Filtering profile (site access for the corresponding URL category is **block**, **continue**, or **override**) attached to the matching Security policy rule. This occurs on an intermittent basis.
## PAN-275047 ## PAN-275047
@@ -236,7 +286,7 @@ The ElasticSearch cluster health status might continue to remain yellow for an e
## PAN-260851 ## PAN-260851
From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (ObjectsApplications) tag. From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (**Objects** > **Applications**) tag.
## PAN-254240 ## PAN-254240
@@ -268,7 +318,7 @@ The autocommit time of the VM-Series firewall running PAN-OS 11.1.0 might take l
## PAN-220180 ## PAN-220180
Configured botnet reports (MonitorBotnet) are not generated. Configured botnet reports (**Monitor** > **Botnet**) are not generated.
## PAN-207733 ## PAN-207733
@@ -280,21 +330,13 @@ When a DHCPv6 client is configured on HA Active/Passive firewalls, the Passive f
## PAN-207442 ## PAN-207442
For M-700 appliances in an active/passive high availability (PanoramaHigh Availability) configuration, the active-primary HA peer configuration sync to the secondary-passive HA peer may fail. When the config sync fails, the job Results is Successful (Tasks), however the sync status on the Dashboard displays as Out of Sync for both HA peers. For M-700 appliances in an active/passive high availability (**Panorama** > **High Availability**) configuration, the `active-primary` HA peer configuration sync to the `secondary-passive` HA peer may fail. When the config sync fails, the job Results is `Successful` (**Tasks**), however the sync status on the **Dashboard** displays as `Out of Sync` for both HA peers.
Workaround: Perform a local commit on the active-primary HA peer and then synchronize the HA configuration. **Workaround**: Perform a local commit on the `active-primary` HA peer and then synchronize the HA configuration.
Log in to the Panorama web interface of the active-primary HA peer. 1. [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface) of the `active-primary` HA peer.
2. Select **Commit** and **Commit to Panorama**.
Log in to the Panorama web interface of the active-primary HA peer. 3. In the `active-primary` HA peer **Dashboard**, click **Sync to Peer** in the High Availability widget.
Select Commit and Commit to Panorama.
Select Commit and Commit to Panorama.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
## PAN-207040 ## PAN-207040
@@ -302,41 +344,22 @@ If you disable Advanced Routing, remove logical routers, and downgrade from PAN-
## PAN-206913 ## PAN-206913
When a DHCPv6 client is configured on HA Active/Passive firewalls, releasing the IPv6 address from the client (using Release in the UI or using the request dhcp client ipv6 release all CLI command) releases the IPv6 address from the Active firewall, but not the Passive firewall. When a DHCPv6 client is configured on HA Active/Passive firewalls, releasing the IPv6 address from the client (using Release in the UI or using the `request dhcp client ipv6 release all` CLI command) releases the IPv6 address from the Active firewall, but not the Passive firewall.
## PAN-206909 ## PAN-206909
The Dedicated Log Collector is unable to reconnect to the Panorama management server if the configd process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection Status (PanoramaManaged Collector) displaying connected and the managed colletor Health status displaying as healthy. The Dedicated Log Collector is unable to reconnect to the Panorama management server if the `configd` process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection `Status` (**Panorama** > **Managed Collector**) displaying `connected` and the managed colletor `Health` status displaying as healthy.
This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted. This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted.
Workaround: Restart the mgmtsrvr process on the Dedicated Log Collector. **Workaround:** Restart the `mgmtsrvr` process on the Dedicated Log Collector.
Log in to the Dedicated Log Collector CLI. 1. [Log in to the Dedicated Log Collector CLI](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli).
2. Confirm the Dedicated Log Collector is disconnected from Panorama.
Log in to the Dedicated Log Collector CLI. `admin>``show panorama-status`
Verify the `Connected` status is `no`.
Confirm the Dedicated Log Collector is disconnected from Panorama.admin> show panorama-status Verify the Connected status is no. 3. Restart the `mgmtsrvr` process.
`admin>``debug software restart process management-server`
Confirm the Dedicated Log Collector is disconnected from Panorama.
admin> show panorama-status Verify the Connected status is no.
admin> show panorama-status
admin> show panorama-status
Verify the Connected status is no.
Restart the mgmtsrvr process.admin> debug software restart process management-server
Restart the mgmtsrvr process.
admin> debug software restart process management-server
admin> debug software restart process management-server
admin> debug software restart process management-server
## PAN-197588 ## PAN-197588
@@ -348,11 +371,11 @@ The PAN-OS ACC (Application Command Center) does not display a widget detailing
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, the power over Ethernet (PoE) ports do not display a Tag value. In **Network** > **Interface** > **Ethernet**, the power over Ethernet (PoE) ports do not display a **Tag** value.
## PAN-196758 ## PAN-196758
On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you Preview Changes (CommitPush to DevicesEdit Selections or CommitCommit and PushEdit Selections). On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you **Preview Changes** (**Commit** > **Push to Devices** > **Edit Selections** or **Commit** > **Commit and Push** > **Edit Selections**).
## PAN-195968 ## PAN-195968
@@ -368,23 +391,23 @@ When using the CLI to configure power over Ethernet (PoE) on a non-PoE port, the
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, hovering the mouse over a power over Ethernet (PoE) Link State icon does not display link speed and link duplex details. In **Network** > **Interface** > **Ethernet**, hovering the mouse over a power over Ethernet (PoE) **Link State** icon does not display link speed and link duplex details.
## PAN-187685 ## PAN-187685
On the Panorama management server, the Template Status displays no synchronization status (PanoramaManaged DevicesSummary) after a bootstrapped firewall is successfully added to Panorama. On the Panorama management server, the Template Status displays no synchronization status (**Panorama** > **Managed Devices** > **Summary**) after a bootstrapped firewall is successfully added to Panorama.
Workaround: After the bootstrapped firewall is successfully added to Panorama, log in to the Panorama web interface and select CommitPush to Devices. **Workaround:** After the bootstrapped firewall is successfully added to Panorama, [log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) and select **Commit** > **Push to Devices**.
## PAN-187407 ## PAN-187407
The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to Hold client request for category lookup and the action set to Reset-Both and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed. The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to **Hold client request for category lookup**and the action set to **Reset-Both** and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed.
## PAN-186283 ## PAN-186283
Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS. Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS.
Workaround: Use CommitPush to Devices to synchronize the templates. **Workaround**: Use **Commit** > **Push to Devices** to synchronize the templates.
## PAN-184708 ## PAN-184708
@@ -392,29 +415,24 @@ Workaround: Use CommitPush to Devices to synchronize the templates.
Panorama managed firewalls Panorama managed firewalls
``` ```
Scheduled report emails (MonitorPDF ReportsEmail Scheduler) are not emailed if: Scheduled report emails (**Monitor** > **PDF Reports** > **Email Scheduler**) are not emailed if:
A scheduled report email contains a Report Group (MonitorPDF ReportsReport Group) which includes a SaaS Application Usage report. - A scheduled report email contains a Report Group (**Monitor** > **PDF Reports** > **Report Group**) which includes a SaaS Application Usage report.
- A scheduled report contains only a SaaS Application Usage Report.
A scheduled report contains only a SaaS Application Usage Report. **Workaround:** To receive a scheduled report email for all other PDF report types:
Workaround: To receive a scheduled report email for all other PDF report types: 1. Select **Monitor** > **PDF Reports** > **Report Groups** and remove all SaaS Application Usage reports from all Report Groups.
2. Select **Monitor** > **PDF Reports** > **Email Scheduler** and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select **Disable** and click **OK**.
Select MonitorPDF ReportsReport Groups and remove all SaaS Application Usage reports from all Report Groups. Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
3. **Commit**.
Select MonitorPDF ReportsEmail Scheduler and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select Disable and click OK.Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report. () Select **Commit** > **Commit and Push**
Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
Commit.() Select CommitCommit and Push
() Select CommitCommit and Push
## PAN-184406 ## PAN-184406
Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash. Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash.
Workaround: Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance. **Workaround:** Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance.
## PAN-183404 ## PAN-183404
web/data/issues/PAN-OS/known/11.1.11.md
+80 -104
View File
@@ -4,51 +4,61 @@ product: PAN-OS
version: 11.1.11 version: 11.1.11
--- ---
## PAN-308564
Packets are dropped on SD-WAN interfaces if they require fragmentation for an interface but have the **Don't Fragment (DF)** bit set. This results in unexpected packet drops. This affects client to server sessions when using SD-WAN for NGFW.
**Workaround:** Allow fragmenting packets with DF bit set (`debug dataplane set ip4-ignore-df yes`).
## PAN-307795 ## PAN-307795
```caveat
This issue is now resolved. See PAN-OS 11.1.13-h1 Addressed Issues.
```
On a standalone Panorama, the system incorrectly generates system logs indicating a lost connection to its peer even when High Availability is not configured. You can safely ignore these logs, as they do not affect operations. On a standalone Panorama, the system incorrectly generates system logs indicating a lost connection to its peer even when High Availability is not configured. You can safely ignore these logs, as they do not affect operations.
## PAN-306502 ## PAN-306502
```caveat
This issue is now resolved. See PAN-OS 11.1.13 Addressed Issues.
```
TLS sessions using version 1.2 or earlier may fail when session traffic matches a decryption policy rule with the no-decrypt action under either of the following conditions: TLS sessions using version 1.2 or earlier may fail when session traffic matches a decryption policy rule with the no-decrypt action under either of the following conditions:
If both of these conditions are met, the session is guaranteed to fail. If both of these conditions are met, the session is guaranteed to fail.
If both of these conditions are met, the session is guaranteed to fail. - Both HTTP header insertion (**Objects** > **Security Profiles** > **URL Filtering** > **HTTP Header Insertion**) and SSL/TLS handshake inspection (**Device** > **Setup** > **Session** > **Decryption Settings** > **SSL Decryption Settings**) are enabled.
- **Log Successful SSL Handshake** is not enabled in the decryption policy rule and neither **Block sessions with expired certificates** nor **Block sessions with untrusted issuers** is enabled in the attached decryption profile.
If both of these conditions are met, the session is guaranteed to fail. **Workaround:** Perform one of the following tasks:
Both HTTP header insertion (ObjectsSecurity ProfilesURL FilteringHTTP Header Insertion) and SSL/TLS handshake inspection (DeviceSetupSessionDecryption SettingsSSL Decryption Settings) are enabled. - Enable **Log Successful SSL Handshake** in all no-decrypt decryption policy rules.
- Enable either **Block sessions with expired certificates** or **Block sessions with untrusted issuers** in the decryption profiles attached to the no-decrypt decryption policy rules.
Both HTTP header insertion (ObjectsSecurity ProfilesURL FilteringHTTP Header Insertion) and SSL/TLS handshake inspection (DeviceSetupSessionDecryption SettingsSSL Decryption Settings) are enabled.
Log Successful SSL Handshake is not enabled in the decryption policy rule and neither Block sessions with expired certificates nor Block sessions with untrusted issuers is enabled in the attached decryption profile.
Log Successful SSL Handshake is not enabled in the decryption policy rule and neither Block sessions with expired certificates nor Block sessions with untrusted issuers is enabled in the attached decryption profile.
Workaround: Perform one of the following tasks:
Enable Log Successful SSL Handshake in all no-decrypt decryption policy rules.
Enable Log Successful SSL Handshake in all no-decrypt decryption policy rules.
Enable either Block sessions with expired certificates or Block sessions with untrusted issuers in the decryption profiles attached to the no-decrypt decryption policy rules.
## PAN-305301 ## PAN-305301
```caveat
This issue is now resolved. See PAN-OS 11.1.13-h1 Addressed Issues.
```
The timing of GlobalProtect lifetime expiry or inactivity logout notifications used for GlobalProtect SSL tunnels may cause the pan_task process to stop responding and the dataplane to restart. The timing of GlobalProtect lifetime expiry or inactivity logout notifications used for GlobalProtect SSL tunnels may cause the pan_task process to stop responding and the dataplane to restart.
Workaround: Select Network > GlobalProtect > Gateways > <gateway-config> > Agent > <agent-config> > Connection Settings and change the value of both Notify Before Lifetime Expires (min) and Notify Before Inactivity Logout (min) to 0. **Workaround:** Select **Network > GlobalProtect > Gateways > <gateway-config> > Agent > <agent-config> > Connection Settings** and change the value of both **Notify Before Lifetime Expires (min)** and **Notify Before Inactivity Logout (min)** to 0.
## PAN-304756 ## PAN-304756
```caveat
This issue is now resolved. See PAN-OS 11.1.13-h1 Addressed Issues.
```
After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems. After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems.
## PAN-304576 ## PAN-304576
Traffic interruption may occur when inspection of HTTP/2 traffic is enabled. Traffic interruption may occur when inspection of HTTP/2 traffic is enabled.
Workaround: Disable HTTP/2 server push using the set deviceconfig setting http2 server-push no CLI command. **Workaround:** Disable HTTP/2 server push using the `set deviceconfig setting http2 server-push no` CLI command.
## PAN-303959 ## PAN-303959
@@ -56,10 +66,18 @@ Traffic that is incorrectly identified as unknown-tcp/unknown-udp eventually dro
## PAN-303051 ## PAN-303051
```caveat
This issue is now resolved. See PAN-OS 11.1.13 Addressed Issues.
```
The reportd process experiences a memory leak because it retains memory that was temporarily used for report generation. Once a task is complete, the process fails to release this memory for reuse, leading to continuous accumulation and eventual memory exhaustion on the Panorama device. The reportd process experiences a memory leak because it retains memory that was temporarily used for report generation. Once a task is complete, the process fails to release this memory for reuse, leading to continuous accumulation and eventual memory exhaustion on the Panorama device.
## PAN-298505 ## PAN-298505
```caveat
This issue is now resolved. See PAN-OS 11.1.12 Addressed Issues
```
After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing auto-commit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems managed by Panorama, and the vsys ID sequence breaks when unused virtual systems are deleted and the changes are pushed to the firewall. After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing auto-commit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems managed by Panorama, and the vsys ID sequence breaks when unused virtual systems are deleted and the changes are pushed to the firewall.
## PAN-297295 ## PAN-297295
@@ -68,29 +86,19 @@ After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vs
VM-Series firewalls on Microsoft Azure environments only VM-Series firewalls on Microsoft Azure environments only
``` ```
After upgrading to an affected release, the firewall restarts continuously because the brdagent process restarts multiple times and exhausts its restart limit, resulting in a segfault error. This issue occurs when a high burst of traffic is sent to the Azure PA-VM (Palo Alto Networks Virtual Machine), and impacts production environments due to the regular reboots. After upgrading to an affected release, the firewall restarts continuously because the **brdagent** process restarts multiple times and exhausts its restart limit, resulting in a segfault error. This issue occurs when a high burst of traffic is sent to the Azure PA-VM (Palo Alto Networks Virtual Machine), and impacts production environments due to the regular reboots.
Workaround: Migrate the VM instance to Dv5 instance type. On these instance types, SYN packets are not routed to the synthetic path, avoiding this condition. Suggested direct resizing paths are:D3_v2/DS3_v2 to D8ds_v5D4_v2/DS4_v2 to D8ds_v5D5_v2/DS5_v2 to D16ds_v5 Azure VMs with ephemeral storage can only be resized to another type with ephemeral storage. **Workaround**: Migrate the VM instance to Dv5 instance type. On these instance types, SYN packets are not routed to the synthetic path, avoiding this condition. Suggested direct resizing paths are:
D3_v2/DS3_v2 to D8ds_v5 - D3_v2/DS3_v2 to D8ds_v5
- D4_v2/DS4_v2 to D8ds_v5
D4_v2/DS4_v2 to D8ds_v5 - D5_v2/DS5_v2 to D16ds_v5
D5_v2/DS5_v2 to D16ds_v5
Azure VMs with ephemeral storage can only be resized to another type with ephemeral storage. Azure VMs with ephemeral storage can only be resized to another type with ephemeral storage.
Azure VMs with ephemeral storage can only be resized to another type with ephemeral storage.
Azure VMs with ephemeral storage can only be resized to another type with ephemeral storage.
## PAN-293673
When the firewall generates a high volume of logs and attempts to export these logs to an FTP server, it may consume excessive memory leading to all PAN-OS processes crashing.
## PAN-292202 ## PAN-292202
The system logs repeatedly displayed the alert Clearing snmpd.log due to log overflow due to the SNMP counters rolling over. This is a benign message and does not impact device functionality. The system logs repeatedly displayed the alert `Clearing snmpd.log due to log overflow` due to the SNMP counters rolling over. This is a benign message and does not impact device functionality.
## PAN-289432 ## PAN-289432
@@ -106,7 +114,7 @@ PA-800 series firewalls only
Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation. Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation.
Workaround: Enable auto-negotiation on the connected peer firewall. **Workaround:** Enable auto-negotiation on the connected peer firewall.
## PAN-286848 ## PAN-286848
@@ -124,17 +132,17 @@ URL-continue and override continue selections will function like a general URL-b
If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots. If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots.
Workaround: Disable the Preserve Pre-NAT feature using the set deviceconfig setting preserve-prenat-feature no CLI command. **Workaround:** Disable the Preserve Pre-NAT feature using the `set deviceconfig setting preserve-prenat-feature no` CLI command.
## PAN-283429 ## PAN-283429
When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted. When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted.
Workaround: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates. **Workaround**: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates.
## PAN-276920 ## PAN-276920
URL filtering response pages may load slowly or fail to display when users request websites that are blocked in the URL Filtering profile (site access for the corresponding URL category is block, continue, or override) attached to the matching Security policy rule. This occurs on an intermittent basis. URL filtering response pages may load slowly or fail to display when users request websites that are blocked in the URL Filtering profile (site access for the corresponding URL category is **block**, **continue**, or **override**) attached to the matching Security policy rule. This occurs on an intermittent basis.
## PAN-275047 ## PAN-275047
@@ -150,7 +158,7 @@ The ElasticSearch cluster health status might continue to remain yellow for an e
## PAN-260851 ## PAN-260851
From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (ObjectsApplications) tag. From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (**Objects** > **Applications**) tag.
## PAN-254240 ## PAN-254240
@@ -182,7 +190,7 @@ The autocommit time of the VM-Series firewall running PAN-OS 11.1.0 might take l
## PAN-220180 ## PAN-220180
Configured botnet reports (MonitorBotnet) are not generated. Configured botnet reports (**Monitor** > **Botnet**) are not generated.
## PAN-207733 ## PAN-207733
@@ -194,21 +202,13 @@ When a DHCPv6 client is configured on HA Active/Passive firewalls, the Passive f
## PAN-207442 ## PAN-207442
For M-700 appliances in an active/passive high availability (PanoramaHigh Availability) configuration, the active-primary HA peer configuration sync to the secondary-passive HA peer may fail. When the config sync fails, the job Results is Successful (Tasks), however the sync status on the Dashboard displays as Out of Sync for both HA peers. For M-700 appliances in an active/passive high availability (**Panorama** > **High Availability**) configuration, the `active-primary` HA peer configuration sync to the `secondary-passive` HA peer may fail. When the config sync fails, the job Results is `Successful` (**Tasks**), however the sync status on the **Dashboard** displays as `Out of Sync` for both HA peers.
Workaround: Perform a local commit on the active-primary HA peer and then synchronize the HA configuration. **Workaround**: Perform a local commit on the `active-primary` HA peer and then synchronize the HA configuration.
Log in to the Panorama web interface of the active-primary HA peer. 1. [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface) of the `active-primary` HA peer.
2. Select **Commit** and **Commit to Panorama**.
Log in to the Panorama web interface of the active-primary HA peer. 3. In the `active-primary` HA peer **Dashboard**, click **Sync to Peer** in the High Availability widget.
Select Commit and Commit to Panorama.
Select Commit and Commit to Panorama.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
## PAN-207040 ## PAN-207040
@@ -216,41 +216,22 @@ If you disable Advanced Routing, remove logical routers, and downgrade from PAN-
## PAN-206913 ## PAN-206913
When a DHCPv6 client is configured on HA Active/Passive firewalls, releasing the IPv6 address from the client (using Release in the UI or using the request dhcp client ipv6 release all CLI command) releases the IPv6 address from the Active firewall, but not the Passive firewall. When a DHCPv6 client is configured on HA Active/Passive firewalls, releasing the IPv6 address from the client (using Release in the UI or using the `request dhcp client ipv6 release all` CLI command) releases the IPv6 address from the Active firewall, but not the Passive firewall.
## PAN-206909 ## PAN-206909
The Dedicated Log Collector is unable to reconnect to the Panorama management server if the configd process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection Status (PanoramaManaged Collector) displaying connected and the managed colletor Health status displaying as healthy. The Dedicated Log Collector is unable to reconnect to the Panorama management server if the `configd` process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection `Status` (**Panorama** > **Managed Collector**) displaying `connected` and the managed colletor `Health` status displaying as healthy.
This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted. This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted.
Workaround: Restart the mgmtsrvr process on the Dedicated Log Collector. **Workaround:** Restart the `mgmtsrvr` process on the Dedicated Log Collector.
Log in to the Dedicated Log Collector CLI. 1. [Log in to the Dedicated Log Collector CLI](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli).
2. Confirm the Dedicated Log Collector is disconnected from Panorama.
Log in to the Dedicated Log Collector CLI. `admin>``show panorama-status`
Verify the `Connected` status is `no`.
Confirm the Dedicated Log Collector is disconnected from Panorama.admin> show panorama-status Verify the Connected status is no. 3. Restart the `mgmtsrvr` process.
`admin>``debug software restart process management-server`
Confirm the Dedicated Log Collector is disconnected from Panorama.
admin> show panorama-status Verify the Connected status is no.
admin> show panorama-status
admin> show panorama-status
Verify the Connected status is no.
Restart the mgmtsrvr process.admin> debug software restart process management-server
Restart the mgmtsrvr process.
admin> debug software restart process management-server
admin> debug software restart process management-server
admin> debug software restart process management-server
## PAN-197588 ## PAN-197588
@@ -262,11 +243,11 @@ The PAN-OS ACC (Application Command Center) does not display a widget detailing
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, the power over Ethernet (PoE) ports do not display a Tag value. In **Network** > **Interface** > **Ethernet**, the power over Ethernet (PoE) ports do not display a **Tag** value.
## PAN-196758 ## PAN-196758
On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you Preview Changes (CommitPush to DevicesEdit Selections or CommitCommit and PushEdit Selections). On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you **Preview Changes** (**Commit** > **Push to Devices** > **Edit Selections** or **Commit** > **Commit and Push** > **Edit Selections**).
## PAN-195968 ## PAN-195968
@@ -282,23 +263,23 @@ When using the CLI to configure power over Ethernet (PoE) on a non-PoE port, the
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, hovering the mouse over a power over Ethernet (PoE) Link State icon does not display link speed and link duplex details. In **Network** > **Interface** > **Ethernet**, hovering the mouse over a power over Ethernet (PoE) **Link State** icon does not display link speed and link duplex details.
## PAN-187685 ## PAN-187685
On the Panorama management server, the Template Status displays no synchronization status (PanoramaManaged DevicesSummary) after a bootstrapped firewall is successfully added to Panorama. On the Panorama management server, the Template Status displays no synchronization status (**Panorama** > **Managed Devices** > **Summary**) after a bootstrapped firewall is successfully added to Panorama.
Workaround: After the bootstrapped firewall is successfully added to Panorama, log in to the Panorama web interface and select CommitPush to Devices. **Workaround:** After the bootstrapped firewall is successfully added to Panorama, [log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) and select **Commit** > **Push to Devices**.
## PAN-187407 ## PAN-187407
The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to Hold client request for category lookup and the action set to Reset-Both and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed. The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to **Hold client request for category lookup**and the action set to **Reset-Both** and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed.
## PAN-186283 ## PAN-186283
Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS. Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS.
Workaround: Use CommitPush to Devices to synchronize the templates. **Workaround**: Use **Commit** > **Push to Devices** to synchronize the templates.
## PAN-184708 ## PAN-184708
@@ -306,29 +287,24 @@ Workaround: Use CommitPush to Devices to synchronize the templates.
Panorama managed firewalls Panorama managed firewalls
``` ```
Scheduled report emails (MonitorPDF ReportsEmail Scheduler) are not emailed if: Scheduled report emails (**Monitor** > **PDF Reports** > **Email Scheduler**) are not emailed if:
A scheduled report email contains a Report Group (MonitorPDF ReportsReport Group) which includes a SaaS Application Usage report. - A scheduled report email contains a Report Group (**Monitor** > **PDF Reports** > **Report Group**) which includes a SaaS Application Usage report.
- A scheduled report contains only a SaaS Application Usage Report.
A scheduled report contains only a SaaS Application Usage Report. **Workaround:** To receive a scheduled report email for all other PDF report types:
Workaround: To receive a scheduled report email for all other PDF report types: 1. Select **Monitor** > **PDF Reports** > **Report Groups** and remove all SaaS Application Usage reports from all Report Groups.
2. Select **Monitor** > **PDF Reports** > **Email Scheduler** and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select **Disable** and click **OK**.
Select MonitorPDF ReportsReport Groups and remove all SaaS Application Usage reports from all Report Groups. Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
3. **Commit**.
Select MonitorPDF ReportsEmail Scheduler and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select Disable and click OK.Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report. () Select **Commit** > **Commit and Push**
Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
Commit.() Select CommitCommit and Push
() Select CommitCommit and Push
## PAN-184406 ## PAN-184406
Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash. Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash.
Workaround: Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance. **Workaround:** Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance.
## PAN-183404 ## PAN-183404
web/data/issues/PAN-OS/known/11.1.12.md
+80 -104
View File
@@ -4,85 +4,93 @@ product: PAN-OS
version: 11.1.12 version: 11.1.12
--- ---
## PAN-308564
Packets are dropped on SD-WAN interfaces if they require fragmentation for an interface but have the **Don't Fragment (DF)** bit set. This results in unexpected packet drops. This affects client to server sessions when using SD-WAN for NGFW.
**Workaround:** Allow fragmenting packets with DF bit set (`debug dataplane set ip4-ignore-df yes`).
## PAN-307795 ## PAN-307795
```caveat
This issue is now resolved. See PAN-OS 11.1.13-h1 Addressed Issues.
```
On a standalone Panorama, the system incorrectly generates system logs indicating a lost connection to its peer even when High Availability is not configured. You can safely ignore these logs, as they do not affect operations. On a standalone Panorama, the system incorrectly generates system logs indicating a lost connection to its peer even when High Availability is not configured. You can safely ignore these logs, as they do not affect operations.
## PAN-306502 ## PAN-306502
```caveat
This issue is now resolved. See PAN-OS 11.1.13 Addressed Issues.
```
TLS sessions using version 1.2 or earlier may fail when session traffic matches a decryption policy rule with the no-decrypt action under either of the following conditions: TLS sessions using version 1.2 or earlier may fail when session traffic matches a decryption policy rule with the no-decrypt action under either of the following conditions:
If both of these conditions are met, the session is guaranteed to fail. If both of these conditions are met, the session is guaranteed to fail.
If both of these conditions are met, the session is guaranteed to fail. - Both HTTP header insertion (**Objects** > **Security Profiles** > **URL Filtering** > **HTTP Header Insertion**) and SSL/TLS handshake inspection (**Device** > **Setup** > **Session** > **Decryption Settings** > **SSL Decryption Settings**) are enabled.
- **Log Successful SSL Handshake** is not enabled in the decryption policy rule and neither **Block sessions with expired certificates** nor **Block sessions with untrusted issuers** is enabled in the attached decryption profile.
If both of these conditions are met, the session is guaranteed to fail. **Workaround:** Perform one of the following tasks:
Both HTTP header insertion (ObjectsSecurity ProfilesURL FilteringHTTP Header Insertion) and SSL/TLS handshake inspection (DeviceSetupSessionDecryption SettingsSSL Decryption Settings) are enabled. - Enable **Log Successful SSL Handshake** in all no-decrypt decryption policy rules.
- Enable either **Block sessions with expired certificates** or **Block sessions with untrusted issuers** in the decryption profiles attached to the no-decrypt decryption policy rules.
Both HTTP header insertion (ObjectsSecurity ProfilesURL FilteringHTTP Header Insertion) and SSL/TLS handshake inspection (DeviceSetupSessionDecryption SettingsSSL Decryption Settings) are enabled.
Log Successful SSL Handshake is not enabled in the decryption policy rule and neither Block sessions with expired certificates nor Block sessions with untrusted issuers is enabled in the attached decryption profile.
Log Successful SSL Handshake is not enabled in the decryption policy rule and neither Block sessions with expired certificates nor Block sessions with untrusted issuers is enabled in the attached decryption profile.
Workaround: Perform one of the following tasks:
Enable Log Successful SSL Handshake in all no-decrypt decryption policy rules.
Enable Log Successful SSL Handshake in all no-decrypt decryption policy rules.
Enable either Block sessions with expired certificates or Block sessions with untrusted issuers in the decryption profiles attached to the no-decrypt decryption policy rules.
## PAN-305301 ## PAN-305301
```caveat
This issue is now resolved. See PAN-OS 11.1.13-h1 Addressed Issues.
```
The timing of GlobalProtect lifetime expiry or inactivity logout notifications used for GlobalProtect SSL tunnels may cause the pan_task process to stop responding and the dataplane to restart. The timing of GlobalProtect lifetime expiry or inactivity logout notifications used for GlobalProtect SSL tunnels may cause the pan_task process to stop responding and the dataplane to restart.
Workaround: Select Network > GlobalProtect > Gateways > <gateway-config> > Agent > <agent-config> > Connection Settings and change the value of both Notify Before Lifetime Expires (min) and Notify Before Inactivity Logout (min) to 0. **Workaround:** Select **Network > GlobalProtect > Gateways > <gateway-config> > Agent > <agent-config> > Connection Settings** and change the value of both **Notify Before Lifetime Expires (min)** and **Notify Before Inactivity Logout (min)** to 0.
## PAN-304756 ## PAN-304756
```caveat
This issue is now resolved. See PAN-OS 11.1.13-h1 Addressed Issues.
```
After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems. After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems.
## PAN-304576 ## PAN-304576
Traffic interruption may occur when inspection of HTTP/2 traffic is enabled. Traffic interruption may occur when inspection of HTTP/2 traffic is enabled.
Workaround: Disable HTTP/2 server push using the set deviceconfig setting http2 server-push no CLI command. **Workaround:** Disable HTTP/2 server push using the `set deviceconfig setting http2 server-push no` CLI command.
## PAN-303959 ## PAN-303959
Traffic that is incorrectly identified as unknown-tcp/unknown-udp eventually drops due to an App-ID resource limitation issue. Traffic that is incorrectly identified as unknown-tcp/unknown-udp eventually drops due to an App-ID resource limitation issue.
## PAN-303051
```caveat
This issue is now resolved. See PAN-OS 11.1.13 Addressed Issues
```
The reportd process experiences a memory leak because it retains memory that was temporarily used for report generation. Once a task is complete, the process fails to release this memory for reuse, leading to continuous accumulation and eventual memory exhaustion on the Panorama device.
## PAN-297295 ## PAN-297295
```caveat ```caveat
VM-Series firewalls on Microsoft Azure environments only VM-Series firewalls on Microsoft Azure environments only
``` ```
After upgrading to an affected release, the firewall restarts continuously because the brdagent process restarts multiple times and exhausts its restart limit, resulting in a segfault error. This issue occurs when a high burst of traffic is sent to the Azure PA-VM (Palo Alto Networks Virtual Machine), and impacts production environments due to the regular reboots. After upgrading to an affected release, the firewall restarts continuously because the **brdagent** process restarts multiple times and exhausts its restart limit, resulting in a segfault error. This issue occurs when a high burst of traffic is sent to the Azure PA-VM (Palo Alto Networks Virtual Machine), and impacts production environments due to the regular reboots.
Workaround: Migrate the VM instance to Dv5 instance type. On these instance types, SYN packets are not routed to the synthetic path, avoiding this condition. Suggested direct resizing paths are:D3_v2/DS3_v2 to D8ds_v5D4_v2/DS4_v2 to D8ds_v5D5_v2/DS5_v2 to D16ds_v5 Azure VMs with ephemeral storage can only be resized to another type with ephemeral storage. **Workaround**: Migrate the VM instance to Dv5 instance type. On these instance types, SYN packets are not routed to the synthetic path, avoiding this condition. Suggested direct resizing paths are:
D3_v2/DS3_v2 to D8ds_v5 - D3_v2/DS3_v2 to D8ds_v5
- D4_v2/DS4_v2 to D8ds_v5
D4_v2/DS4_v2 to D8ds_v5 - D5_v2/DS5_v2 to D16ds_v5
D5_v2/DS5_v2 to D16ds_v5
Azure VMs with ephemeral storage can only be resized to another type with ephemeral storage. Azure VMs with ephemeral storage can only be resized to another type with ephemeral storage.
Azure VMs with ephemeral storage can only be resized to another type with ephemeral storage.
Azure VMs with ephemeral storage can only be resized to another type with ephemeral storage.
## PAN-293673
When the firewall generates a high volume of logs and attempts to export these logs to an FTP server, it may consume excessive memory leading to all PAN-OS processes crashing.
## PAN-292202 ## PAN-292202
The system logs repeatedly displayed the alert Clearing snmpd.log due to log overflow due to the SNMP counters rolling over. This is a benign message and does not impact device functionality. The system logs repeatedly displayed the alert `Clearing snmpd.log due to log overflow` due to the SNMP counters rolling over. This is a benign message and does not impact device functionality.
## PAN-289432 ## PAN-289432
@@ -98,7 +106,7 @@ PA-800 series firewalls only
Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation. Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation.
Workaround: Enable auto-negotiation on the connected peer firewall. **Workaround:** Enable auto-negotiation on the connected peer firewall.
## PAN-286848 ## PAN-286848
@@ -116,13 +124,13 @@ URL-continue and override continue selections will function like a general URL-b
If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots. If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots.
Workaround: Disable the Preserve Pre-NAT feature using the set deviceconfig setting preserve-prenat-feature no CLI command. **Workaround:** Disable the Preserve Pre-NAT feature using the `set deviceconfig setting preserve-prenat-feature no` CLI command.
## PAN-283429 ## PAN-283429
When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted. When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted.
Workaround: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates. **Workaround**: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates.
## PAN-279415 ## PAN-279415
@@ -130,7 +138,7 @@ Service routes configured for a data plane interface might incorrectly route tra
## PAN-276920 ## PAN-276920
URL filtering response pages may load slowly or fail to display when users request websites that are blocked in the URL Filtering profile (site access for the corresponding URL category is block, continue, or override) attached to the matching Security policy rule. This occurs on an intermittent basis. URL filtering response pages may load slowly or fail to display when users request websites that are blocked in the URL Filtering profile (site access for the corresponding URL category is **block**, **continue**, or **override**) attached to the matching Security policy rule. This occurs on an intermittent basis.
## PAN-275047 ## PAN-275047
@@ -146,7 +154,7 @@ The ElasticSearch cluster health status might continue to remain yellow for an e
## PAN-260851 ## PAN-260851
From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (ObjectsApplications) tag. From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (**Objects** > **Applications**) tag.
## PAN-254240 ## PAN-254240
@@ -178,7 +186,7 @@ The autocommit time of the VM-Series firewall running PAN-OS 11.1.0 might take l
## PAN-220180 ## PAN-220180
Configured botnet reports (MonitorBotnet) are not generated. Configured botnet reports (**Monitor** > **Botnet**) are not generated.
## PAN-207733 ## PAN-207733
@@ -190,21 +198,13 @@ When a DHCPv6 client is configured on HA Active/Passive firewalls, the Passive f
## PAN-207442 ## PAN-207442
For M-700 appliances in an active/passive high availability (PanoramaHigh Availability) configuration, the active-primary HA peer configuration sync to the secondary-passive HA peer may fail. When the config sync fails, the job Results is Successful (Tasks), however the sync status on the Dashboard displays as Out of Sync for both HA peers. For M-700 appliances in an active/passive high availability (**Panorama** > **High Availability**) configuration, the `active-primary` HA peer configuration sync to the `secondary-passive` HA peer may fail. When the config sync fails, the job Results is `Successful` (**Tasks**), however the sync status on the **Dashboard** displays as `Out of Sync` for both HA peers.
Workaround: Perform a local commit on the active-primary HA peer and then synchronize the HA configuration. **Workaround**: Perform a local commit on the `active-primary` HA peer and then synchronize the HA configuration.
Log in to the Panorama web interface of the active-primary HA peer. 1. [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface) of the `active-primary` HA peer.
2. Select **Commit** and **Commit to Panorama**.
Log in to the Panorama web interface of the active-primary HA peer. 3. In the `active-primary` HA peer **Dashboard**, click **Sync to Peer** in the High Availability widget.
Select Commit and Commit to Panorama.
Select Commit and Commit to Panorama.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
## PAN-207040 ## PAN-207040
@@ -212,41 +212,22 @@ If you disable Advanced Routing, remove logical routers, and downgrade from PAN-
## PAN-206913 ## PAN-206913
When a DHCPv6 client is configured on HA Active/Passive firewalls, releasing the IPv6 address from the client (using Release in the UI or using the request dhcp client ipv6 release all CLI command) releases the IPv6 address from the Active firewall, but not the Passive firewall. When a DHCPv6 client is configured on HA Active/Passive firewalls, releasing the IPv6 address from the client (using Release in the UI or using the `request dhcp client ipv6 release all` CLI command) releases the IPv6 address from the Active firewall, but not the Passive firewall.
## PAN-206909 ## PAN-206909
The Dedicated Log Collector is unable to reconnect to the Panorama management server if the configd process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection Status (PanoramaManaged Collector) displaying connected and the managed colletor Health status displaying as healthy. The Dedicated Log Collector is unable to reconnect to the Panorama management server if the `configd` process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection `Status` (**Panorama** > **Managed Collector**) displaying `connected` and the managed colletor `Health` status displaying as healthy.
This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted. This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted.
Workaround: Restart the mgmtsrvr process on the Dedicated Log Collector. **Workaround:** Restart the `mgmtsrvr` process on the Dedicated Log Collector.
Log in to the Dedicated Log Collector CLI. 1. [Log in to the Dedicated Log Collector CLI](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli).
2. Confirm the Dedicated Log Collector is disconnected from Panorama.
Log in to the Dedicated Log Collector CLI. `admin>``show panorama-status`
Verify the `Connected` status is `no`.
Confirm the Dedicated Log Collector is disconnected from Panorama.admin> show panorama-status Verify the Connected status is no. 3. Restart the `mgmtsrvr` process.
`admin>``debug software restart process management-server`
Confirm the Dedicated Log Collector is disconnected from Panorama.
admin> show panorama-status Verify the Connected status is no.
admin> show panorama-status
admin> show panorama-status
Verify the Connected status is no.
Restart the mgmtsrvr process.admin> debug software restart process management-server
Restart the mgmtsrvr process.
admin> debug software restart process management-server
admin> debug software restart process management-server
admin> debug software restart process management-server
## PAN-197588 ## PAN-197588
@@ -258,11 +239,11 @@ The PAN-OS ACC (Application Command Center) does not display a widget detailing
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, the power over Ethernet (PoE) ports do not display a Tag value. In **Network** > **Interface** > **Ethernet**, the power over Ethernet (PoE) ports do not display a **Tag** value.
## PAN-196758 ## PAN-196758
On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you Preview Changes (CommitPush to DevicesEdit Selections or CommitCommit and PushEdit Selections). On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you **Preview Changes** (**Commit** > **Push to Devices** > **Edit Selections** or **Commit** > **Commit and Push** > **Edit Selections**).
## PAN-195968 ## PAN-195968
@@ -278,23 +259,23 @@ When using the CLI to configure power over Ethernet (PoE) on a non-PoE port, the
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, hovering the mouse over a power over Ethernet (PoE) Link State icon does not display link speed and link duplex details. In **Network** > **Interface** > **Ethernet**, hovering the mouse over a power over Ethernet (PoE) **Link State** icon does not display link speed and link duplex details.
## PAN-187685 ## PAN-187685
On the Panorama management server, the Template Status displays no synchronization status (PanoramaManaged DevicesSummary) after a bootstrapped firewall is successfully added to Panorama. On the Panorama management server, the Template Status displays no synchronization status (**Panorama** > **Managed Devices** > **Summary**) after a bootstrapped firewall is successfully added to Panorama.
Workaround: After the bootstrapped firewall is successfully added to Panorama, log in to the Panorama web interface and select CommitPush to Devices. **Workaround:** After the bootstrapped firewall is successfully added to Panorama, [log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) and select **Commit** > **Push to Devices**.
## PAN-187407 ## PAN-187407
The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to Hold client request for category lookup and the action set to Reset-Both and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed. The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to **Hold client request for category lookup**and the action set to **Reset-Both** and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed.
## PAN-186283 ## PAN-186283
Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS. Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS.
Workaround: Use CommitPush to Devices to synchronize the templates. **Workaround**: Use **Commit** > **Push to Devices** to synchronize the templates.
## PAN-184708 ## PAN-184708
@@ -302,29 +283,24 @@ Workaround: Use CommitPush to Devices to synchronize the templates.
Panorama managed firewalls Panorama managed firewalls
``` ```
Scheduled report emails (MonitorPDF ReportsEmail Scheduler) are not emailed if: Scheduled report emails (**Monitor** > **PDF Reports** > **Email Scheduler**) are not emailed if:
A scheduled report email contains a Report Group (MonitorPDF ReportsReport Group) which includes a SaaS Application Usage report. - A scheduled report email contains a Report Group (**Monitor** > **PDF Reports** > **Report Group**) which includes a SaaS Application Usage report.
- A scheduled report contains only a SaaS Application Usage Report.
A scheduled report contains only a SaaS Application Usage Report. **Workaround:** To receive a scheduled report email for all other PDF report types:
Workaround: To receive a scheduled report email for all other PDF report types: 1. Select **Monitor** > **PDF Reports** > **Report Groups** and remove all SaaS Application Usage reports from all Report Groups.
2. Select **Monitor** > **PDF Reports** > **Email Scheduler** and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select **Disable** and click **OK**.
Select MonitorPDF ReportsReport Groups and remove all SaaS Application Usage reports from all Report Groups. Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
3. **Commit**.
Select MonitorPDF ReportsEmail Scheduler and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select Disable and click OK.Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report. () Select **Commit** > **Commit and Push**
Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
Commit.() Select CommitCommit and Push
() Select CommitCommit and Push
## PAN-184406 ## PAN-184406
Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash. Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash.
Workaround: Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance. **Workaround:** Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance.
## PAN-183404 ## PAN-183404
web/data/issues/PAN-OS/known/11.1.13.md
+58 -76
View File
@@ -4,37 +4,51 @@ product: PAN-OS
version: 11.1.13 version: 11.1.13
--- ---
## PAN-308564
Packets are dropped on SD-WAN interfaces if they require fragmentation for an interface but have the **Don't Fragment (DF)** bit set. This results in unexpected packet drops. This affects client to server sessions when using SD-WAN for NGFW.
**Workaround:** Allow fragmenting packets with DF bit set (`debug dataplane set ip4-ignore-df yes`).
## PAN-307795 ## PAN-307795
```caveat
This issue is now resolved. See PAN-OS 11.1.13-h1 Addressed Issues.
```
On a standalone Panorama, the system incorrectly generates system logs indicating a lost connection to its peer even when High Availability is not configured. You can safely ignore these logs, as they do not affect operations. On a standalone Panorama, the system incorrectly generates system logs indicating a lost connection to its peer even when High Availability is not configured. You can safely ignore these logs, as they do not affect operations.
## PAN-305301 ## PAN-305301
```caveat
This issue is now resolved. See PAN-OS 11.1.13-h1 Addressed Issues.
```
The timing of GlobalProtect lifetime expiry or inactivity logout notifications used for GlobalProtect SSL tunnels may cause the pan_task process to stop responding and the dataplane to restart. The timing of GlobalProtect lifetime expiry or inactivity logout notifications used for GlobalProtect SSL tunnels may cause the pan_task process to stop responding and the dataplane to restart.
Workaround: Select Network > GlobalProtect > Gateways > <gateway-config> > Agent > <agent-config> > Connection Settings and change the value of both Notify Before Lifetime Expires (min) and Notify Before Inactivity Logout (min) to 0. **Workaround:** Select **Network > GlobalProtect > Gateways > <gateway-config> > Agent > <agent-config> > Connection Settings** and change the value of both **Notify Before Lifetime Expires (min)** and **Notify Before Inactivity Logout (min)** to 0.
## PAN-304756 ## PAN-304756
```caveat
This issue is now resolved. See PAN-OS 11.1.13-h1 Addressed Issues.
```
After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems. After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems.
## PAN-304576 ## PAN-304576
Traffic interruption may occur when inspection of HTTP/2 traffic is enabled. Traffic interruption may occur when inspection of HTTP/2 traffic is enabled.
Workaround: Disable HTTP/2 server push using the set deviceconfig setting http2 server-push no CLI command. **Workaround:** Disable HTTP/2 server push using the `set deviceconfig setting http2 server-push no` CLI command.
## PAN-303959 ## PAN-303959
Traffic that is incorrectly identified as unknown-tcp/unknown-udp eventually drops due to an App-ID resource limitation issue. Traffic that is incorrectly identified as unknown-tcp/unknown-udp eventually drops due to an App-ID resource limitation issue.
## PAN-293673
When the firewall generates a high volume of logs and attempts to export these logs to an FTP server, it may consume excessive memory leading to all PAN-OS processes crashing.
## PAN-292202 ## PAN-292202
The system logs repeatedly displayed the alert Clearing snmpd.log due to log overflow due to the SNMP counters rolling over. This is a benign message and does not impact device functionality. The system logs repeatedly displayed the alert `Clearing snmpd.log due to log overflow` due to the SNMP counters rolling over. This is a benign message and does not impact device functionality.
## PAN-289432 ## PAN-289432
@@ -50,7 +64,7 @@ PA-800 series firewalls only
Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation. Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation.
Workaround: Enable auto-negotiation on the connected peer firewall. **Workaround:** Enable auto-negotiation on the connected peer firewall.
## PAN-286848 ## PAN-286848
@@ -68,13 +82,13 @@ URL-continue and override continue selections will function like a general URL-b
If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots. If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots.
Workaround: Disable the Preserve Pre-NAT feature using the set deviceconfig setting preserve-prenat-feature no CLI command. **Workaround:** Disable the Preserve Pre-NAT feature using the `set deviceconfig setting preserve-prenat-feature no` CLI command.
## PAN-283429 ## PAN-283429
When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted. When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted.
Workaround: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates. **Workaround**: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates.
## PAN-279415 ## PAN-279415
@@ -82,7 +96,7 @@ Service routes configured for a data plane interface might incorrectly route tra
## PAN-276920 ## PAN-276920
URL filtering response pages may load slowly or fail to display when users request websites that are blocked in the URL Filtering profile (site access for the corresponding URL category is block, continue, or override) attached to the matching Security policy rule. This occurs on an intermittent basis. URL filtering response pages may load slowly or fail to display when users request websites that are blocked in the URL Filtering profile (site access for the corresponding URL category is **block**, **continue**, or **override**) attached to the matching Security policy rule. This occurs on an intermittent basis.
## PAN-275047 ## PAN-275047
@@ -106,7 +120,7 @@ The ElasticSearch cluster health status might continue to remain yellow for an e
## PAN-260851 ## PAN-260851
From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (ObjectsApplications) tag. From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (**Objects** > **Applications**) tag.
## PAN-254240 ## PAN-254240
@@ -138,7 +152,7 @@ The autocommit time of the VM-Series firewall running PAN-OS 11.1.0 might take l
## PAN-220180 ## PAN-220180
Configured botnet reports (MonitorBotnet) are not generated. Configured botnet reports (**Monitor** > **Botnet**) are not generated.
## PAN-207733 ## PAN-207733
@@ -150,21 +164,13 @@ When a DHCPv6 client is configured on HA Active/Passive firewalls, the Passive f
## PAN-207442 ## PAN-207442
For M-700 appliances in an active/passive high availability (PanoramaHigh Availability) configuration, the active-primary HA peer configuration sync to the secondary-passive HA peer may fail. When the config sync fails, the job Results is Successful (Tasks), however the sync status on the Dashboard displays as Out of Sync for both HA peers. For M-700 appliances in an active/passive high availability (**Panorama** > **High Availability**) configuration, the `active-primary` HA peer configuration sync to the `secondary-passive` HA peer may fail. When the config sync fails, the job Results is `Successful` (**Tasks**), however the sync status on the **Dashboard** displays as `Out of Sync` for both HA peers.
Workaround: Perform a local commit on the active-primary HA peer and then synchronize the HA configuration. **Workaround**: Perform a local commit on the `active-primary` HA peer and then synchronize the HA configuration.
Log in to the Panorama web interface of the active-primary HA peer. 1. [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface) of the `active-primary` HA peer.
2. Select **Commit** and **Commit to Panorama**.
Log in to the Panorama web interface of the active-primary HA peer. 3. In the `active-primary` HA peer **Dashboard**, click **Sync to Peer** in the High Availability widget.
Select Commit and Commit to Panorama.
Select Commit and Commit to Panorama.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
## PAN-207040 ## PAN-207040
@@ -172,41 +178,22 @@ If you disable Advanced Routing, remove logical routers, and downgrade from PAN-
## PAN-206913 ## PAN-206913
When a DHCPv6 client is configured on HA Active/Passive firewalls, releasing the IPv6 address from the client (using Release in the UI or using the request dhcp client ipv6 release all CLI command) releases the IPv6 address from the Active firewall, but not the Passive firewall. When a DHCPv6 client is configured on HA Active/Passive firewalls, releasing the IPv6 address from the client (using Release in the UI or using the `request dhcp client ipv6 release all` CLI command) releases the IPv6 address from the Active firewall, but not the Passive firewall.
## PAN-206909 ## PAN-206909
The Dedicated Log Collector is unable to reconnect to the Panorama management server if the configd process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection Status (PanoramaManaged Collector) displaying connected and the managed colletor Health status displaying as healthy. The Dedicated Log Collector is unable to reconnect to the Panorama management server if the `configd` process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection `Status` (**Panorama** > **Managed Collector**) displaying `connected` and the managed colletor `Health` status displaying as healthy.
This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted. This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted.
Workaround: Restart the mgmtsrvr process on the Dedicated Log Collector. **Workaround:** Restart the `mgmtsrvr` process on the Dedicated Log Collector.
Log in to the Dedicated Log Collector CLI. 1. [Log in to the Dedicated Log Collector CLI](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli).
2. Confirm the Dedicated Log Collector is disconnected from Panorama.
Log in to the Dedicated Log Collector CLI. `admin>``show panorama-status`
Verify the `Connected` status is `no`.
Confirm the Dedicated Log Collector is disconnected from Panorama.admin> show panorama-status Verify the Connected status is no. 3. Restart the `mgmtsrvr` process.
`admin>``debug software restart process management-server`
Confirm the Dedicated Log Collector is disconnected from Panorama.
admin> show panorama-status Verify the Connected status is no.
admin> show panorama-status
admin> show panorama-status
Verify the Connected status is no.
Restart the mgmtsrvr process.admin> debug software restart process management-server
Restart the mgmtsrvr process.
admin> debug software restart process management-server
admin> debug software restart process management-server
admin> debug software restart process management-server
## PAN-197588 ## PAN-197588
@@ -218,11 +205,11 @@ The PAN-OS ACC (Application Command Center) does not display a widget detailing
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, the power over Ethernet (PoE) ports do not display a Tag value. In **Network** > **Interface** > **Ethernet**, the power over Ethernet (PoE) ports do not display a **Tag** value.
## PAN-196758 ## PAN-196758
On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you Preview Changes (CommitPush to DevicesEdit Selections or CommitCommit and PushEdit Selections). On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you **Preview Changes** (**Commit** > **Push to Devices** > **Edit Selections** or **Commit** > **Commit and Push** > **Edit Selections**).
## PAN-195968 ## PAN-195968
@@ -238,23 +225,23 @@ When using the CLI to configure power over Ethernet (PoE) on a non-PoE port, the
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, hovering the mouse over a power over Ethernet (PoE) Link State icon does not display link speed and link duplex details. In **Network** > **Interface** > **Ethernet**, hovering the mouse over a power over Ethernet (PoE) **Link State** icon does not display link speed and link duplex details.
## PAN-187685 ## PAN-187685
On the Panorama management server, the Template Status displays no synchronization status (PanoramaManaged DevicesSummary) after a bootstrapped firewall is successfully added to Panorama. On the Panorama management server, the Template Status displays no synchronization status (**Panorama** > **Managed Devices** > **Summary**) after a bootstrapped firewall is successfully added to Panorama.
Workaround: After the bootstrapped firewall is successfully added to Panorama, log in to the Panorama web interface and select CommitPush to Devices. **Workaround:** After the bootstrapped firewall is successfully added to Panorama, [log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) and select **Commit** > **Push to Devices**.
## PAN-187407 ## PAN-187407
The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to Hold client request for category lookup and the action set to Reset-Both and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed. The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to **Hold client request for category lookup**and the action set to **Reset-Both** and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed.
## PAN-186283 ## PAN-186283
Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS. Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS.
Workaround: Use CommitPush to Devices to synchronize the templates. **Workaround**: Use **Commit** > **Push to Devices** to synchronize the templates.
## PAN-184708 ## PAN-184708
@@ -262,29 +249,24 @@ Workaround: Use CommitPush to Devices to synchronize the templates.
Panorama managed firewalls Panorama managed firewalls
``` ```
Scheduled report emails (MonitorPDF ReportsEmail Scheduler) are not emailed if: Scheduled report emails (**Monitor** > **PDF Reports** > **Email Scheduler**) are not emailed if:
A scheduled report email contains a Report Group (MonitorPDF ReportsReport Group) which includes a SaaS Application Usage report. - A scheduled report email contains a Report Group (**Monitor** > **PDF Reports** > **Report Group**) which includes a SaaS Application Usage report.
- A scheduled report contains only a SaaS Application Usage Report.
A scheduled report contains only a SaaS Application Usage Report. **Workaround:** To receive a scheduled report email for all other PDF report types:
Workaround: To receive a scheduled report email for all other PDF report types: 1. Select **Monitor** > **PDF Reports** > **Report Groups** and remove all SaaS Application Usage reports from all Report Groups.
2. Select **Monitor** > **PDF Reports** > **Email Scheduler** and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select **Disable** and click **OK**.
Select MonitorPDF ReportsReport Groups and remove all SaaS Application Usage reports from all Report Groups. Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
3. **Commit**.
Select MonitorPDF ReportsEmail Scheduler and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select Disable and click OK.Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report. () Select **Commit** > **Commit and Push**
Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
Commit.() Select CommitCommit and Push
() Select CommitCommit and Push
## PAN-184406 ## PAN-184406
Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash. Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash.
Workaround: Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance. **Workaround:** Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance.
## PAN-183404 ## PAN-183404
web/data/issues/PAN-OS/known/11.1.2.md
+160 -122
View File
@@ -6,18 +6,38 @@ version: 11.1.2
## PAN-304756 ## PAN-304756
```caveat
This issue is now resolved. See PAN-OS 11.1.13-h1 Addressed Issues.
```
After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems. After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems.
## PAN-298505 ## PAN-298505
```caveat
This issue is now resolved. See PAN-OS 11.1.6-h20 Addressed Issues, PAN-OS 11.1.10-h7 Addressed Issues, and PAN-OS 11.1.12 Addressed Issues
```
After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing auto-commit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems managed by Panorama, and the vsys ID sequence breaks when unused virtual systems are deleted and the changes are pushed to the firewall. After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing auto-commit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems managed by Panorama, and the vsys ID sequence breaks when unused virtual systems are deleted and the changes are pushed to the firewall.
## PAN-294179
```caveat
This issue is now resolved. See PAN-OS 11.1.6-h17 Addressed Issues.
```
On the**Panorama Config Audit** page, some commit versions might display incorrect or missing data. Fields such as, **COMMITTED BY**, **COMMIT DATE**, and**OBJECT CHANGES** might not be visible for some commit versions. Sometimes, commit versions can disappear after a refresh and the commit description field might display corrupted characters.
## PAN-291288 ## PAN-291288
An active firewall might unexpectedly reboot due to a pan_task crash caused by a page allocation failure. This issue is observed after a period of runtime with traffic and telemetry collection. An active firewall might unexpectedly reboot due to a pan_task crash caused by a page allocation failure. This issue is observed after a period of runtime with traffic and telemetry collection.
## PAN-290088 ## PAN-290088
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
When pushing configurations from Panorama to a firewall, a memory leak might occur in the firewall's configd process, particularly when the configurations contain shared policies. Each configuration push causes the configd process to consume additional memory that is not released after the commit completes. When pushing configurations from Panorama to a firewall, a memory leak might occur in the firewall's configd process, particularly when the configurations contain shared policies. Each configuration push causes the configd process to consume additional memory that is not released after the commit completes.
## PAN-289383 ## PAN-289383
@@ -28,51 +48,54 @@ PA-800 series firewalls only
Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation. Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation.
Workaround: Enable auto-negotiation on the connected peer firewall. **Workaround:** Enable auto-negotiation on the connected peer firewall.
## PAN-288097 ## PAN-288097
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
Routed process may stop responding after changing MTU or any link parameters when OSPF and PIM are enabled on the same interface. Routed process may stop responding after changing MTU or any link parameters when OSPF and PIM are enabled on the same interface.
## PAN-287871 ## PAN-287871
```caveat
This issue affects PAN-OS 11.1.2-h9
```
When SSL Inbound Inspection is enabled and the firewall receives fragmented Client Hello packets that include the TCP timestamp option, the Client Hello message is forwarded to the destination server without the timestamp option. When SSL Inbound Inspection is enabled and the firewall receives fragmented Client Hello packets that include the TCP timestamp option, the Client Hello message is forwarded to the destination server without the timestamp option.
## PAN-286231 ## PAN-286231
When performing a partial Commit and Push on Panorama, there is a risk that unintended configuration changes might be pushed to a firewall. ```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
This issue is more likely to occur in the following scenarios:When you run Commit and Push operations as a single action.When you trigger multiple parallel commit-all jobs at the same time.Device groups and templates have different configuration synchronization versions. When performing a partial **Commit and Push** on Panorama, there is a risk that unintended configuration changes might be pushed to a firewall.
When you run Commit and Push operations as a single action. This issue is more likely to occur in the following scenarios:
When you run Commit and Push operations as a single action. - When you run **Commit and Push** operations as a single action.
- When you trigger multiple parallel commit-all jobs at the same time.
- Device groups and templates have different configuration synchronization versions.
When you trigger multiple parallel commit-all jobs at the same time. **Workaround:** Perform one of the following steps:
When you trigger multiple parallel commit-all jobs at the same time. - Perform commit and push as two separate, sequential steps.
- Perform a full push instead of selective push.
Device groups and templates have different configuration synchronization versions.
Device groups and templates have different configuration synchronization versions.
Workaround: Perform one of the following steps:
Perform commit and push as two separate, sequential steps.
Perform a full push instead of selective push.
## PAN-285894 ## PAN-285894
If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots. If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots.
Workaround: Disable the Preserve Pre-NAT feature using the set deviceconfig setting preserve-prenat-feature no CLI command. **Workaround:** Disable the Preserve Pre-NAT feature using the `set deviceconfig setting preserve-prenat-feature no` CLI command.
## PAN-283429 ## PAN-283429
When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted. When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted.
Workaround: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates. **Workaround**: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates.
## PAN-281885 ## PAN-281885
@@ -80,20 +103,27 @@ When exporting and importing the CSV file, the hash values of pre-shared key (PS
## PAN-280532 ## PAN-280532
```caveat
This issue is now resolved. See PAN-OS 11.1.10 Addressed Issues.
```
When you use a single syslog server over TCP for log forwarding, and the connectivity to the syslog server breaks, syslog forwarding does not resume even after the connectivity to the server restores. When you use a single syslog server over TCP for log forwarding, and the connectivity to the syslog server breaks, syslog forwarding does not resume even after the connectivity to the server restores.
Workaround: Performing one of the following tasks: **Workaround:** Performing one of the following tasks:
Reboot the firewall. - Reboot the firewall.
- Temporarily, configure syslog to use UDP, commit the configuration, revert to TCP, and then commit.
Temporarily, configure syslog to use UDP, commit the configuration, revert to TCP, and then commit.
## PAN-280471 ## PAN-280471
When applying filters or searching for logs in the PanoramaMonitorLogssection, you might experience slow performance. When applying filters or searching for logs in the **Panorama** > **Monitor** > **Logs**section, you might experience slow performance.
## PAN-279415 ## PAN-279415
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
Service routes configured for a data plane interface might incorrectly route traffic through the management plane interface instead. This issue impacts Syslog and CRL status traffic when the service route lacks a specific destination custom service route. Service routes configured for a data plane interface might incorrectly route traffic through the management plane interface instead. This issue impacts Syslog and CRL status traffic when the service route lacks a specific destination custom service route.
## PAN-278296 ## PAN-278296
@@ -102,22 +132,42 @@ The system MAC address of the aggregate interface is the same on both the active
## PAN-277417 ## PAN-277417
```caveat
This issue is now resolved. See PAN-OS 11.1.9 Addressed Issues.
```
Memory leak issues can occur during the parsing of server certificates used for SSL Inbound Inspection, preventing the firewall from completing inspection. Memory leak issues can occur during the parsing of server certificates used for SSL Inbound Inspection, preventing the firewall from completing inspection.
## PAN-277034 ## PAN-277034
```caveat
This issue is now resolved. See PAN-OS 11.1.10-h5 Addressed Issuesand PAN-OS 11.1.6-h19 Addressed Issues
```
WildFire reports might not fully display or be downloadable because some static resources fail to load. WildFire reports might not fully display or be downloadable because some static resources fail to load.
## PAN-275601 ## PAN-275601
When Panorama is not internet-connected and you try to upload images to the managed firewalls by using the Validate option, the upload fails with the following error: Failed to create multi-upload job. No valid software deploy targets found. ```caveat
This issue is now resolved. See PAN-OS 11.1.10 Addressed Issues
```
When Panorama is not internet-connected and you try to upload images to the managed firewalls by using the **Validate** option, the upload fails with the following error: `Failed to create multi-upload job. No valid software deploy targets found.`
## PAN-273300 ## PAN-273300
When upgrading Panorama from PAN-OS 10.2 or PAN-OS 11.0 to PAN-OS 11.1 or a later release, Panorama fails to upgrade if it is operating within a Collector Group. The following error appears:Error: Traceback (most recent call last):File "/opt/panrepo/releases/<PANOS release version>/validate"... (min ([dts['min'] for dts in 10g_type_intv_dir.values() if dts|'min']])-strftime ('%Y-%m-%d'), ```caveat
This issue is now resolved. See PAN-OS 11.1.6-h1 Addressed Issues
```
When upgrading Panorama from PAN-OS 10.2 or PAN-OS 11.0 to PAN-OS 11.1 or a later release, Panorama fails to upgrade if it is operating within a Collector Group. The following error appears:`Error: Traceback (most recent call last):File "/opt/panrepo/releases/<PANOS release version>/validate"... (min ([dts['min'] for dts in 10g_type_intv_dir.values() if dts|'min']])-strftime ('%Y-%m-%d'),`
## PAN-263987 ## PAN-263987
```caveat
This issue is now resolved. See PAN-OS 11.1.4-h4 Addressed Issues.
```
When a NAT traversal (NAT-T or UDP encapsulation) IPSec tunnel is terminated on a Palo Alto Networks firewall and the NAT rule applied to the NAT-T IPSec tunnel is also on the same firewall, then the data traffic flowing through the NAT-T IPSec tunnel can't be NATed correctly. When a NAT traversal (NAT-T or UDP encapsulation) IPSec tunnel is terminated on a Palo Alto Networks firewall and the NAT rule applied to the NAT-T IPSec tunnel is also on the same firewall, then the data traffic flowing through the NAT-T IPSec tunnel can't be NATed correctly.
## PAN-263208 ## PAN-263208
@@ -138,14 +188,22 @@ Dereferencing a NULL pointer that occurs might cause pan_task processes to crash
## PAN-260851 ## PAN-260851
From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (ObjectsApplications) tag. From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (**Objects** > **Applications**) tag.
## PAN-259769 ## PAN-259769
GlobalProtect portal is not accessible via a web browser and the app displays the error ERR_EMPTY_RESPONSE. ```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues.
```
GlobalProtect portal is not accessible via a web browser and the app displays the error `ERR_EMPTY_RESPONSE`.
## PAN-257615 ## PAN-257615
```caveat
This issue is now resolved. See PAN-OS 11.1.2-h9 Addressed Issues.
```
The Panorama web interface intermittently displays logs or fails to display logs completely. The Panorama web interface intermittently displays logs or fails to display logs completely.
## PAN-255538 ## PAN-255538
@@ -156,55 +214,59 @@ On the PA-455 firewall, the LEDs indicating the link status of Ports 3 and 4 are
The PA-450R, PA-450R-5G, and PA-455 firewalls can experience an interruption of traffic when switching the combo port connection from fiber to copper. The PA-450R, PA-450R-5G, and PA-455 firewalls can experience an interruption of traffic when switching the combo port connection from fiber to copper.
Workaround: With the copper port connected, initiate a soft reboot of the firewall using the CLI command request restart system. After the reboot, the copper port will be able to process traffic. **Workaround:** With the copper port connected, initiate a soft reboot of the firewall using the CLI command `request restart system`. After the reboot, the copper port will be able to process traffic.
## PAN-250062 ## PAN-250062
```caveat
This issue is now resolved. See PAN-OS 11.1.4-h4 Addressed Issues.
```
Device telemetry might fail at configured intervals due to bundle generation issues. Device telemetry might fail at configured intervals due to bundle generation issues.
## PAN-243951 ## PAN-243951
On the Panorama management sever in an active/passive High Availability (HA) configuration, managed devices (PanoramaManaged DevicesSummary) display as out-of-sync on the passive HA peer when configuration changes are made to the SD-WAN (PanoramaSD-WAN) configuration on the active HA peer. ```caveat
This issue is now resolved. See PAN-OS 11.1.2-h3 Addressed Issues
```
Workaround: Manually synchronize the Panorama HA peers. On the Panorama management sever in an active/passive High Availability (HA) configuration, managed devices (**Panorama** > **Managed Devices** > **Summary**) display as `out-of-sync` on the passive HA peer when configuration changes are made to the SD-WAN (**Panorama** > **SD-WAN**) configuration on the active HA peer.
Log in to the Panorama web interface on the active HA peer. **Workaround:** Manually synchronize the Panorama HA peers.
Log in to the Panorama web interface on the active HA peer. 1. Log in to the [Panorama web interface](https://docs.paloaltonetworks.com/panorama/11-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface) on the active HA peer.
2. Select **Commit** and **Commit to Panorama** the SD-WAN configuration changes on the active HA peer.
Select Commit and Commit to Panorama the SD-WAN configuration changes on the active HA peer. On the passive HA peer, select PanoramaManaged DevicesSummary and observe that the managed devices are now out-of-sync. On the passive HA peer, select **Panorama** > **Managed Devices** > **Summary** and observe that the managed devices are now `out-of-sync`.
3. Log in to the primary HA peer [Panorama CLI](https://docs.paloaltonetworks.com/panorama/11-1/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli) and trigger a manual synchronization between the active and secondary HA peers.
Select Commit and Commit to Panorama the SD-WAN configuration changes on the active HA peer. *request high-availability sync-to-remote running-config*
4. Log back in to the active HA peer Panorama web interface and select **Commit** > **Push to Devices** and **Push**.
On the passive HA peer, select PanoramaManaged DevicesSummary and observe that the managed devices are now out-of-sync.
Log in to the primary HA peer Panorama CLI and trigger a manual synchronization between the active and secondary HA peers.request high-availability sync-to-remote running-config
Log in to the primary HA peer Panorama CLI and trigger a manual synchronization between the active and secondary HA peers.
request high-availability sync-to-remote running-config
Log back in to the active HA peer Panorama web interface and select CommitPush to Devices and Push.
Log back in to the active HA peer Panorama web interface and select CommitPush to Devices and Push.
## PAN-241041 ## PAN-241041
On the Panorama management server exporting template or template stack variables (PanoramaTemplates) in CSV format results in an empty CSV file. ```caveat
This issue is now resolved. See PAN-OS 11.1.3 Addressed Issues
```
On the Panorama management server exporting template or template stack variables (**Panorama** > **Templates**) in CSV format results in an empty CSV file.
## PAN-237106 ## PAN-237106
```caveat
This issue is now resolved. See PAN-OS 11.1.8 Addressed Issues
```
LSVPN satellite certificates may be generated with serial numbers exceeding 40 hexadecimal characters. This causes certificate revocation and deletion operations to fail with the following error messages: LSVPN satellite certificates may be generated with serial numbers exceeding 40 hexadecimal characters. This causes certificate revocation and deletion operations to fail with the following error messages:
db-serialno can be at most 40 characters - `db-serialno can be at most 40 characters`
- `db-serialno is invalid`
db-serialno is invalid **Workaround:**
To resolve this issue, use the following CLI commands with the LSVPN satellite serial number to manually delete or revoke the affected certificates: To resolve this issue, use the following CLI commands with the LSVPN satellite serial number to manually delete or revoke the affected certificates:
Delete certificate information:delete sslmgr-store certificate-info portal name <name> serialno <satellite_serial> **Delete certificate information**:`delete sslmgr-store certificate-info portal name <name> serialno <satellite_serial>`
Revoke satellite certificates:delete sslmgr-store satellite-info-revoke-certificate portal <name> serialno <list_of_satellite_serials> **Revoke satellite certificates**:`delete sslmgr-store satellite-info-revoke-certificate portal <name> serialno <list_of_satellite_serials>`
## PAN-234015 ## PAN-234015
@@ -216,17 +278,21 @@ The autocommit time of the VM-Series firewall running PAN-OS 11.1.0 might take l
## PAN-220180 ## PAN-220180
Configured botnet reports (MonitorBotnet) are not generated. Configured botnet reports (**Monitor** > **Botnet**) are not generated.
## PAN-217307 ## PAN-217307
The following Security policy rule (PoliciesSecurity) filters return no results: ```caveat
This issue is now resolved. See PAN-OS 11.1.3 Addressed Issues.
```
log-start eq no The following Security policy rule (**Policies** > **Security**) filters return no results:
log-end eq no `log-start eq no`
log-end eq yes `log-end eq no`
`log-end eq yes`
## PAN-207733 ## PAN-207733
@@ -238,21 +304,13 @@ When a DHCPv6 client is configured on HA Active/Passive firewalls, the Passive f
## PAN-207442 ## PAN-207442
For M-700 appliances in an active/passive high availability (PanoramaHigh Availability) configuration, the active-primary HA peer configuration sync to the secondary-passive HA peer may fail. When the config sync fails, the job Results is Successful (Tasks), however the sync status on the Dashboard displays as Out of Sync for both HA peers. For M-700 appliances in an active/passive high availability (**Panorama** > **High Availability**) configuration, the `active-primary` HA peer configuration sync to the `secondary-passive` HA peer may fail. When the config sync fails, the job Results is `Successful` (**Tasks**), however the sync status on the **Dashboard** displays as `Out of Sync` for both HA peers.
Workaround: Perform a local commit on the active-primary HA peer and then synchronize the HA configuration. **Workaround**: Perform a local commit on the `active-primary` HA peer and then synchronize the HA configuration.
Log in to the Panorama web interface of the active-primary HA peer. 1. [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface) of the `active-primary` HA peer.
2. Select **Commit** and **Commit to Panorama**.
Log in to the Panorama web interface of the active-primary HA peer. 3. In the `active-primary` HA peer **Dashboard**, click **Sync to Peer** in the High Availability widget.
Select Commit and Commit to Panorama.
Select Commit and Commit to Panorama.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
## PAN-207040 ## PAN-207040
@@ -260,37 +318,18 @@ If you disable Advanced Routing, remove logical routers, and downgrade from PAN-
## PAN-206909 ## PAN-206909
The Dedicated Log Collector is unable to reconnect to the Panorama management server if the configd process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection Status (PanoramaManaged Collector) displaying connected and the managed colletor Health status displaying as healthy. The Dedicated Log Collector is unable to reconnect to the Panorama management server if the `configd` process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection `Status` (**Panorama** > **Managed Collector**) displaying `connected` and the managed colletor `Health` status displaying as healthy.
This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted. This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted.
Workaround: Restart the mgmtsrvr process on the Dedicated Log Collector. **Workaround:** Restart the `mgmtsrvr` process on the Dedicated Log Collector.
Log in to the Dedicated Log Collector CLI. 1. [Log in to the Dedicated Log Collector CLI](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli).
2. Confirm the Dedicated Log Collector is disconnected from Panorama.
Log in to the Dedicated Log Collector CLI. `admin>``show panorama-status`
Verify the `Connected` status is `no`.
Confirm the Dedicated Log Collector is disconnected from Panorama.admin> show panorama-status Verify the Connected status is no. 3. Restart the `mgmtsrvr` process.
`admin>``debug software restart process management-server`
Confirm the Dedicated Log Collector is disconnected from Panorama.
admin> show panorama-status Verify the Connected status is no.
admin> show panorama-status
admin> show panorama-status
Verify the Connected status is no.
Restart the mgmtsrvr process.admin> debug software restart process management-server
Restart the mgmtsrvr process.
admin> debug software restart process management-server
admin> debug software restart process management-server
admin> debug software restart process management-server
## PAN-197588 ## PAN-197588
@@ -302,11 +341,11 @@ The PAN-OS ACC (Application Command Center) does not display a widget detailing
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, the power over Ethernet (PoE) ports do not display a Tag value. In **Network** > **Interface** > **Ethernet**, the power over Ethernet (PoE) ports do not display a **Tag** value.
## PAN-196758 ## PAN-196758
On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you Preview Changes (CommitPush to DevicesEdit Selections or CommitCommit and PushEdit Selections). On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you **Preview Changes** (**Commit** > **Push to Devices** > **Edit Selections** or **Commit** > **Commit and Push** > **Edit Selections**).
## PAN-195968 ## PAN-195968
@@ -322,23 +361,23 @@ When using the CLI to configure power over Ethernet (PoE) on a non-PoE port, the
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, hovering the mouse over a power over Ethernet (PoE) Link State icon does not display link speed and link duplex details. In **Network** > **Interface** > **Ethernet**, hovering the mouse over a power over Ethernet (PoE) **Link State** icon does not display link speed and link duplex details.
## PAN-187685 ## PAN-187685
On the Panorama management server, the Template Status displays no synchronization status (PanoramaManaged DevicesSummary) after a bootstrapped firewall is successfully added to Panorama. On the Panorama management server, the Template Status displays no synchronization status (**Panorama** > **Managed Devices** > **Summary**) after a bootstrapped firewall is successfully added to Panorama.
Workaround: After the bootstrapped firewall is successfully added to Panorama, log in to the Panorama web interface and select CommitPush to Devices. **Workaround:** After the bootstrapped firewall is successfully added to Panorama, [log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) and select **Commit** > **Push to Devices**.
## PAN-187407 ## PAN-187407
The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to Hold client request for category lookup and the action set to Reset-Both and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed. The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to **Hold client request for category lookup**and the action set to **Reset-Both** and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed.
## PAN-186283 ## PAN-186283
Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS. Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS.
Workaround: Use CommitPush to Devices to synchronize the templates. **Workaround**: Use **Commit** > **Push to Devices** to synchronize the templates.
## PAN-184708 ## PAN-184708
@@ -346,29 +385,24 @@ Workaround: Use CommitPush to Devices to synchronize the templates.
Panorama managed firewalls Panorama managed firewalls
``` ```
Scheduled report emails (MonitorPDF ReportsEmail Scheduler) are not emailed if: Scheduled report emails (**Monitor** > **PDF Reports** > **Email Scheduler**) are not emailed if:
A scheduled report email contains a Report Group (MonitorPDF ReportsReport Group) which includes a SaaS Application Usage report. - A scheduled report email contains a Report Group (**Monitor** > **PDF Reports** > **Report Group**) which includes a SaaS Application Usage report.
- A scheduled report contains only a SaaS Application Usage Report.
A scheduled report contains only a SaaS Application Usage Report. **Workaround:** To receive a scheduled report email for all other PDF report types:
Workaround: To receive a scheduled report email for all other PDF report types: 1. Select **Monitor** > **PDF Reports** > **Report Groups** and remove all SaaS Application Usage reports from all Report Groups.
2. Select **Monitor** > **PDF Reports** > **Email Scheduler** and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select **Disable** and click **OK**.
Select MonitorPDF ReportsReport Groups and remove all SaaS Application Usage reports from all Report Groups. Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
3. **Commit**.
Select MonitorPDF ReportsEmail Scheduler and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select Disable and click OK.Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report. () Select **Commit** > **Commit and Push**
Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
Commit.() Select CommitCommit and Push
() Select CommitCommit and Push
## PAN-184406 ## PAN-184406
Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash. Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash.
Workaround: Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance. **Workaround:** Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance.
## PAN-183404 ## PAN-183404
@@ -380,4 +414,8 @@ If you use multiple log forwarding cards (LFCs) on the PA-7000 series, all of th
## PAN-164885 ## PAN-164885
On the Panorama management server, pushes to managed firewalls (CommitPush to Devices or Commit and Push) may fail when an EDL (ObjectsExternal Dynamic Lists) is configured to Check for updates every 5 minutes due to the commit and EDL fetch processes overlapping. This is more likely to occur when multiple EDLs are configured to check for updates every 5 minutes. ```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
On the Panorama management server, pushes to managed firewalls (**Commit** > **Push to Devices** or **Commit and Push**) may fail when an EDL (**Objects** > **External Dynamic Lists**) is configured to **Check for updates** every 5 minutes due to the commit and EDL fetch processes overlapping. This is more likely to occur when multiple EDLs are configured to check for updates every 5 minutes.
web/data/issues/PAN-OS/known/11.1.3.md
+209 -98
View File
@@ -6,18 +6,38 @@ version: 11.1.3
## PAN-304756 ## PAN-304756
```caveat
This issue is now resolved. See PAN-OS 11.1.13-h1 Addressed Issues.
```
After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems. After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems.
## PAN-298505 ## PAN-298505
```caveat
This issue is now resolved. See PAN-OS 11.1.6-h20 Addressed Issues, PAN-OS 11.1.10-h7 Addressed Issues, and PAN-OS 11.1.12 Addressed Issues
```
After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing auto-commit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems managed by Panorama, and the vsys ID sequence breaks when unused virtual systems are deleted and the changes are pushed to the firewall. After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing auto-commit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems managed by Panorama, and the vsys ID sequence breaks when unused virtual systems are deleted and the changes are pushed to the firewall.
## PAN-294179
```caveat
This issue is now resolved. See PAN-OS 11.1.6-h17 Addressed Issues.
```
On the**Panorama Config Audit** page, some commit versions might display incorrect or missing data. Fields such as, **COMMITTED BY**, **COMMIT DATE**, and**OBJECT CHANGES** might not be visible for some commit versions. Sometimes, commit versions can disappear after a refresh and the commit description field might display corrupted characters.
## PAN-291288 ## PAN-291288
An active firewall might unexpectedly reboot due to a pan_task crash caused by a page allocation failure. This issue is observed after a period of runtime with traffic and telemetry collection. An active firewall might unexpectedly reboot due to a pan_task crash caused by a page allocation failure. This issue is observed after a period of runtime with traffic and telemetry collection.
## PAN-290088 ## PAN-290088
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
When pushing configurations from Panorama to a firewall, a memory leak might occur in the firewall's configd process, particularly when the configurations contain shared policies. Each configuration push causes the configd process to consume additional memory that is not released after the commit completes. When pushing configurations from Panorama to a firewall, a memory leak might occur in the firewall's configd process, particularly when the configurations contain shared policies. Each configuration push causes the configd process to consume additional memory that is not released after the commit completes.
## PAN-289383 ## PAN-289383
@@ -28,51 +48,54 @@ PA-800 series firewalls only
Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation. Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation.
Workaround: Enable auto-negotiation on the connected peer firewall. **Workaround:** Enable auto-negotiation on the connected peer firewall.
## PAN-288097 ## PAN-288097
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
Routed process may stop responding after changing MTU or any link parameters when OSPF and PIM are enabled on the same interface. Routed process may stop responding after changing MTU or any link parameters when OSPF and PIM are enabled on the same interface.
## PAN-287871 ## PAN-287871
```caveat
This issue affects PAN-OS 11.1.3-h2
```
When SSL Inbound Inspection is enabled and the firewall receives fragmented Client Hello packets that include the TCP timestamp option, the Client Hello message is forwarded to the destination server without the timestamp option. When SSL Inbound Inspection is enabled and the firewall receives fragmented Client Hello packets that include the TCP timestamp option, the Client Hello message is forwarded to the destination server without the timestamp option.
## PAN-286231 ## PAN-286231
When performing a partial Commit and Push on Panorama, there is a risk that unintended configuration changes might be pushed to a firewall. ```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
This issue is more likely to occur in the following scenarios:When you run Commit and Push operations as a single action.When you trigger multiple parallel commit-all jobs at the same time.Device groups and templates have different configuration synchronization versions. When performing a partial **Commit and Push** on Panorama, there is a risk that unintended configuration changes might be pushed to a firewall.
When you run Commit and Push operations as a single action. This issue is more likely to occur in the following scenarios:
When you run Commit and Push operations as a single action. - When you run **Commit and Push** operations as a single action.
- When you trigger multiple parallel commit-all jobs at the same time.
- Device groups and templates have different configuration synchronization versions.
When you trigger multiple parallel commit-all jobs at the same time. **Workaround:** Perform one of the following steps:
When you trigger multiple parallel commit-all jobs at the same time. - Perform commit and push as two separate, sequential steps.
- Perform a full push instead of selective push.
Device groups and templates have different configuration synchronization versions.
Device groups and templates have different configuration synchronization versions.
Workaround: Perform one of the following steps:
Perform commit and push as two separate, sequential steps.
Perform a full push instead of selective push.
## PAN-285894 ## PAN-285894
If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots. If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots.
Workaround: Disable the Preserve Pre-NAT feature using the set deviceconfig setting preserve-prenat-feature no CLI command. **Workaround:** Disable the Preserve Pre-NAT feature using the `set deviceconfig setting preserve-prenat-feature no` CLI command.
## PAN-283429 ## PAN-283429
When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted. When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted.
Workaround: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates. **Workaround**: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates.
## PAN-281885 ## PAN-281885
@@ -80,24 +103,35 @@ When exporting and importing the CSV file, the hash values of pre-shared key (PS
## PAN-280532 ## PAN-280532
```caveat
This issue is now resolved. See PAN-OS 11.1.10 Addressed Issues.
```
When you use a single syslog server over TCP for log forwarding, and the connectivity to the syslog server breaks, syslog forwarding does not resume even after the connectivity to the server restores. When you use a single syslog server over TCP for log forwarding, and the connectivity to the syslog server breaks, syslog forwarding does not resume even after the connectivity to the server restores.
Workaround: Performing one of the following tasks: **Workaround:** Performing one of the following tasks:
Reboot the firewall. - Reboot the firewall.
- Temporarily, configure syslog to use UDP, commit the configuration, revert to TCP, and then commit.
Temporarily, configure syslog to use UDP, commit the configuration, revert to TCP, and then commit.
## PAN-280471 ## PAN-280471
When applying filters or searching for logs in the PanoramaMonitorLogssection, you might experience slow performance. When applying filters or searching for logs in the **Panorama** > **Monitor** > **Logs**section, you might experience slow performance.
## PAN-279621 ## PAN-279621
```caveat
This issue is now resolved. See PAN-OS 11.1.9 Addressed Issues.
```
Early aging and removal of firewall session while they are still active can lead to intermittent instabilities and crashes for proxy traffic, the Content and Threat detection engine, and any data-path processing. Early aging and removal of firewall session while they are still active can lead to intermittent instabilities and crashes for proxy traffic, the Content and Threat detection engine, and any data-path processing.
## PAN-279415 ## PAN-279415
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
Service routes configured for a data plane interface might incorrectly route traffic through the management plane interface instead. This issue impacts Syslog and CRL status traffic when the service route lacks a specific destination custom service route. Service routes configured for a data plane interface might incorrectly route traffic through the management plane interface instead. This issue impacts Syslog and CRL status traffic when the service route lacks a specific destination custom service route.
## PAN-278296 ## PAN-278296
@@ -106,26 +140,50 @@ The system MAC address of the aggregate interface is the same on both the active
## PAN-277417 ## PAN-277417
```caveat
This issue is now resolved. See PAN-OS 11.1.9 Addressed Issues.
```
Memory leak issues can occur during the parsing of server certificates used for SSL Inbound Inspection, preventing the firewall from completing inspection. Memory leak issues can occur during the parsing of server certificates used for SSL Inbound Inspection, preventing the firewall from completing inspection.
## PAN-277034 ## PAN-277034
```caveat
This issue is now resolved. See PAN-OS 11.1.10-h5 Addressed Issuesand PAN-OS 11.1.6-h19 Addressed Issues
```
WildFire reports might not fully display or be downloadable because some static resources fail to load. WildFire reports might not fully display or be downloadable because some static resources fail to load.
## PAN-275601 ## PAN-275601
When Panorama is not internet-connected and you try to upload images to the managed firewalls by using the Validate option, the upload fails with the following error: Failed to create multi-upload job. No valid software deploy targets found. ```caveat
This issue is now resolved. See PAN-OS 11.1.10 Addressed Issues
```
When Panorama is not internet-connected and you try to upload images to the managed firewalls by using the **Validate** option, the upload fails with the following error: `Failed to create multi-upload job. No valid software deploy targets found.`
## PAN-273300 ## PAN-273300
When upgrading Panorama from PAN-OS 10.2 or PAN-OS 11.0 to PAN-OS 11.1 or a later release, Panorama fails to upgrade if it is operating within a Collector Group. The following error appears:Error: Traceback (most recent call last):File "/opt/panrepo/releases/<PANOS release version>/validate"... (min ([dts['min'] for dts in 10g_type_intv_dir.values() if dts|'min']])-strftime ('%Y-%m-%d'), ```caveat
This issue is now resolved. See PAN-OS 11.1.6-h1 Addressed Issues
```
When upgrading Panorama from PAN-OS 10.2 or PAN-OS 11.0 to PAN-OS 11.1 or a later release, Panorama fails to upgrade if it is operating within a Collector Group. The following error appears:`Error: Traceback (most recent call last):File "/opt/panrepo/releases/<PANOS release version>/validate"... (min ([dts['min'] for dts in 10g_type_intv_dir.values() if dts|'min']])-strftime ('%Y-%m-%d'),`
## PAN-265336 ## PAN-265336
```caveat
(PAN-OS 11.1.3-h6 only)
```
Copper ports flap when generating a technical support file, executing telemetry, or retrieving port status using a Management Data Input/Output (MDIO) read. Copper ports flap when generating a technical support file, executing telemetry, or retrieving port status using a Management Data Input/Output (MDIO) read.
## PAN-263987 ## PAN-263987
```caveat
This issue is now resolved. See PAN-OS 11.1.4-h4 Addressed Issues.
```
When a NAT traversal (NAT-T or UDP encapsulation) IPSec tunnel is terminated on a Palo Alto Networks firewall and the NAT rule applied to the NAT-T IPSec tunnel is also on the same firewall, then the data traffic flowing through the NAT-T IPSec tunnel can't be NATed correctly. When a NAT traversal (NAT-T or UDP encapsulation) IPSec tunnel is terminated on a Palo Alto Networks firewall and the NAT rule applied to the NAT-T IPSec tunnel is also on the same firewall, then the data traffic flowing through the NAT-T IPSec tunnel can't be NATed correctly.
## PAN-263940 ## PAN-263940
@@ -138,14 +196,30 @@ Dereferencing a NULL pointer that occurs might cause pan_task processes to crash
## PAN-260851 ## PAN-260851
From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (ObjectsApplications) tag. From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (**Objects** > **Applications**) tag.
## PAN-259769
```caveat
This issue is now resolved. See PAN-OS 11.1.3-h6 Addressed Issues
```
GlobalProtect portal is not accessible via a web browser and the app displays the error `ERR_EMPTY_RESPONSE`.
## PAN-259733 ## PAN-259733
```caveat
This issue is now resolved. See PAN-OS 11.1.3-h2 Addressed Issues.
```
Custom reports created in PAN-OS are not deleted as expected, resulting in high memory use by the reportd process. This can lead to issues, such as out-of-memory conditions, content installation failures, and unexpected firewall reboots. Custom reports created in PAN-OS are not deleted as expected, resulting in high memory use by the reportd process. This can lead to issues, such as out-of-memory conditions, content installation failures, and unexpected firewall reboots.
## PAN-257615 ## PAN-257615
```caveat
This issue is now resolved. See PAN-OS 11.1.3-h4 Addressed Issues.
```
The Panorama web interface intermittently displays logs or fails to display logs completely. The Panorama web interface intermittently displays logs or fails to display logs completely.
## PAN-255868 ## PAN-255868
@@ -156,32 +230,56 @@ PA-3400 Series firewalls only
After enabling kernel data collection during a silent reboot, the firewall fails and reboots to maintenance mode. After enabling kernel data collection during a silent reboot, the firewall fails and reboots to maintenance mode.
Workaround: To recover the firewall, initiate a reboot from maintenance mode. **Workaround:** To recover the firewall, initiate a reboot from maintenance mode.
## PAN-255579 ## PAN-255579
```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues.
```
Demo Mode and Log Forwarding: PA-7500 Series firewalls and Panorama display data plane logs after a delay. Demo Mode and Log Forwarding: PA-7500 Series firewalls and Panorama display data plane logs after a delay.
## PAN-255285 ## PAN-255285
```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues.
```
If only the HCSI-A link is connected on NGFW cluster nodes (the HSCI-B link is not connected) and the management interfaces goes down, the situation will result in a split brain. If only the HCSI-A link is connected on NGFW cluster nodes (the HSCI-B link is not connected) and the management interfaces goes down, the situation will result in a split brain.
## PAN-255116 ## PAN-255116
```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
When QoS is applied, traffic on an NGFW cluster node going from an MC-LAG interface to a destination stops when a member of the MC-LAG goes down. When QoS is applied, traffic on an NGFW cluster node going from an MC-LAG interface to a destination stops when a member of the MC-LAG goes down.
## PAN-254927 ## PAN-254927
```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
Certain types of data packets sent to threat inspection processing on the Networking cards of PA-7500 Series firewalls cause a pan_task crash. Certain types of data packets sent to threat inspection processing on the Networking cards of PA-7500 Series firewalls cause a pan_task crash.
## PAN-254827 ## PAN-254827
```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
When you change an IP address on a management interface on any of the NGFW cluster nodes, there's no workflow in cluster-config to detect this change, so the subsequent commit-all will not push the updated management IP address. When you change an IP address on a management interface on any of the NGFW cluster nodes, there's no workflow in cluster-config to detect this change, so the subsequent commit-all will not push the updated management IP address.
Workaround: You must manually make an unrelated change to cluster-config in order for Panorama to detect this change; the subsequent commit-all will push the cluster-config with the updated management IP address to cluster-manager. **Workaround:** You must manually make an unrelated change to cluster-config in order for Panorama to detect this change; the subsequent commit-all will push the cluster-config with the updated management IP address to cluster-manager.
## PAN-254351 ## PAN-254351
```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
An NGFW cluster node could get stuck in suspended state in some cases when you use GRE tunnel termination with keepalive enabled on both ends. An NGFW cluster node could get stuck in suspended state in some cases when you use GRE tunnel termination with keepalive enabled on both ends.
## PAN-254240 ## PAN-254240
@@ -194,10 +292,18 @@ The auto commit job may take longer than expected to complete when the Panorama
## PAN-253466 ## PAN-253466
```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
In the event of a cluster manager restart on the leader node of an NGFW cluster, traffic stops because the state machine transitions to unknown and the leader is not changing. In the event of a cluster manager restart on the leader node of an NGFW cluster, traffic stops because the state machine transitions to unknown and the leader is not changing.
## PAN-253466 ## PAN-253466
```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
On an NGFW cluster node, an expected packet buffer leak occurs with FTP/SIP traffic over an extended period of time. On an NGFW cluster node, an expected packet buffer leak occurs with FTP/SIP traffic over an extended period of time.
## PAN-252358 ## PAN-252358
@@ -210,7 +316,11 @@ In the event of a corosync restart, an NGFW cluster node goes to failed state.
## PAN-251639 ## PAN-251639
When a Wildfire Analysis security profile is enabled, an out of memory condition might occur due to a memory leak in the varrcvr process. ```caveat
This issue is now resolved. See PAN-OS 11.1.4 Addressed Issues.
```
When a Wildfire Analysis security profile is enabled, an out of memory condition might occur due to a memory leak in the `varrcvr` process.
## PAN-251551 ## PAN-251551
@@ -222,6 +332,10 @@ When an NGFW cluster agent crashes and doesn't recover, leader election will tak
## PAN-251501 ## PAN-251501
```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
Upon a reboot, an NGFW cluster node will occasionally fail to rejoin a cluster due to a timing issue. Upon a reboot, an NGFW cluster node will occasionally fail to rejoin a cluster due to a timing issue.
## PAN-250903 ## PAN-250903
@@ -234,18 +348,34 @@ In a congestion scenario on an HSCI port of an NGFW cluster node, the QoS priori
## PAN-250062 ## PAN-250062
```caveat
This issue is now resolved. See PAN-OS 11.1.4-h4 Addressed Issues.
```
Device telemetry might fail at configured intervals due to bundle generation issues. Device telemetry might fail at configured intervals due to bundle generation issues.
## PAN-250043 ## PAN-250043
```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
On an NGFW cluster node, if you configure a QoS interface with an Egress Max (Mbps) that exceeds 68000, the operation will fail with a message indicating "...is not a valid reference.…" The QoS Max bandwidth on any interface cannot be configured to be more than 68000. On an NGFW cluster node, if you configure a QoS interface with an Egress Max (Mbps) that exceeds 68000, the operation will fail with a message indicating "...is not a valid reference.…" The QoS Max bandwidth on any interface cannot be configured to be more than 68000.
## PAN-249727 ## PAN-249727
```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
On an NGFW cluster node, the Custom/Pre-defined URL category is not part of the session flow data and a promoted session after failover does not include it. On an NGFW cluster node, the Custom/Pre-defined URL category is not part of the session flow data and a promoted session after failover does not include it.
## PAN-248762 ## PAN-248762
```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
A firewall using the Advanced Routing Engine configured with OSPF crashes when connecting to the neighbor while exchanging route maps. A firewall using the Advanced Routing Engine configured with OSPF crashes when connecting to the neighbor while exchanging route maps.
## PAN-247974 ## PAN-247974
@@ -266,17 +396,22 @@ Cloud application information is missing from traffic logs on NGFW cluster nodes
## PAN-237106 ## PAN-237106
```caveat
This issue is now resolved. See PAN-OS 11.1.8 Addressed Issues
```
LSVPN satellite certificates may be generated with serial numbers exceeding 40 hexadecimal characters. This causes certificate revocation and deletion operations to fail with the following error messages: LSVPN satellite certificates may be generated with serial numbers exceeding 40 hexadecimal characters. This causes certificate revocation and deletion operations to fail with the following error messages:
db-serialno can be at most 40 characters - `db-serialno can be at most 40 characters`
- `db-serialno is invalid`
db-serialno is invalid **Workaround:**
To resolve this issue, use the following CLI commands with the LSVPN satellite serial number to manually delete or revoke the affected certificates: To resolve this issue, use the following CLI commands with the LSVPN satellite serial number to manually delete or revoke the affected certificates:
Delete certificate information:delete sslmgr-store certificate-info portal name <name> serialno <satellite_serial> **Delete certificate information**:`delete sslmgr-store certificate-info portal name <name> serialno <satellite_serial>`
Revoke satellite certificates:delete sslmgr-store satellite-info-revoke-certificate portal <name> serialno <list_of_satellite_serials> **Revoke satellite certificates**:`delete sslmgr-store satellite-info-revoke-certificate portal <name> serialno <list_of_satellite_serials>`
## PAN-234015 ## PAN-234015
@@ -284,6 +419,10 @@ The X-Forwarded-For (XFF) value is not displayed in traffic logs.
## PAN-227978 ## PAN-227978
```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
The UI widget does not accurately list the status of the port when NGFW clustering is enabled. The UI widget does not accurately list the status of the port when NGFW clustering is enabled.
## PAN-224502 ## PAN-224502
@@ -292,7 +431,7 @@ The autocommit time of the VM-Series firewall running PAN-OS 11.1.0 might take l
## PAN-220180 ## PAN-220180
Configured botnet reports (MonitorBotnet) are not generated. Configured botnet reports (**Monitor** > **Botnet**) are not generated.
## PAN-207733 ## PAN-207733
@@ -304,21 +443,13 @@ When a DHCPv6 client is configured on HA Active/Passive firewalls, the Passive f
## PAN-207442 ## PAN-207442
For M-700 appliances in an active/passive high availability (PanoramaHigh Availability) configuration, the active-primary HA peer configuration sync to the secondary-passive HA peer may fail. When the config sync fails, the job Results is Successful (Tasks), however the sync status on the Dashboard displays as Out of Sync for both HA peers. For M-700 appliances in an active/passive high availability (**Panorama** > **High Availability**) configuration, the `active-primary` HA peer configuration sync to the `secondary-passive` HA peer may fail. When the config sync fails, the job Results is `Successful` (**Tasks**), however the sync status on the **Dashboard** displays as `Out of Sync` for both HA peers.
Workaround: Perform a local commit on the active-primary HA peer and then synchronize the HA configuration. **Workaround**: Perform a local commit on the `active-primary` HA peer and then synchronize the HA configuration.
Log in to the Panorama web interface of the active-primary HA peer. 1. [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface) of the `active-primary` HA peer.
2. Select **Commit** and **Commit to Panorama**.
Log in to the Panorama web interface of the active-primary HA peer. 3. In the `active-primary` HA peer **Dashboard**, click **Sync to Peer** in the High Availability widget.
Select Commit and Commit to Panorama.
Select Commit and Commit to Panorama.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
## PAN-207040 ## PAN-207040
@@ -326,37 +457,18 @@ If you disable Advanced Routing, remove logical routers, and downgrade from PAN-
## PAN-206909 ## PAN-206909
The Dedicated Log Collector is unable to reconnect to the Panorama management server if the configd process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection Status (PanoramaManaged Collector) displaying connected and the managed colletor Health status displaying as healthy. The Dedicated Log Collector is unable to reconnect to the Panorama management server if the `configd` process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection `Status` (**Panorama** > **Managed Collector**) displaying `connected` and the managed colletor `Health` status displaying as healthy.
This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted. This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted.
Workaround: Restart the mgmtsrvr process on the Dedicated Log Collector. **Workaround:** Restart the `mgmtsrvr` process on the Dedicated Log Collector.
Log in to the Dedicated Log Collector CLI. 1. [Log in to the Dedicated Log Collector CLI](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli).
2. Confirm the Dedicated Log Collector is disconnected from Panorama.
Log in to the Dedicated Log Collector CLI. `admin>``show panorama-status`
Verify the `Connected` status is `no`.
Confirm the Dedicated Log Collector is disconnected from Panorama.admin> show panorama-status Verify the Connected status is no. 3. Restart the `mgmtsrvr` process.
`admin>``debug software restart process management-server`
Confirm the Dedicated Log Collector is disconnected from Panorama.
admin> show panorama-status Verify the Connected status is no.
admin> show panorama-status
admin> show panorama-status
Verify the Connected status is no.
Restart the mgmtsrvr process.admin> debug software restart process management-server
Restart the mgmtsrvr process.
admin> debug software restart process management-server
admin> debug software restart process management-server
admin> debug software restart process management-server
## PAN-197588 ## PAN-197588
@@ -368,11 +480,11 @@ The PAN-OS ACC (Application Command Center) does not display a widget detailing
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, the power over Ethernet (PoE) ports do not display a Tag value. In **Network** > **Interface** > **Ethernet**, the power over Ethernet (PoE) ports do not display a **Tag** value.
## PAN-196758 ## PAN-196758
On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you Preview Changes (CommitPush to DevicesEdit Selections or CommitCommit and PushEdit Selections). On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you **Preview Changes** (**Commit** > **Push to Devices** > **Edit Selections** or **Commit** > **Commit and Push** > **Edit Selections**).
## PAN-195968 ## PAN-195968
@@ -388,23 +500,23 @@ When using the CLI to configure power over Ethernet (PoE) on a non-PoE port, the
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, hovering the mouse over a power over Ethernet (PoE) Link State icon does not display link speed and link duplex details. In **Network** > **Interface** > **Ethernet**, hovering the mouse over a power over Ethernet (PoE) **Link State** icon does not display link speed and link duplex details.
## PAN-187685 ## PAN-187685
On the Panorama management server, the Template Status displays no synchronization status (PanoramaManaged DevicesSummary) after a bootstrapped firewall is successfully added to Panorama. On the Panorama management server, the Template Status displays no synchronization status (**Panorama** > **Managed Devices** > **Summary**) after a bootstrapped firewall is successfully added to Panorama.
Workaround: After the bootstrapped firewall is successfully added to Panorama, log in to the Panorama web interface and select CommitPush to Devices. **Workaround:** After the bootstrapped firewall is successfully added to Panorama, [log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) and select **Commit** > **Push to Devices**.
## PAN-187407 ## PAN-187407
The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to Hold client request for category lookup and the action set to Reset-Both and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed. The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to **Hold client request for category lookup**and the action set to **Reset-Both** and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed.
## PAN-186283 ## PAN-186283
Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS. Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS.
Workaround: Use CommitPush to Devices to synchronize the templates. **Workaround**: Use **Commit** > **Push to Devices** to synchronize the templates.
## PAN-184708 ## PAN-184708
@@ -412,29 +524,24 @@ Workaround: Use CommitPush to Devices to synchronize the templates.
Panorama managed firewalls Panorama managed firewalls
``` ```
Scheduled report emails (MonitorPDF ReportsEmail Scheduler) are not emailed if: Scheduled report emails (**Monitor** > **PDF Reports** > **Email Scheduler**) are not emailed if:
A scheduled report email contains a Report Group (MonitorPDF ReportsReport Group) which includes a SaaS Application Usage report. - A scheduled report email contains a Report Group (**Monitor** > **PDF Reports** > **Report Group**) which includes a SaaS Application Usage report.
- A scheduled report contains only a SaaS Application Usage Report.
A scheduled report contains only a SaaS Application Usage Report. **Workaround:** To receive a scheduled report email for all other PDF report types:
Workaround: To receive a scheduled report email for all other PDF report types: 1. Select **Monitor** > **PDF Reports** > **Report Groups** and remove all SaaS Application Usage reports from all Report Groups.
2. Select **Monitor** > **PDF Reports** > **Email Scheduler** and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select **Disable** and click **OK**.
Select MonitorPDF ReportsReport Groups and remove all SaaS Application Usage reports from all Report Groups. Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
3. **Commit**.
Select MonitorPDF ReportsEmail Scheduler and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select Disable and click OK.Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report. () Select **Commit** > **Commit and Push**
Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
Commit.() Select CommitCommit and Push
() Select CommitCommit and Push
## PAN-184406 ## PAN-184406
Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash. Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash.
Workaround: Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance. **Workaround:** Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance.
## PAN-183404 ## PAN-183404
@@ -446,4 +553,8 @@ If you use multiple log forwarding cards (LFCs) on the PA-7000 series, all of th
## PAN-164885 ## PAN-164885
On the Panorama management server, pushes to managed firewalls (CommitPush to Devices or Commit and Push) may fail when an EDL (ObjectsExternal Dynamic Lists) is configured to Check for updates every 5 minutes due to the commit and EDL fetch processes overlapping. This is more likely to occur when multiple EDLs are configured to check for updates every 5 minutes. ```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
On the Panorama management server, pushes to managed firewalls (**Commit** > **Push to Devices** or **Commit and Push**) may fail when an EDL (**Objects** > **External Dynamic Lists**) is configured to **Check for updates** every 5 minutes due to the commit and EDL fetch processes overlapping. This is more likely to occur when multiple EDLs are configured to check for updates every 5 minutes.
web/data/issues/PAN-OS/known/11.1.4.md
+276 -111
View File
@@ -6,18 +6,34 @@ version: 11.1.4
## PAN-304756 ## PAN-304756
```caveat
This issue is now resolved. See PAN-OS 11.1.13-h1 Addressed Issues.
```
After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems. After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems.
## PAN-298505 ## PAN-298505
```caveat
This issue is now resolved. See PAN-OS 11.1.6-h20 Addressed Issues, PAN-OS 11.1.10-h7 Addressed Issues, and PAN-OS 11.1.12 Addressed Issues
```
After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing auto-commit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems managed by Panorama, and the vsys ID sequence breaks when unused virtual systems are deleted and the changes are pushed to the firewall. After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing auto-commit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems managed by Panorama, and the vsys ID sequence breaks when unused virtual systems are deleted and the changes are pushed to the firewall.
## PAN-294179 ## PAN-294179
On the Panorama Config Audit page, some commit versions might display incorrect or missing data. Fields such as, COMMITTED BY , COMMIT DATE , and OBJECT CHANGES might not be visible for some commit versions. Sometimes, commit versions can disappear after a refresh and the commit description field might display corrupted characters. ```caveat
This issue is now resolved. See PAN-OS 11.1.6-h17 Addressed Issues.
```
On the**Panorama Config Audit** page, some commit versions might display incorrect or missing data. Fields such as, **COMMITTED BY**, **COMMIT DATE**, and**OBJECT CHANGES** might not be visible for some commit versions. Sometimes, commit versions can disappear after a refresh and the commit description field might display corrupted characters.
## PAN-293673 ## PAN-293673
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
When the firewall generates a high volume of logs and attempts to export these logs to an FTP server, it may consume excessive memory leading to all PAN-OS processes crashing. When the firewall generates a high volume of logs and attempts to export these logs to an FTP server, it may consume excessive memory leading to all PAN-OS processes crashing.
## PAN-291288 ## PAN-291288
@@ -26,6 +42,10 @@ An active firewall might unexpectedly reboot due to a pan_task crash caused by a
## PAN-290088 ## PAN-290088
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
When pushing configurations from Panorama to a firewall, a memory leak might occur in the firewall's configd process, particularly when the configurations contain shared policies. Each configuration push causes the configd process to consume additional memory that is not released after the commit completes. When pushing configurations from Panorama to a firewall, a memory leak might occur in the firewall's configd process, particularly when the configurations contain shared policies. Each configuration push causes the configd process to consume additional memory that is not released after the commit completes.
## PAN-289383 ## PAN-289383
@@ -36,67 +56,82 @@ PA-800 series firewalls only
Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation. Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation.
Workaround: Enable auto-negotiation on the connected peer firewall. **Workaround:** Enable auto-negotiation on the connected peer firewall.
## PAN-288097 ## PAN-288097
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
Routed process may stop responding after changing MTU or any link parameters when OSPF and PIM are enabled on the same interface. Routed process may stop responding after changing MTU or any link parameters when OSPF and PIM are enabled on the same interface.
## PAN-287871 ## PAN-287871
```caveat
This issue affects PAN-OS 11.1.4-h4
```
When SSL Inbound Inspection is enabled and the firewall receives fragmented Client Hello packets that include the TCP timestamp option, the Client Hello message is forwarded to the destination server without the timestamp option. When SSL Inbound Inspection is enabled and the firewall receives fragmented Client Hello packets that include the TCP timestamp option, the Client Hello message is forwarded to the destination server without the timestamp option.
## PAN-286255 ## PAN-286255
```caveat
This issue affects PAN-OS 11.1.4-h15
```
When a firewall receives an unexpected termination request for certain SSL sessions , NGFW dataplane might experience a slow buffer resource leak. When a firewall receives an unexpected termination request for certain SSL sessions , NGFW dataplane might experience a slow buffer resource leak.
Workaround: Disable accumulation proxy on the NGFW. **Workaround**: Disable accumulation proxy on the NGFW.
## PAN-286255 ## PAN-286255
```caveat
This issue affects PAN-OS 11.1.7-h2 This issue is now resolved. See PAN-OS 11.1.6-h7 Addressed Issues.
```
When a firewall receives an unexpected termination request for certain SSL sessions , NGFW dataplane might experience a slow buffer resource leak. When a firewall receives an unexpected termination request for certain SSL sessions , NGFW dataplane might experience a slow buffer resource leak.
Workaround: Disable accumulation proxy on the NGFW. **Workaround**: Disable accumulation proxy on the NGFW.
## PAN-286231 ## PAN-286231
When performing a partial Commit and Push on Panorama, there is a risk that unintended configuration changes might be pushed to a firewall. ```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
This issue is more likely to occur in the following scenarios:When you run Commit and Push operations as a single action.When you trigger multiple parallel commit-all jobs at the same time.Device groups and templates have different configuration synchronization versions. When performing a partial **Commit and Push** on Panorama, there is a risk that unintended configuration changes might be pushed to a firewall.
When you run Commit and Push operations as a single action. This issue is more likely to occur in the following scenarios:
When you run Commit and Push operations as a single action. - When you run **Commit and Push** operations as a single action.
- When you trigger multiple parallel commit-all jobs at the same time.
- Device groups and templates have different configuration synchronization versions.
When you trigger multiple parallel commit-all jobs at the same time. **Workaround:** Perform one of the following steps:
When you trigger multiple parallel commit-all jobs at the same time. - Perform commit and push as two separate, sequential steps.
- Perform a full push instead of selective push.
Device groups and templates have different configuration synchronization versions.
Device groups and templates have different configuration synchronization versions.
Workaround: Perform one of the following steps:
Perform commit and push as two separate, sequential steps.
Perform a full push instead of selective push.
## PAN-285894 ## PAN-285894
If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots. If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots.
Workaround: Disable the Preserve Pre-NAT feature using the set deviceconfig setting preserve-prenat-feature no CLI command. **Workaround:** Disable the Preserve Pre-NAT feature using the `set deviceconfig setting preserve-prenat-feature no` CLI command.
## PAN-285587 ## PAN-285587
```caveat
This issue affects PAN-OS 11.1.4-h13.
```
Bootstrapping the VM-Series firewall on OpenStack with user-data does not function correctly. When you run the command show system bootstrap status shows, the output shows the message No Install media detected. Bootstrapping the VM-Series firewall on OpenStack with user-data does not function correctly. When you run the command show system bootstrap status shows, the output shows the message No Install media detected.
## PAN-283429 ## PAN-283429
When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted. When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted.
Workaround: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates. **Workaround**: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates.
## PAN-281885 ## PAN-281885
@@ -104,28 +139,43 @@ When exporting and importing the CSV file, the hash values of pre-shared key (PS
## PAN-280532 ## PAN-280532
```caveat
This issue is now resolved. See PAN-OS 11.1.10 Addressed Issues.
```
When you use a single syslog server over TCP for log forwarding, and the connectivity to the syslog server breaks, syslog forwarding does not resume even after the connectivity to the server restores. When you use a single syslog server over TCP for log forwarding, and the connectivity to the syslog server breaks, syslog forwarding does not resume even after the connectivity to the server restores.
Workaround: Performing one of the following tasks: **Workaround:** Performing one of the following tasks:
Reboot the firewall. - Reboot the firewall.
- Temporarily, configure syslog to use UDP, commit the configuration, revert to TCP, and then commit.
Temporarily, configure syslog to use UDP, commit the configuration, revert to TCP, and then commit.
## PAN-280471 ## PAN-280471
When applying filters or searching for logs in the PanoramaMonitorLogssection, you might experience slow performance. When applying filters or searching for logs in the **Panorama** > **Monitor** > **Logs**section, you might experience slow performance.
## PAN-279746 ## PAN-279746
```caveat
This issue affects PAN-OS 11.1.4-h4 and PAN-OS 11.1.4-h7. This issue is now resolved. See PAN-OS 11.1.4-h15 Addressed Issues.
```
An SSL/TLS Client Hello may not be transmitted out of the firewall if the Client Hello arrives in multiple TCP segments and the traffic is not subject to SSL decryption (for example, SMTP over SSL). An SSL/TLS Client Hello may not be transmitted out of the firewall if the Client Hello arrives in multiple TCP segments and the traffic is not subject to SSL decryption (for example, SMTP over SSL).
## PAN-279621 ## PAN-279621
```caveat
This issue is now resolved. See PAN-OS 11.1.9 Addressed Issues.
```
Early aging and removal of firewall session while they are still active can lead to intermittent instabilities and crashes for proxy traffic, the Content and Threat detection engine, and any data-path processing. Early aging and removal of firewall session while they are still active can lead to intermittent instabilities and crashes for proxy traffic, the Content and Threat detection engine, and any data-path processing.
## PAN-279415 ## PAN-279415
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
Service routes configured for a data plane interface might incorrectly route traffic through the management plane interface instead. This issue impacts Syslog and CRL status traffic when the service route lacks a specific destination custom service route. Service routes configured for a data plane interface might incorrectly route traffic through the management plane interface instead. This issue impacts Syslog and CRL status traffic when the service route lacks a specific destination custom service route.
## PAN-278296 ## PAN-278296
@@ -134,62 +184,122 @@ The system MAC address of the aggregate interface is the same on both the active
## PAN-277417 ## PAN-277417
```caveat
This issue is now resolved. See PAN-OS 11.1.9 Addressed Issues.
```
Memory leak issues can occur during the parsing of server certificates used for SSL Inbound Inspection, preventing the firewall from completing inspection. Memory leak issues can occur during the parsing of server certificates used for SSL Inbound Inspection, preventing the firewall from completing inspection.
## PAN-277034 ## PAN-277034
```caveat
This issue is now resolved. See PAN-OS 11.1.10-h5 Addressed Issuesand PAN-OS 11.1.6-h19 Addressed Issues
```
WildFire reports might not fully display or be downloadable because some static resources fail to load. WildFire reports might not fully display or be downloadable because some static resources fail to load.
## PAN-275905 ## PAN-275905
```caveat
This issue affects PAN-OS 11.1.4-h4 and PAN-OS 11.1.4-h7.
```
A high volume of incoming logs to a Collector Group can significantly increase CPU usage on the Elasticsearch and Management Server, potentially causing process instability or crashes. A high volume of incoming logs to a Collector Group can significantly increase CPU usage on the Elasticsearch and Management Server, potentially causing process instability or crashes.
## PAN-275601 ## PAN-275601
When Panorama is not internet-connected and you try to upload images to the managed firewalls by using the Validate option, the upload fails with the following error: Failed to create multi-upload job. No valid software deploy targets found. ```caveat
This issue is now resolved. See PAN-OS 11.1.10 Addressed Issues
```
When Panorama is not internet-connected and you try to upload images to the managed firewalls by using the **Validate** option, the upload fails with the following error: `Failed to create multi-upload job. No valid software deploy targets found.`
## PAN-274791 ## PAN-274791
```caveat
This issue affects PAN-OS 11.1.4-h4 and PAN-OS 11.1.4-h7. This issue is now resolved. See PAN-OS 11.1.6-h3 Addressed Issues.
```
The firewall might reboot when traffic matches with certain Advanced features (such as Advanced Threat Prevention and Advanced URL Filtering with properly configured URL Filtering/Anti-Spyware/Vulnerability security profiles) and Shared Pool Type 32 becomes depleted. The firewall might reboot when traffic matches with certain Advanced features (such as Advanced Threat Prevention and Advanced URL Filtering with properly configured URL Filtering/Anti-Spyware/Vulnerability security profiles) and Shared Pool Type 32 becomes depleted.
## PAN-273300 ## PAN-273300
When upgrading Panorama from PAN-OS 10.2 or PAN-OS 11.0 to PAN-OS 11.1 or a later release, Panorama fails to upgrade if it is operating within a Collector Group. The following error appears:Error: Traceback (most recent call last):File "/opt/panrepo/releases/<PANOS release version>/validate"... (min ([dts['min'] for dts in 10g_type_intv_dir.values() if dts|'min']])-strftime ('%Y-%m-%d'), ```caveat
This issue is now resolved. See PAN-OS 11.1.6-h1 Addressed Issues
```
When upgrading Panorama from PAN-OS 10.2 or PAN-OS 11.0 to PAN-OS 11.1 or a later release, Panorama fails to upgrade if it is operating within a Collector Group. The following error appears:`Error: Traceback (most recent call last):File "/opt/panrepo/releases/<PANOS release version>/validate"... (min ([dts['min'] for dts in 10g_type_intv_dir.values() if dts|'min']])-strftime ('%Y-%m-%d'),`
## PAN-272085 ## PAN-272085
```caveat
(This issue affects PAN-OS 11.1.4-h4 and PAN-OS 11.1.4-h7.)
```
When DoH is enabled for DNS Security, multiple DoH transactions in a single HTTP/1 connection might unexpectedly cause the firewall to crash and reboot. When DoH is enabled for DNS Security, multiple DoH transactions in a single HTTP/1 connection might unexpectedly cause the firewall to crash and reboot.
Workaround: Manually disable DoH support for DNS Security using the set deviceconfig setting dns-over-https enable no CLI command. Alternatively, you can remove the DNS Security configuration used to handle DoH traffic. **Workaround:** Manually disable DoH support for DNS Security using the `set deviceconfig setting dns-over-https enable no` CLI command. Alternatively, you can remove the DNS Security configuration used to handle DoH traffic.
## PAN-270549 ## PAN-270549
```caveat
This issue affects PAN-OS 11.1.4-h4 and PAN-OS 11.1.4-h7. This issue is now resolved. See PAN-OS 11.1.6-h1 Addressed Issues.
```
Some TLS connections are not handled correctly leading to an instability in the dataplane of PAN-OS. Some TLS connections are not handled correctly leading to an instability in the dataplane of PAN-OS.
## PAN-270224
```caveat
This issue affects PAN-OS 11.1.4-h4 and PAN-OS 11.1.4-h7. This issue is now resolved. See PAN-OS 11.1.4-h9 Addressed Issues.
```
When querying for logs in the **Monitor** tab in Panorama, some forwarded logs might be missing from the results.
## PAN-269106 ## PAN-269106
When using a cloud-based ML detection engine (MICA), the wifclient might crash during server cert verification for MICA gRPC connections and cause the dataplane to restart. On certain platforms, this might cause the firewall to reboot. ```caveat
This issue affects PAN-OS 11.1.4-h4 and PAN-OS 11.1.4-h7. This issue is now resolved. See PAN-OS 11.1.6-h1 Addressed Issues.
```
Workaround: Disable CRL using the following CLI command:debug iot eal key-value PAN_ICD_SERVER_CERT_USE_CRL=False When using a cloud-based ML detection engine (MICA), the `wifclient` might crash during server cert verification for MICA gRPC connections and cause the dataplane to restart. On certain platforms, this might cause the firewall to reboot.
**Workaround**: Disable CRL using the following CLI command:`debug iot eal key-value PAN_ICD_SERVER_CERT_USE_CRL=False`
## PAN-267671 ## PAN-267671
```caveat
This issue is now resolved. See PAN-OS 11.1.4-h13 Addressed Issues.
```
Exporting reports in PDF or CSV format and processing hourly scheduled report results can potentially trigger memory leaks. As a result, this can lead to process crashes and firewall reboots. Exporting reports in PDF or CSV format and processing hourly scheduled report results can potentially trigger memory leaks. As a result, this can lead to process crashes and firewall reboots.
## PAN-268815 ## PAN-268815
When using IoT Security, the wifclient might exit multiple times causing the firewall to reboot. ```caveat
This issue affects PAN-OS 11.1.4-h4 and PAN-OS 11.1.4-h7. This issue is now resolved. See PAN-OS 11.1.6-h1 Addressed Issues.
```
Workaround: Uninstall the IoT Security license and disable Enable enhanced application logging (DeviceManagementCloud LoggingCloud Logging Settings). When using IoT Security, the `wifclient` might exit multiple times causing the firewall to reboot.
**Workaround**: Uninstall the IoT Security license and disable **Enable enhanced application logging** (**Device** > **Management** > **Cloud Logging** > **Cloud Logging Settings**).
## PAN-263226 ## PAN-263226
```caveat
This issue is now resolved. See PAN-OS 11.1.4-h4 Addressed Issues.
```
When SSL decryption is enabled and Client Hello messages span multiple TCP segments, elements from the proxy_l2info memory pool may not be freed properly. Memory leaks in this pool cause some SSL decryption sessions to fail. When SSL decryption is enabled and Client Hello messages span multiple TCP segments, elements from the proxy_l2info memory pool may not be freed properly. Memory leaks in this pool cause some SSL decryption sessions to fail.
Workaround: Disable Client Hello accumulation using the debug dataplane set ssl-decrypt accumulate-client-hello disable yes CLI command. **Workaround:** Disable Client Hello accumulation using the `debug dataplane set ssl-decrypt accumulate-client-hello disable yes` CLI command.
## PAN-263987 ## PAN-263987
```caveat
This issue is now resolved. See PAN-OS 11.1.4-h4 Addressed Issues.
```
When a NAT traversal (NAT-T or UDP encapsulation) IPSec tunnel is terminated on a Palo Alto Networks firewall and the NAT rule applied to the NAT-T IPSec tunnel is also on the same firewall, then the data traffic flowing through the NAT-T IPSec tunnel can't be NATed correctly. When a NAT traversal (NAT-T or UDP encapsulation) IPSec tunnel is terminated on a Palo Alto Networks firewall and the NAT rule applied to the NAT-T IPSec tunnel is also on the same firewall, then the data traffic flowing through the NAT-T IPSec tunnel can't be NATed correctly.
## PAN-263940 ## PAN-263940
@@ -214,58 +324,108 @@ Dereferencing a NULL pointer that occurs might cause pan_task processes to crash
## PAN-260851 ## PAN-260851
From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (ObjectsApplications) tag. From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (**Objects** > **Applications**) tag.
## PAN-260512 ## PAN-260512
```caveat
This issue affects PAN-OS 11.1.4-h4 and PAN-OS 11.1.4-h7. This issue is now resolved. See PAN-OS 11.1.4-h9 Addressed Issues.
```
When accessing the IP addresses of Dynamic address group objects from the Panorama user interface in a configuration with numerous Device Groups, the configd process might stop responding. When accessing the IP addresses of Dynamic address group objects from the Panorama user interface in a configuration with numerous Device Groups, the configd process might stop responding.
## PAN-259769 ## PAN-259769
GlobalProtect portal is not accessible via a web browser and the app displays the error ERR_EMPTY_RESPONSE. ```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues.
```
GlobalProtect portal is not accessible via a web browser and the app displays the error `ERR_EMPTY_RESPONSE`.
## PAN-259733
```caveat
This issue is now resolved. See PAN-OS 11.1.4-h1 Addressed Issues .
```
Custom reports created in PAN-OS are not deleted as expected, resulting in high memory use by the reportd process. This can lead to issues, such as out-of-memory conditions, content installation failures, and unexpected firewall reboots.
## PAN-258570 ## PAN-258570
```caveat
This issue affects PAN-OS 11.1.4-h4 and PAN-OS 11.1.4-h7. This issue is now resolved. See PAN-OS 11.1.6-h3 Addressed Issues.
```
The varrcvr process might progressively use more memory resulting in unexpected reboots when WildFire file forwarding is handling PE files. The varrcvr process might progressively use more memory resulting in unexpected reboots when WildFire file forwarding is handling PE files.
## PAN-257957 ## PAN-257957
```caveat
This issue affects 11.1.4-h1. This issue is now resolved. See PAN-OS 11.1.4-h4 Addressed Issues.
```
If you enable FIPS-CC mode and use the PAP or CHAP authentication methods for your RADIUS server, the authd process may restart unexpectedly. To avoid this issue, use one of the following workarounds: If you enable FIPS-CC mode and use the PAP or CHAP authentication methods for your RADIUS server, the authd process may restart unexpectedly. To avoid this issue, use one of the following workarounds:
If you use PAN-OS 10.2.10-h3, 10.2.11, or an earlier version, configure the RADIUS server so that it does not send the message authenticator back to client. - If you use PAN-OS 10.2.10-h3, 10.2.11, or an earlier version, configure the RADIUS server so that it does not send the message authenticator back to client.
- Use other protocols, such as LDAP, Kerberos, TACACS+, SAML, RADIUS EAP, instead of RADIUS PAP or CHAP.
Use other protocols, such as LDAP, Kerberos, TACACS+, SAML, RADIUS EAP, instead of RADIUS PAP or CHAP. - Change from FIPS mode to normal mode.
Change from FIPS mode to normal mode.
## PAN-257615 ## PAN-257615
```caveat
This issue is now resolved. See PAN-OS 11.1.4-h1 Addressed Issues.
```
The Panorama web interface intermittently displays logs or fails to display logs completely. The Panorama web interface intermittently displays logs or fails to display logs completely.
## PAN-255579 ## PAN-255579
```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues.
```
Demo Mode and Log Forwarding: PA-7500 Series firewalls and Panorama display data plane logs after a delay. Demo Mode and Log Forwarding: PA-7500 Series firewalls and Panorama display data plane logs after a delay.
## PAN-255285 ## PAN-255285
```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues.
```
If only the HCSI-A link is connected on NGFW cluster nodes (the HSCI-B link is not connected) and the management interfaces goes down, the situation will result in a split brain. If only the HCSI-A link is connected on NGFW cluster nodes (the HSCI-B link is not connected) and the management interfaces goes down, the situation will result in a split brain.
## PAN-255116 ## PAN-255116
```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
When QoS is applied, traffic on an NGFW cluster node going from an MC-LAG interface to a destination stops when a member of the MC-LAG goes down. When QoS is applied, traffic on an NGFW cluster node going from an MC-LAG interface to a destination stops when a member of the MC-LAG goes down.
## PAN-254927 ## PAN-254927
```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
Certain types of data packets sent to threat inspection processing on the Networking cards of PA-7500 Series firewalls cause a pan_task crash. Certain types of data packets sent to threat inspection processing on the Networking cards of PA-7500 Series firewalls cause a pan_task crash.
## PAN-254827 ## PAN-254827
```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
When you change an IP address on a management interface on any of the NGFW cluster nodes, there's no workflow in cluster-config to detect this change, so the subsequent commit-all will not push the updated management IP address. When you change an IP address on a management interface on any of the NGFW cluster nodes, there's no workflow in cluster-config to detect this change, so the subsequent commit-all will not push the updated management IP address.
Workaround: You must manually make an unrelated change to cluster-config in order for Panorama to detect this change; the subsequent commit-all will push the cluster-config with the updated management IP address to cluster-manager. **Workaround:** You must manually make an unrelated change to cluster-config in order for Panorama to detect this change; the subsequent commit-all will push the cluster-config with the updated management IP address to cluster-manager.
## PAN-254351 ## PAN-254351
```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
An NGFW cluster node could get stuck in suspended state in some cases when you use GRE tunnel termination with keepalive enabled on both ends. An NGFW cluster node could get stuck in suspended state in some cases when you use GRE tunnel termination with keepalive enabled on both ends.
## PAN-254240 ## PAN-254240
@@ -282,6 +442,10 @@ In the event of a cluster manager restart on the leader node of an NGFW cluster,
## PAN-253466 ## PAN-253466
```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
On an NGFW cluster node, an expected packet buffer leak occurs with FTP/SIP traffic over an extended period of time. On an NGFW cluster node, an expected packet buffer leak occurs with FTP/SIP traffic over an extended period of time.
## PAN-252358 ## PAN-252358
@@ -302,6 +466,10 @@ When an NGFW cluster agent crashes and doesn't recover, leader election will tak
## PAN-251501 ## PAN-251501
```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
Upon a reboot, an NGFW cluster node will occasionally fail to rejoin a cluster due to a timing issue. Upon a reboot, an NGFW cluster node will occasionally fail to rejoin a cluster due to a timing issue.
## PAN-250903 ## PAN-250903
@@ -314,18 +482,34 @@ In a congestion scenario on an HSCI port of an NGFW cluster node, the QoS priori
## PAN-250062 ## PAN-250062
```caveat
This issue is now resolved. See PAN-OS 11.1.4-h4 Addressed Issues.
```
Device telemetry might fail at configured intervals due to bundle generation issues. Device telemetry might fail at configured intervals due to bundle generation issues.
## PAN-250043 ## PAN-250043
```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
On an NGFW cluster node, if you configure a QoS interface with an Egress Max (Mbps) that exceeds 68000, the operation will fail with a message indicating "...is not a valid reference.…" The QoS Max bandwidth on any interface cannot be configured to be more than 68000. On an NGFW cluster node, if you configure a QoS interface with an Egress Max (Mbps) that exceeds 68000, the operation will fail with a message indicating "...is not a valid reference.…" The QoS Max bandwidth on any interface cannot be configured to be more than 68000.
## PAN-249727 ## PAN-249727
```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
On an NGFW cluster node, the Custom/Pre-defined URL category is not part of the session flow data and a promoted session after failover does not include it. On an NGFW cluster node, the Custom/Pre-defined URL category is not part of the session flow data and a promoted session after failover does not include it.
## PAN-248762 ## PAN-248762
```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
A firewall using the Advanced Routing Engine configured with OSPF crashes when connecting to the neighbor while exchanging route maps. A firewall using the Advanced Routing Engine configured with OSPF crashes when connecting to the neighbor while exchanging route maps.
## PAN-247974 ## PAN-247974
@@ -346,17 +530,22 @@ Cloud application information is missing from traffic logs on NGFW cluster nodes
## PAN-237106 ## PAN-237106
```caveat
This issue is now resolved. See PAN-OS 11.1.8 Addressed Issues
```
LSVPN satellite certificates may be generated with serial numbers exceeding 40 hexadecimal characters. This causes certificate revocation and deletion operations to fail with the following error messages: LSVPN satellite certificates may be generated with serial numbers exceeding 40 hexadecimal characters. This causes certificate revocation and deletion operations to fail with the following error messages:
db-serialno can be at most 40 characters - `db-serialno can be at most 40 characters`
- `db-serialno is invalid`
db-serialno is invalid **Workaround:**
To resolve this issue, use the following CLI commands with the LSVPN satellite serial number to manually delete or revoke the affected certificates: To resolve this issue, use the following CLI commands with the LSVPN satellite serial number to manually delete or revoke the affected certificates:
Delete certificate information:delete sslmgr-store certificate-info portal name <name> serialno <satellite_serial> **Delete certificate information**:`delete sslmgr-store certificate-info portal name <name> serialno <satellite_serial>`
Revoke satellite certificates:delete sslmgr-store satellite-info-revoke-certificate portal <name> serialno <list_of_satellite_serials> **Revoke satellite certificates**:`delete sslmgr-store satellite-info-revoke-certificate portal <name> serialno <list_of_satellite_serials>`
## PAN-234015 ## PAN-234015
@@ -364,6 +553,10 @@ The X-Forwarded-For (XFF) value is not displayed in traffic logs.
## PAN-227978 ## PAN-227978
```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
The UI widget does not accurately list the status of the port when NGFW clustering is enabled. The UI widget does not accurately list the status of the port when NGFW clustering is enabled.
## PAN-224502 ## PAN-224502
@@ -372,7 +565,7 @@ The autocommit time of the VM-Series firewall running PAN-OS 11.1.0 might take l
## PAN-220180 ## PAN-220180
Configured botnet reports (MonitorBotnet) are not generated. Configured botnet reports (**Monitor** > **Botnet**) are not generated.
## PAN-207733 ## PAN-207733
@@ -384,21 +577,13 @@ When a DHCPv6 client is configured on HA Active/Passive firewalls, the Passive f
## PAN-207442 ## PAN-207442
For M-700 appliances in an active/passive high availability (PanoramaHigh Availability) configuration, the active-primary HA peer configuration sync to the secondary-passive HA peer may fail. When the config sync fails, the job Results is Successful (Tasks), however the sync status on the Dashboard displays as Out of Sync for both HA peers. For M-700 appliances in an active/passive high availability (**Panorama** > **High Availability**) configuration, the `active-primary` HA peer configuration sync to the `secondary-passive` HA peer may fail. When the config sync fails, the job Results is `Successful` (**Tasks**), however the sync status on the **Dashboard** displays as `Out of Sync` for both HA peers.
Workaround: Perform a local commit on the active-primary HA peer and then synchronize the HA configuration. **Workaround**: Perform a local commit on the `active-primary` HA peer and then synchronize the HA configuration.
Log in to the Panorama web interface of the active-primary HA peer. 1. [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface) of the `active-primary` HA peer.
2. Select **Commit** and **Commit to Panorama**.
Log in to the Panorama web interface of the active-primary HA peer. 3. In the `active-primary` HA peer **Dashboard**, click **Sync to Peer** in the High Availability widget.
Select Commit and Commit to Panorama.
Select Commit and Commit to Panorama.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
## PAN-207040 ## PAN-207040
@@ -406,37 +591,18 @@ If you disable Advanced Routing, remove logical routers, and downgrade from PAN-
## PAN-206909 ## PAN-206909
The Dedicated Log Collector is unable to reconnect to the Panorama management server if the configd process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection Status (PanoramaManaged Collector) displaying connected and the managed colletor Health status displaying as healthy. The Dedicated Log Collector is unable to reconnect to the Panorama management server if the `configd` process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection `Status` (**Panorama** > **Managed Collector**) displaying `connected` and the managed colletor `Health` status displaying as healthy.
This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted. This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted.
Workaround: Restart the mgmtsrvr process on the Dedicated Log Collector. **Workaround:** Restart the `mgmtsrvr` process on the Dedicated Log Collector.
Log in to the Dedicated Log Collector CLI. 1. [Log in to the Dedicated Log Collector CLI](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli).
2. Confirm the Dedicated Log Collector is disconnected from Panorama.
Log in to the Dedicated Log Collector CLI. `admin>``show panorama-status`
Verify the `Connected` status is `no`.
Confirm the Dedicated Log Collector is disconnected from Panorama.admin> show panorama-status Verify the Connected status is no. 3. Restart the `mgmtsrvr` process.
`admin>``debug software restart process management-server`
Confirm the Dedicated Log Collector is disconnected from Panorama.
admin> show panorama-status Verify the Connected status is no.
admin> show panorama-status
admin> show panorama-status
Verify the Connected status is no.
Restart the mgmtsrvr process.admin> debug software restart process management-server
Restart the mgmtsrvr process.
admin> debug software restart process management-server
admin> debug software restart process management-server
admin> debug software restart process management-server
## PAN-197588 ## PAN-197588
@@ -448,11 +614,11 @@ The PAN-OS ACC (Application Command Center) does not display a widget detailing
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, the power over Ethernet (PoE) ports do not display a Tag value. In **Network** > **Interface** > **Ethernet**, the power over Ethernet (PoE) ports do not display a **Tag** value.
## PAN-196758 ## PAN-196758
On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you Preview Changes (CommitPush to DevicesEdit Selections or CommitCommit and PushEdit Selections). On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you **Preview Changes** (**Commit** > **Push to Devices** > **Edit Selections** or **Commit** > **Commit and Push** > **Edit Selections**).
## PAN-195968 ## PAN-195968
@@ -468,23 +634,23 @@ When using the CLI to configure power over Ethernet (PoE) on a non-PoE port, the
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, hovering the mouse over a power over Ethernet (PoE) Link State icon does not display link speed and link duplex details. In **Network** > **Interface** > **Ethernet**, hovering the mouse over a power over Ethernet (PoE) **Link State** icon does not display link speed and link duplex details.
## PAN-187685 ## PAN-187685
On the Panorama management server, the Template Status displays no synchronization status (PanoramaManaged DevicesSummary) after a bootstrapped firewall is successfully added to Panorama. On the Panorama management server, the Template Status displays no synchronization status (**Panorama** > **Managed Devices** > **Summary**) after a bootstrapped firewall is successfully added to Panorama.
Workaround: After the bootstrapped firewall is successfully added to Panorama, log in to the Panorama web interface and select CommitPush to Devices. **Workaround:** After the bootstrapped firewall is successfully added to Panorama, [log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) and select **Commit** > **Push to Devices**.
## PAN-187407 ## PAN-187407
The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to Hold client request for category lookup and the action set to Reset-Both and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed. The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to **Hold client request for category lookup**and the action set to **Reset-Both** and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed.
## PAN-186283 ## PAN-186283
Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS. Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS.
Workaround: Use CommitPush to Devices to synchronize the templates. **Workaround**: Use **Commit** > **Push to Devices** to synchronize the templates.
## PAN-184708 ## PAN-184708
@@ -492,29 +658,24 @@ Workaround: Use CommitPush to Devices to synchronize the templates.
Panorama managed firewalls Panorama managed firewalls
``` ```
Scheduled report emails (MonitorPDF ReportsEmail Scheduler) are not emailed if: Scheduled report emails (**Monitor** > **PDF Reports** > **Email Scheduler**) are not emailed if:
A scheduled report email contains a Report Group (MonitorPDF ReportsReport Group) which includes a SaaS Application Usage report. - A scheduled report email contains a Report Group (**Monitor** > **PDF Reports** > **Report Group**) which includes a SaaS Application Usage report.
- A scheduled report contains only a SaaS Application Usage Report.
A scheduled report contains only a SaaS Application Usage Report. **Workaround:** To receive a scheduled report email for all other PDF report types:
Workaround: To receive a scheduled report email for all other PDF report types: 1. Select **Monitor** > **PDF Reports** > **Report Groups** and remove all SaaS Application Usage reports from all Report Groups.
2. Select **Monitor** > **PDF Reports** > **Email Scheduler** and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select **Disable** and click **OK**.
Select MonitorPDF ReportsReport Groups and remove all SaaS Application Usage reports from all Report Groups. Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
3. **Commit**.
Select MonitorPDF ReportsEmail Scheduler and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select Disable and click OK.Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report. () Select **Commit** > **Commit and Push**
Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
Commit.() Select CommitCommit and Push
() Select CommitCommit and Push
## PAN-184406 ## PAN-184406
Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash. Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash.
Workaround: Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance. **Workaround:** Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance.
## PAN-183404 ## PAN-183404
@@ -526,4 +687,8 @@ If you use multiple log forwarding cards (LFCs) on the PA-7000 series, all of th
## PAN-164885 ## PAN-164885
On the Panorama management server, pushes to managed firewalls (CommitPush to Devices or Commit and Push) may fail when an EDL (ObjectsExternal Dynamic Lists) is configured to Check for updates every 5 minutes due to the commit and EDL fetch processes overlapping. This is more likely to occur when multiple EDLs are configured to check for updates every 5 minutes. ```caveat
This issue is now resolved. See PAN-OS 11.1.5 Addressed Issues
```
On the Panorama management server, pushes to managed firewalls (**Commit** > **Push to Devices** or **Commit and Push**) may fail when an EDL (**Objects** > **External Dynamic Lists**) is configured to **Check for updates** every 5 minutes due to the commit and EDL fetch processes overlapping. This is more likely to occur when multiple EDLs are configured to check for updates every 5 minutes.
web/data/issues/PAN-OS/known/11.1.5.md
+151 -80
View File
@@ -6,14 +6,42 @@ version: 11.1.5
## PAN-304756 ## PAN-304756
```caveat
This issue is now resolved. See PAN-OS 11.1.13-h1 Addressed Issues.
```
After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems. After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems.
## PAN-298505 ## PAN-298505
```caveat
This issue is now resolved. See PAN-OS 11.1.6-h20 Addressed Issues, PAN-OS 11.1.10-h7 Addressed Issues, and PAN-OS 11.1.12 Addressed Issues
```
After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing auto-commit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems managed by Panorama, and the vsys ID sequence breaks when unused virtual systems are deleted and the changes are pushed to the firewall. After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing auto-commit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems managed by Panorama, and the vsys ID sequence breaks when unused virtual systems are deleted and the changes are pushed to the firewall.
## PAN-294179
```caveat
This issue is now resolved. See PAN-OS 11.1.6-h17 Addressed Issues.
```
On the**Panorama Config Audit** page, some commit versions might display incorrect or missing data. Fields such as, **COMMITTED BY**, **COMMIT DATE**, and**OBJECT CHANGES** might not be visible for some commit versions. Sometimes, commit versions can disappear after a refresh and the commit description field might display corrupted characters.
## PAN-293673
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
When the firewall generates a high volume of logs and attempts to export these logs to an FTP server, it may consume excessive memory leading to all PAN-OS processes crashing.
## PAN-292202 ## PAN-292202
```caveat
This issue is now resolved. See
```
The system logs repeatedly displayed the alert `Clearing snmpd.log due to log overflow` due to the SNMP counters rolling over. This is a benign message and does not impact device functionality. The system logs repeatedly displayed the alert `Clearing snmpd.log due to log overflow` due to the SNMP counters rolling over. This is a benign message and does not impact device functionality.
## PAN-291288 ## PAN-291288
@@ -22,6 +50,10 @@ An active firewall might unexpectedly reboot due to a pan_task crash caused by a
## PAN-290088 ## PAN-290088
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
When pushing configurations from Panorama to a firewall, a memory leak might occur in the firewall's configd process, particularly when the configurations contain shared policies. Each configuration push causes the configd process to consume additional memory that is not released after the commit completes. When pushing configurations from Panorama to a firewall, a memory leak might occur in the firewall's configd process, particularly when the configurations contain shared policies. Each configuration push causes the configd process to consume additional memory that is not released after the commit completes.
## PAN-289383 ## PAN-289383
@@ -32,10 +64,14 @@ PA-800 series firewalls only
Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation. Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation.
Workaround: Enable auto-negotiation on the connected peer firewall. **Workaround:** Enable auto-negotiation on the connected peer firewall.
## PAN-288097 ## PAN-288097
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
Routed process may stop responding after changing MTU or any link parameters when OSPF and PIM are enabled on the same interface. Routed process may stop responding after changing MTU or any link parameters when OSPF and PIM are enabled on the same interface.
## PAN-287871 ## PAN-287871
@@ -44,6 +80,10 @@ When SSL Inbound Inspection is enabled and the firewall receives fragmented Clie
## PAN-287056 ## PAN-287056
```caveat
This issue is now resolved. See PAN-OS 11.1.6-h14 Addressed Issues
```
A BGP export policy rule that matches on a next hop fails to block the advertisement of static routes, and the firewall incorrectly matches the egress interface IP address instead of the original next-hop IP address of the static route, which causes the deny rule to fail. A BGP export policy rule that matches on a next hop fails to block the advertisement of static routes, and the firewall incorrectly matches the egress interface IP address instead of the original next-hop IP address of the static route, which causes the deny rule to fail.
## PAN-286496 ## PAN-286496
@@ -56,21 +96,44 @@ URL-continue and override continue selections will function like a general URL-b
## PAN-286255 ## PAN-286255
```caveat
This issue is now resolved. See PAN-OS 11.1.6-h7 Addressed Issues.
```
When a firewall receives an unexpected termination request for certain SSL sessions, NGFW dataplane might experience a slow buffer resource leak. When a firewall receives an unexpected termination request for certain SSL sessions, NGFW dataplane might experience a slow buffer resource leak.
Workaround: Disable accumulation proxy on the NGFW. **Workaround**: Disable accumulation proxy on the NGFW.
## PAN-286231
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
When performing a partial **Commit and Push** on Panorama, there is a risk that unintended configuration changes might be pushed to a firewall.
This issue is more likely to occur in the following scenarios:
- When you run **Commit and Push** operations as a single action.
- When you trigger multiple parallel commit-all jobs at the same time.
- Device groups and templates have different configuration synchronization versions.
**Workaround:** Perform one of the following steps:
- Perform commit and push as two separate, sequential steps.
- Perform a full push instead of selective push.
## PAN-285894 ## PAN-285894
If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots. If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots.
Workaround: Disable the Preserve Pre-NAT feature using the set deviceconfig setting preserve-prenat-feature no CLI command. **Workaround:** Disable the Preserve Pre-NAT feature using the `set deviceconfig setting preserve-prenat-feature no` CLI command.
## PAN-283429 ## PAN-283429
When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted. When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted.
Workaround: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates. **Workaround**: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates.
## PAN-281885 ## PAN-281885
@@ -78,17 +141,20 @@ When exporting and importing the CSV file, the hash values of pre-shared key (PS
## PAN-280532 ## PAN-280532
```caveat
This issue is now resolved. See PAN-OS 11.1.10 Addressed Issues.
```
When you use a single syslog server over TCP for log forwarding, and the connectivity to the syslog server breaks, syslog forwarding does not resume even after the connectivity to the server restores. When you use a single syslog server over TCP for log forwarding, and the connectivity to the syslog server breaks, syslog forwarding does not resume even after the connectivity to the server restores.
Workaround: Performing one of the following tasks: **Workaround:** Performing one of the following tasks:
Reboot the firewall. - Reboot the firewall.
- Temporarily, configure syslog to use UDP, commit the configuration, revert to TCP, and then commit.
Temporarily, configure syslog to use UDP, commit the configuration, revert to TCP, and then commit.
## PAN-280471 ## PAN-280471
When applying filters or searching for logs in the PanoramaMonitorLogssection, you might experience slow performance. When applying filters or searching for logs in the **Panorama** > **Monitor** > **Logs**section, you might experience slow performance.
## PAN-279746 ## PAN-279746
@@ -96,10 +162,18 @@ An SSL/TLS Client Hello may not be transmitted out of the firewall if the Client
## PAN-279621 ## PAN-279621
```caveat
This issue is now resolved. See PAN-OS 11.1.9 Addressed Issues.
```
Early aging and removal of firewall session while they are still active can lead to intermittent instabilities and crashes for proxy traffic, the Content and Threat detection engine, and any data-path processing. Early aging and removal of firewall session while they are still active can lead to intermittent instabilities and crashes for proxy traffic, the Content and Threat detection engine, and any data-path processing.
## PAN-279415 ## PAN-279415
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
Service routes configured for a data plane interface might incorrectly route traffic through the management plane interface instead. This issue impacts Syslog and CRL status traffic when the service route lacks a specific destination custom service route. Service routes configured for a data plane interface might incorrectly route traffic through the management plane interface instead. This issue impacts Syslog and CRL status traffic when the service route lacks a specific destination custom service route.
## PAN-278296 ## PAN-278296
@@ -108,22 +182,42 @@ The system MAC address of the aggregate interface is the same on both the active
## PAN-277417 ## PAN-277417
```caveat
This issue is now resolved. See PAN-OS 11.1.9 Addressed Issues.
```
Memory leak issues can occur during the parsing of server certificates used for SSL Inbound Inspection, preventing the firewall from completing inspection. Memory leak issues can occur during the parsing of server certificates used for SSL Inbound Inspection, preventing the firewall from completing inspection.
## PAN-277034 ## PAN-277034
```caveat
This issue is now resolved. See PAN-OS 11.1.10-h5 Addressed Issuesand PAN-OS 11.1.6-h19 Addressed Issues
```
WildFire reports might not fully display or be downloadable because some static resources fail to load. WildFire reports might not fully display or be downloadable because some static resources fail to load.
## PAN-275601 ## PAN-275601
When Panorama is not internet-connected and you try to upload images to the managed firewalls by using the Validate option, the upload fails with the following error: Failed to create multi-upload job. No valid software deploy targets found. ```caveat
This issue is now resolved. See PAN-OS 11.1.10 Addressed Issues
```
When Panorama is not internet-connected and you try to upload images to the managed firewalls by using the **Validate** option, the upload fails with the following error: `Failed to create multi-upload job. No valid software deploy targets found.`
## PAN-273300 ## PAN-273300
When upgrading Panorama from PAN-OS 10.2 or PAN-OS 11.0 to PAN-OS 11.1 or a later release, Panorama fails to upgrade if it is operating within a Collector Group. The following error appears:Error: Traceback (most recent call last):File "/opt/panrepo/releases/<PANOS release version>/validate"... (min ([dts['min'] for dts in 10g_type_intv_dir.values() if dts|'min']])-strftime ('%Y-%m-%d'), ```caveat
This issue is now resolved. See PAN-OS 11.1.6-h1 Addressed Issues
```
When upgrading Panorama from PAN-OS 10.2 or PAN-OS 11.0 to PAN-OS 11.1 or a later release, Panorama fails to upgrade if it is operating within a Collector Group. The following error appears:`Error: Traceback (most recent call last):File "/opt/panrepo/releases/<PANOS release version>/validate"... (min ([dts['min'] for dts in 10g_type_intv_dir.values() if dts|'min']])-strftime ('%Y-%m-%d'),`
## PAN-269193 ## PAN-269193
```caveat
This issue is now resolved. See PAN-OS 11.1.8 Addressed Issues.
```
When multiple application are configured for GlobalProtect Clientless VPN, users are directed to the first application instead of the portal page with a list of application. When multiple application are configured for GlobalProtect Clientless VPN, users are directed to the first application instead of the portal page with a list of application.
## PAN-262556 ## PAN-262556
@@ -132,11 +226,15 @@ The ElasticSearch cluster health status might continue to remain yellow for an e
## PAN-261429 ## PAN-261429
The command show auth radius-require-msg-authentic might return no output. ```caveat
This issue is now resolved. See PAN-OS 11.1.6-h10 Addressed Issues and PAN-OS 11.1.8 Addressed Issues.
```
The command `show auth radius-require-msg-authentic` might return no output.
## PAN-260851 ## PAN-260851
From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (ObjectsApplications) tag. From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (**Objects** > **Applications**) tag.
## PAN-254240 ## PAN-254240
@@ -188,17 +286,22 @@ Cloud application information is missing from traffic logs on NGFW cluster nodes
## PAN-237106 ## PAN-237106
```caveat
This issue is now resolved. See PAN-OS 11.1.8 Addressed Issues
```
LSVPN satellite certificates may be generated with serial numbers exceeding 40 hexadecimal characters. This causes certificate revocation and deletion operations to fail with the following error messages: LSVPN satellite certificates may be generated with serial numbers exceeding 40 hexadecimal characters. This causes certificate revocation and deletion operations to fail with the following error messages:
db-serialno can be at most 40 characters - `db-serialno can be at most 40 characters`
- `db-serialno is invalid`
db-serialno is invalid **Workaround:**
To resolve this issue, use the following CLI commands with the LSVPN satellite serial number to manually delete or revoke the affected certificates: To resolve this issue, use the following CLI commands with the LSVPN satellite serial number to manually delete or revoke the affected certificates:
Delete certificate information:delete sslmgr-store certificate-info portal name <name> serialno <satellite_serial> **Delete certificate information**:`delete sslmgr-store certificate-info portal name <name> serialno <satellite_serial>`
Revoke satellite certificates:delete sslmgr-store satellite-info-revoke-certificate portal <name> serialno <list_of_satellite_serials> **Revoke satellite certificates**:`delete sslmgr-store satellite-info-revoke-certificate portal <name> serialno <list_of_satellite_serials>`
## PAN-234015 ## PAN-234015
@@ -210,7 +313,7 @@ The autocommit time of the VM-Series firewall running PAN-OS 11.1.0 might take l
## PAN-220180 ## PAN-220180
Configured botnet reports (MonitorBotnet) are not generated. Configured botnet reports (**Monitor** > **Botnet**) are not generated.
## PAN-207733 ## PAN-207733
@@ -222,21 +325,13 @@ When a DHCPv6 client is configured on HA Active/Passive firewalls, the Passive f
## PAN-207442 ## PAN-207442
For M-700 appliances in an active/passive high availability (PanoramaHigh Availability) configuration, the active-primary HA peer configuration sync to the secondary-passive HA peer may fail. When the config sync fails, the job Results is Successful (Tasks), however the sync status on the Dashboard displays as Out of Sync for both HA peers. For M-700 appliances in an active/passive high availability (**Panorama** > **High Availability**) configuration, the `active-primary` HA peer configuration sync to the `secondary-passive` HA peer may fail. When the config sync fails, the job Results is `Successful` (**Tasks**), however the sync status on the **Dashboard** displays as `Out of Sync` for both HA peers.
Workaround: Perform a local commit on the active-primary HA peer and then synchronize the HA configuration. **Workaround**: Perform a local commit on the `active-primary` HA peer and then synchronize the HA configuration.
Log in to the Panorama web interface of the active-primary HA peer. 1. [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface) of the `active-primary` HA peer.
2. Select **Commit** and **Commit to Panorama**.
Log in to the Panorama web interface of the active-primary HA peer. 3. In the `active-primary` HA peer **Dashboard**, click **Sync to Peer** in the High Availability widget.
Select Commit and Commit to Panorama.
Select Commit and Commit to Panorama.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
## PAN-207040 ## PAN-207040
@@ -244,37 +339,18 @@ If you disable Advanced Routing, remove logical routers, and downgrade from PAN-
## PAN-206909 ## PAN-206909
The Dedicated Log Collector is unable to reconnect to the Panorama management server if the configd process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection Status (PanoramaManaged Collector) displaying connected and the managed colletor Health status displaying as healthy. The Dedicated Log Collector is unable to reconnect to the Panorama management server if the `configd` process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection `Status` (**Panorama** > **Managed Collector**) displaying `connected` and the managed colletor `Health` status displaying as healthy.
This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted. This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted.
Workaround: Restart the mgmtsrvr process on the Dedicated Log Collector. **Workaround:** Restart the `mgmtsrvr` process on the Dedicated Log Collector.
Log in to the Dedicated Log Collector CLI. 1. [Log in to the Dedicated Log Collector CLI](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli).
2. Confirm the Dedicated Log Collector is disconnected from Panorama.
Log in to the Dedicated Log Collector CLI. `admin>``show panorama-status`
Verify the `Connected` status is `no`.
Confirm the Dedicated Log Collector is disconnected from Panorama.admin> show panorama-status Verify the Connected status is no. 3. Restart the `mgmtsrvr` process.
`admin>``debug software restart process management-server`
Confirm the Dedicated Log Collector is disconnected from Panorama.
admin> show panorama-status Verify the Connected status is no.
admin> show panorama-status
admin> show panorama-status
Verify the Connected status is no.
Restart the mgmtsrvr process.admin> debug software restart process management-server
Restart the mgmtsrvr process.
admin> debug software restart process management-server
admin> debug software restart process management-server
admin> debug software restart process management-server
## PAN-197588 ## PAN-197588
@@ -286,11 +362,11 @@ The PAN-OS ACC (Application Command Center) does not display a widget detailing
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, the power over Ethernet (PoE) ports do not display a Tag value. In **Network** > **Interface** > **Ethernet**, the power over Ethernet (PoE) ports do not display a **Tag** value.
## PAN-196758 ## PAN-196758
On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you Preview Changes (CommitPush to DevicesEdit Selections or CommitCommit and PushEdit Selections). On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you **Preview Changes** (**Commit** > **Push to Devices** > **Edit Selections** or **Commit** > **Commit and Push** > **Edit Selections**).
## PAN-195968 ## PAN-195968
@@ -306,23 +382,23 @@ When using the CLI to configure power over Ethernet (PoE) on a non-PoE port, the
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, hovering the mouse over a power over Ethernet (PoE) Link State icon does not display link speed and link duplex details. In **Network** > **Interface** > **Ethernet**, hovering the mouse over a power over Ethernet (PoE) **Link State** icon does not display link speed and link duplex details.
## PAN-187685 ## PAN-187685
On the Panorama management server, the Template Status displays no synchronization status (PanoramaManaged DevicesSummary) after a bootstrapped firewall is successfully added to Panorama. On the Panorama management server, the Template Status displays no synchronization status (**Panorama** > **Managed Devices** > **Summary**) after a bootstrapped firewall is successfully added to Panorama.
Workaround: After the bootstrapped firewall is successfully added to Panorama, log in to the Panorama web interface and select CommitPush to Devices. **Workaround:** After the bootstrapped firewall is successfully added to Panorama, [log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) and select **Commit** > **Push to Devices**.
## PAN-187407 ## PAN-187407
The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to Hold client request for category lookup and the action set to Reset-Both and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed. The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to **Hold client request for category lookup**and the action set to **Reset-Both** and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed.
## PAN-186283 ## PAN-186283
Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS. Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS.
Workaround: Use CommitPush to Devices to synchronize the templates. **Workaround**: Use **Commit** > **Push to Devices** to synchronize the templates.
## PAN-184708 ## PAN-184708
@@ -330,29 +406,24 @@ Workaround: Use CommitPush to Devices to synchronize the templates.
Panorama managed firewalls Panorama managed firewalls
``` ```
Scheduled report emails (MonitorPDF ReportsEmail Scheduler) are not emailed if: Scheduled report emails (**Monitor** > **PDF Reports** > **Email Scheduler**) are not emailed if:
A scheduled report email contains a Report Group (MonitorPDF ReportsReport Group) which includes a SaaS Application Usage report. - A scheduled report email contains a Report Group (**Monitor** > **PDF Reports** > **Report Group**) which includes a SaaS Application Usage report.
- A scheduled report contains only a SaaS Application Usage Report.
A scheduled report contains only a SaaS Application Usage Report. **Workaround:** To receive a scheduled report email for all other PDF report types:
Workaround: To receive a scheduled report email for all other PDF report types: 1. Select **Monitor** > **PDF Reports** > **Report Groups** and remove all SaaS Application Usage reports from all Report Groups.
2. Select **Monitor** > **PDF Reports** > **Email Scheduler** and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select **Disable** and click **OK**.
Select MonitorPDF ReportsReport Groups and remove all SaaS Application Usage reports from all Report Groups. Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
3. **Commit**.
Select MonitorPDF ReportsEmail Scheduler and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select Disable and click OK.Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report. () Select **Commit** > **Commit and Push**
Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
Commit.() Select CommitCommit and Push
() Select CommitCommit and Push
## PAN-184406 ## PAN-184406
Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash. Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash.
Workaround: Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance. **Workaround:** Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance.
## PAN-183404 ## PAN-183404
web/data/issues/PAN-OS/known/11.1.6.md
+233 -139
View File
@@ -4,54 +4,76 @@ product: PAN-OS
version: 11.1.6 version: 11.1.6
--- ---
## PAN-308564
Packets are dropped on SD-WAN interfaces if they require fragmentation for an interface but have the **Don't Fragment (DF)** bit set. This results in unexpected packet drops. This affects client to server sessions when using SD-WAN for NGFW.
**Workaround:** Allow fragmenting packets with DF bit set (`debug dataplane set ip4-ignore-df yes`).
## PAN-307795 ## PAN-307795
```caveat
This issue affects PAN-OS 11.1.6-h21 through 11.1.6-h24 This issue is now resolved. See PAN-OS 11.1.10-h12 Addressed Issues.
```
On a standalone Panorama, the system incorrectly generates system logs indicating a lost connection to its peer even when High Availability is not configured. You can safely ignore these logs, as they do not affect operations. On a standalone Panorama, the system incorrectly generates system logs indicating a lost connection to its peer even when High Availability is not configured. You can safely ignore these logs, as they do not affect operations.
## PAN-306502 ## PAN-306502
```caveat
This issue is now resolved. See PAN-OS 11.1.6-h23 Addressed Issues.
```
TLS sessions using version 1.2 or earlier may fail when session traffic matches a decryption policy rule with the no-decrypt action under either of the following conditions: TLS sessions using version 1.2 or earlier may fail when session traffic matches a decryption policy rule with the no-decrypt action under either of the following conditions:
If both of these conditions are met, the session is guaranteed to fail. If both of these conditions are met, the session is guaranteed to fail.
If both of these conditions are met, the session is guaranteed to fail. - Both HTTP header insertion (**Objects** > **Security Profiles** > **URL Filtering** > **HTTP Header Insertion**) and SSL/TLS handshake inspection (**Device** > **Setup** > **Session** > **Decryption Settings** > **SSL Decryption Settings**) are enabled.
- **Log Successful SSL Handshake** is not enabled in the decryption policy rule and neither **Block sessions with expired certificates** nor **Block sessions with untrusted issuers** is enabled in the attached decryption profile.
If both of these conditions are met, the session is guaranteed to fail. **Workaround:** Perform one of the following tasks:
Both HTTP header insertion (ObjectsSecurity ProfilesURL FilteringHTTP Header Insertion) and SSL/TLS handshake inspection (DeviceSetupSessionDecryption SettingsSSL Decryption Settings) are enabled. - Enable **Log Successful SSL Handshake** in all no-decrypt decryption policy rules.
- Enable either **Block sessions with expired certificates** or **Block sessions with untrusted issuers** in the decryption profiles attached to the no-decrypt decryption policy rules.
Both HTTP header insertion (ObjectsSecurity ProfilesURL FilteringHTTP Header Insertion) and SSL/TLS handshake inspection (DeviceSetupSessionDecryption SettingsSSL Decryption Settings) are enabled.
Log Successful SSL Handshake is not enabled in the decryption policy rule and neither Block sessions with expired certificates nor Block sessions with untrusted issuers is enabled in the attached decryption profile.
Log Successful SSL Handshake is not enabled in the decryption policy rule and neither Block sessions with expired certificates nor Block sessions with untrusted issuers is enabled in the attached decryption profile.
Workaround: Perform one of the following tasks:
Enable Log Successful SSL Handshake in all no-decrypt decryption policy rules.
Enable Log Successful SSL Handshake in all no-decrypt decryption policy rules.
Enable either Block sessions with expired certificates or Block sessions with untrusted issuers in the decryption profiles attached to the no-decrypt decryption policy rules.
## PAN-305301 ## PAN-305301
```caveat
This issue is now resolved. See PAN-OS 11.1.10-h12 Addressed Issues.
```
The timing of GlobalProtect lifetime expiry or inactivity logout notifications used for GlobalProtect SSL tunnels may cause the pan_task process to stop responding and the dataplane to restart. The timing of GlobalProtect lifetime expiry or inactivity logout notifications used for GlobalProtect SSL tunnels may cause the pan_task process to stop responding and the dataplane to restart.
Workaround: Select Network > GlobalProtect > Gateways > <gateway-config> > Agent > <agent-config> > Connection Settings and change the value of both Notify Before Lifetime Expires (min) and Notify Before Inactivity Logout (min) to 0. **Workaround:** Select **Network > GlobalProtect > Gateways > <gateway-config> > Agent > <agent-config> > Connection Settings** and change the value of both **Notify Before Lifetime Expires (min)** and **Notify Before Inactivity Logout (min)** to 0.
## PAN-304756 ## PAN-304756
```caveat
This issue is now resolved. See PAN-OS 11.1.13-h1 Addressed Issues.
```
After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems. After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems.
## PAN-304576 ## PAN-304576
Traffic interruption may occur when inspection of HTTP/2 traffic is enabled. Traffic interruption may occur when inspection of HTTP/2 traffic is enabled.
Workaround: Disable HTTP/2 server push using the set deviceconfig setting http2 server-push no CLI command. **Workaround:** Disable HTTP/2 server push using the `set deviceconfig setting http2 server-push no` CLI command.
## PAN-303051
```caveat
This issue affects PAN-OS 11.1.6-h10 This issue is now resolved. See PAN-OS 11.1.13 Addressed Issues
```
The reportd process experiences a memory leak because it retains memory that was temporarily used for report generation. Once a task is complete, the process fails to release this memory for reuse, leading to continuous accumulation and eventual memory exhaustion on the Panorama device.
## PAN-298505 ## PAN-298505
```caveat
This issue is now resolved. See PAN-OS 11.1.6-h20 Addressed Issues, PAN-OS 11.1.10-h7 Addressed Issues, and PAN-OS 11.1.12 Addressed Issues.
```
After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing auto-commit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems managed by Panorama, and the vsys ID sequence breaks when unused virtual systems are deleted and the changes are pushed to the firewall. After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing auto-commit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems managed by Panorama, and the vsys ID sequence breaks when unused virtual systems are deleted and the changes are pushed to the firewall.
## PAN-294436 ## PAN-294436
@@ -62,8 +84,20 @@ PA-410, PA-440, PA-450, and PA-460 firewalls
After upgrading to 11.1.6-h6, the Eth1/2, Eth1/3, Eth1/8, and HA interfaces (if configured) fail to display counters and statistics in the CLI and SNMP. After upgrading to 11.1.6-h6, the Eth1/2, Eth1/3, Eth1/8, and HA interfaces (if configured) fail to display counters and statistics in the CLI and SNMP.
## PAN-294179
```caveat
This issue is now resolved. See PAN-OS 11.1.6-h17 Addressed Issues.
```
On the**Panorama Config Audit** page, some commit versions might display incorrect or missing data. Fields such as, **COMMITTED BY**, **COMMIT DATE**, and**OBJECT CHANGES** might not be visible for some commit versions. Sometimes, commit versions can disappear after a refresh and the commit description field might display corrupted characters.
## PAN-293673 ## PAN-293673
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
When the firewall generates a high volume of logs and attempts to export these logs to an FTP server, it may consume excessive memory leading to all PAN-OS processes crashing. When the firewall generates a high volume of logs and attempts to export these logs to an FTP server, it may consume excessive memory leading to all PAN-OS processes crashing.
## PAN-292202 ## PAN-292202
@@ -76,14 +110,26 @@ An active firewall might unexpectedly reboot due to a pan_task crash caused by a
## PAN-290996 ## PAN-290996
```caveat
This issue is now resolved. See PAN-OS 11.1.6-h14 Addressed Issues, PAN-OS 11.1.7-h1 Addressed Issues, and PAN-OS 11.1.10-h1 Addressed Issues
```
When performing an SNMP walk, the Connections Per Second (CPS) counters incorrectly return a value of 0 for each virtual system (VSYS), despite the firewall actively processing connections. When performing an SNMP walk, the Connections Per Second (CPS) counters incorrectly return a value of 0 for each virtual system (VSYS), despite the firewall actively processing connections.
## PAN-290235 ## PAN-290235
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues.
```
The dscd process crashes continuously on MIPS platforms (for example, PA-850 firewalls) due to a runtime error related to an invalid memory address or nil pointer dereference. This occurs when the golang library upgrade in CIE is not compatible with the MIPS platform. The dscd process crashes continuously on MIPS platforms (for example, PA-850 firewalls) due to a runtime error related to an invalid memory address or nil pointer dereference. This occurs when the golang library upgrade in CIE is not compatible with the MIPS platform.
## PAN-290088 ## PAN-290088
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues.
```
When pushing configurations from Panorama to a firewall, a memory leak might occur in the firewall's configd process, particularly when the configurations contain shared policies. Each configuration push causes the configd process to consume additional memory that is not released after the commit completes. When pushing configurations from Panorama to a firewall, a memory leak might occur in the firewall's configd process, particularly when the configurations contain shared policies. Each configuration push causes the configd process to consume additional memory that is not released after the commit completes.
## PAN-289383 ## PAN-289383
@@ -94,21 +140,33 @@ PA-800 series firewalls only
Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation. Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation.
Workaround: Enable auto-negotiation on the connected peer firewall. **Workaround:** Enable auto-negotiation on the connected peer firewall.
## PAN-288097 ## PAN-288097
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
Routed process may stop responding after changing MTU or any link parameters when OSPF and PIM are enabled on the same interface. Routed process may stop responding after changing MTU or any link parameters when OSPF and PIM are enabled on the same interface.
## PAN-287056 ## PAN-287056
```caveat
This issue is now resolved. See PAN-OS 11.1.6-h14 Addressed Issues
```
A BGP export policy rule that matches on a next hop fails to block the advertisement of static routes, and the firewall incorrectly matches the egress interface IP address instead of the original next-hop IP address of the static route, which causes the deny rule to fail. A BGP export policy rule that matches on a next hop fails to block the advertisement of static routes, and the firewall incorrectly matches the egress interface IP address instead of the original next-hop IP address of the static route, which causes the deny rule to fail.
## PAN-286897 ## PAN-286897
```caveat
This issue is now resolved. See PAN-OS 11.1.6-h10 Addressed Issues and PAN-OS 11.1.10 Addressed Issues.
```
The pan_task process might fail when the firewall attempts to forward files to the WildFire public cloud, which can cause the dataplane to experience heartbeat failures. The pan_task process might fail when the firewall attempts to forward files to the WildFire public cloud, which can cause the dataplane to experience heartbeat failures.
Workaround: Disable the firewall WildFire Analysis profile. **Workaround:** Disable the firewall WildFire Analysis profile.
## PAN-286848 ## PAN-286848
@@ -124,43 +182,46 @@ URL-continue and override continue selections will function like a general URL-b
## PAN-286306 ## PAN-286306
When getting transceiver information from ESCC for SFP 25G modules, the transceiver code incorrectly displays Unknown instead of 25GBase-SR. ```caveat
This issue is now resolved. See PAN-OS 11.1.6-h14 Addressed Issues
```
When getting transceiver information from ESCC for SFP 25G modules, the transceiver code incorrectly displays `Unknown` instead of `25GBase-SR`.
## PAN-286255 ## PAN-286255
```caveat
This issue affects PAN-OS 11.1.6-h4 This issue is now resolved. See PAN-OS 11.1.6-h7 Addressed Issues.
```
When a firewall receives an unexpected termination request for certain SSL sessions , NGFW dataplane might experience a slow buffer resource leak. When a firewall receives an unexpected termination request for certain SSL sessions , NGFW dataplane might experience a slow buffer resource leak.
Workaround: Disable accumulation proxy on the NGFW. **Workaround**: Disable accumulation proxy on the NGFW.
## PAN-286231 ## PAN-286231
When performing a partial Commit and Push on Panorama, there is a risk that unintended configuration changes might be pushed to a firewall. ```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
This issue is more likely to occur in the following scenarios:When you run Commit and Push operations as a single action.When you trigger multiple parallel commit-all jobs at the same time.Device groups and templates have different configuration synchronization versions. When performing a partial **Commit and Push** on Panorama, there is a risk that unintended configuration changes might be pushed to a firewall.
When you run Commit and Push operations as a single action. This issue is more likely to occur in the following scenarios:
When you run Commit and Push operations as a single action. - When you run **Commit and Push** operations as a single action.
- When you trigger multiple parallel commit-all jobs at the same time.
- Device groups and templates have different configuration synchronization versions.
When you trigger multiple parallel commit-all jobs at the same time. **Workaround:** Perform one of the following steps:
When you trigger multiple parallel commit-all jobs at the same time. - Perform commit and push as two separate, sequential steps.
- Perform a full push instead of selective push.
Device groups and templates have different configuration synchronization versions.
Device groups and templates have different configuration synchronization versions.
Workaround: Perform one of the following steps:
Perform commit and push as two separate, sequential steps.
Perform a full push instead of selective push.
## PAN-285894 ## PAN-285894
If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots. If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots.
Workaround: Disable the Preserve Pre-NAT feature using the set deviceconfig setting preserve-prenat-feature no CLI command. **Workaround:** Disable the Preserve Pre-NAT feature using the `set deviceconfig setting preserve-prenat-feature no` CLI command.
## PAN-285590 ## PAN-285590
@@ -174,20 +235,30 @@ PA-3400 Series firewalls only
The firewall might unexpectedly reboot and enter maintenance mode due to a ctd-agent out-of-memory (OOM) condition when undergoing advanced services load testing with a high volume of IoT EAL log forwarding. The firewall might unexpectedly reboot and enter maintenance mode due to a ctd-agent out-of-memory (OOM) condition when undergoing advanced services load testing with a high volume of IoT EAL log forwarding.
Workaround: Limit the number of EAL logs generated by the firewall using the following CLI command: debug iot eal key-value EAL_PENDING_BYTES=1000. **Workaround:** Limit the number of EAL logs generated by the firewall using the following CLI command: `debug iot eal key-value EAL_PENDING_BYTES=1000`.
## PAN-283429 ## PAN-283429
When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted. When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted.
Workaround: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates. **Workaround**: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates.
## PAN-282854 ## PAN-282854
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
The Elasticsearch cluster fails to start after deploying dedicated log collectors in a multi-collector environment. The Elasticsearch cluster fails to start after deploying dedicated log collectors in a multi-collector environment.
**Workaround:** Restart all the involved log collectors.
## PAN-282236 ## PAN-282236
```caveat
(PAN-OS 11.1.6-h3 only) This issue is now resolved. See PAN-OS 11.1.6-h4 Addressed Issues.
```
The firewall doesn't reassemble IPv6 packets correctly after they are fragmented. IPv6 SSL sessions may not be established if the client hello arrives in multiple segments. The firewall doesn't reassemble IPv6 packets correctly after they are fragmented. IPv6 SSL sessions may not be established if the client hello arrives in multiple segments.
## PAN-281885 ## PAN-281885
@@ -196,54 +267,62 @@ When exporting and importing the CSV file, the hash values of pre-shared key (PS
## PAN-280532 ## PAN-280532
```caveat
This issue is now resolved. See PAN-OS 11.1.10 Addressed Issues.
```
When you use a single syslog server over TCP for log forwarding, and the connectivity to the syslog server breaks, syslog forwarding does not resume even after the connectivity to the server restores. When you use a single syslog server over TCP for log forwarding, and the connectivity to the syslog server breaks, syslog forwarding does not resume even after the connectivity to the server restores.
Workaround: Performing one of the following tasks: **Workaround:** Performing one of the following tasks:
Reboot the firewall. - Reboot the firewall.
- Temporarily, configure syslog to use UDP, commit the configuration, revert to TCP, and then commit.
Temporarily, configure syslog to use UDP, commit the configuration, revert to TCP, and then commit.
## PAN-280471 ## PAN-280471
When applying filters or searching for logs in the PanoramaMonitorLogssection, you might experience slow performance. When applying filters or searching for logs in the **Panorama** > **Monitor** > **Logs**section, you might experience slow performance.
## PAN-279901 ## PAN-279901
When decryption is enabled, segmented Client Hello packets can cause website access issues and memory leaks under the following conditions: When decryption is enabled, segmented Client Hello packets can cause website access issues and memory leaks under the following conditions:
The segmented Client Hello packets arrive out-of-order - The segmented Client Hello packets arrive out-of-order
- The segmented Client Hello packets arrive out-of-order and can be reassembled into a complete Client Hello when the first contiguous segment is formed by NGFW
- The first segment of the Client Hello packets is less than 5 bytes
- A decryption policy rule excludes this traffic from decryption and a Security policy rule (URL filtering) denies this session
The segmented Client Hello packets arrive out-of-order To enable this fix, run the CLI command `bug dataplane set ssl-decrypt accumulate-client-hello disjoined yes`
The segmented Client Hello packets arrive out-of-order and can be reassembled into a complete Client Hello when the first contiguous segment is formed by NGFW
The segmented Client Hello packets arrive out-of-order and can be reassembled into a complete Client Hello when the first contiguous segment is formed by NGFW
The first segment of the Client Hello packets is less than 5 bytes
The first segment of the Client Hello packets is less than 5 bytes
A decryption policy rule excludes this traffic from decryption and a Security policy rule (URL filtering) denies this session
A decryption policy rule excludes this traffic from decryption and a Security policy rule (URL filtering) denies this session
To enable this fix, run the CLI command bug dataplane set ssl-decrypt accumulate-client-hello disjoined yes
## PAN-279746 ## PAN-279746
```caveat
(PAN-OS 11.1.6-h3 only) This issue is now resolved. See PAN-OS 11.1.6-h4 Addressed Issues.
```
An SSL/TLS Client Hello may not be transmitted out of the firewall if the Client Hello arrives in multiple TCP segments and the traffic is not subject to SSL decryption (for example, SMTP over SSL). An SSL/TLS Client Hello may not be transmitted out of the firewall if the Client Hello arrives in multiple TCP segments and the traffic is not subject to SSL decryption (for example, SMTP over SSL).
## PAN-279621 ## PAN-279621
```caveat
This issue is now resolved. See PAN-OS 11.1.9 Addressed Issues.
```
Early aging and removal of firewall session while they are still active can lead to intermittent instabilities and crashes for proxy traffic, the Content and Threat detection engine, and any data-path processing. Early aging and removal of firewall session while they are still active can lead to intermittent instabilities and crashes for proxy traffic, the Content and Threat detection engine, and any data-path processing.
## PAN-279604 ## PAN-279604
```caveat
(PAN-OS 11.1.6-h1 only)
```
The scheduled SaaS application usage reports are incorrectly generated and only the login page appears instead of the intended report content. The scheduled SaaS application usage reports are incorrectly generated and only the login page appears instead of the intended report content.
## PAN-279415 ## PAN-279415
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
Service routes configured for a data plane interface might incorrectly route traffic through the management plane interface instead. This issue impacts Syslog and CRL status traffic when the service route lacks a specific destination custom service route. Service routes configured for a data plane interface might incorrectly route traffic through the management plane interface instead. This issue impacts Syslog and CRL status traffic when the service route lacks a specific destination custom service route.
## PAN-278322 ## PAN-278322
@@ -252,33 +331,53 @@ VM-Series firewalls deployed behind an AWS GWLB might display an incorrect or em
## PAN-278296 ## PAN-278296
```caveat
(This issue affects PAN-OS 11.1.6-h6.) This issue is now resolved. See PAN-OS 11.1.6-h6 Addressed Issues.
```
The system MAC address of the aggregate interface is the same on both the active and the passive devices, causing some packets to be sent incorrectly to the passive device. This is causing the AE interface on the active firewall to not come up. The system MAC address of the aggregate interface is the same on both the active and the passive devices, causing some packets to be sent incorrectly to the passive device. This is causing the AE interface on the active firewall to not come up.
## PAN-277417 ## PAN-277417
```caveat
Thibx
```
Memory leak issues can occur during the parsing of server certificates used for SSL Inbound Inspection, preventing the firewall from completing inspection. Memory leak issues can occur during the parsing of server certificates used for SSL Inbound Inspection, preventing the firewall from completing inspection.
## PAN-277090 ## PAN-277090
When you enable Advanced Routing and configure a BGP Authentication profile, if you configure a Secret that includes any special characters apart from these seven special characters !@#%^_-, an error message displays, indicating that The value in this field is invalid. When you enable Advanced Routing and configure a BGP Authentication profile, if you configure a Secret that includes any special characters apart from these seven special characters !@#%^_-, an error message displays, indicating that `The value in this field is invalid.`
Workaround: Don't include any special character apart from the !@#%^_- characters in the Secret for a BGP Authentication profile. **Workaround:** Don't include any special character apart from the !@#%^_- characters in the Secret for a BGP Authentication profile.
## PAN-277034 ## PAN-277034
```caveat
This issue is now resolved. See PAN-OS 11.1.10-h5 Addressed Issuesand PAN-OS 11.1.6-h19 Addressed Issues
```
WildFire reports might not fully display or be downloadable because some static resources fail to load. WildFire reports might not fully display or be downloadable because some static resources fail to load.
## PAN-276920 ## PAN-276920
URL filtering response pages may load slowly or fail to display when users request websites that are blocked in the URL Filtering profile (site access for the corresponding URL category is block, continue, or override) attached to the matching Security policy rule. This occurs on an intermittent basis. URL filtering response pages may load slowly or fail to display when users request websites that are blocked in the URL Filtering profile (site access for the corresponding URL category is **block**, **continue**, or **override**) attached to the matching Security policy rule. This occurs on an intermittent basis.
## PAN-275905 ## PAN-275905
```caveat
(PAN-OS 11.1.6-h3 only)
```
A high volume of incoming logs to a Collector Group can significantly increase CPU usage on the Elasticsearch and Management Server, potentially causing process instability or crashes. A high volume of incoming logs to a Collector Group can significantly increase CPU usage on the Elasticsearch and Management Server, potentially causing process instability or crashes.
## PAN-275601 ## PAN-275601
When Panorama is not internet-connected and you try to upload images to the managed firewalls by using the Validate option, the upload fails with the following error: Failed to create multi-upload job. No valid software deploy targets found. ```caveat
This issue is now resolved. See PAN-OS 11.1.10 Addressed Issues
```
When Panorama is not internet-connected and you try to upload images to the managed firewalls by using the **Validate** option, the upload fails with the following error: `Failed to create multi-upload job. No valid software deploy targets found.`
## PAN-275047 ## PAN-275047
@@ -294,25 +393,47 @@ VM-Series firewalls deployed behind an AWS GWLB might crash and reboot unexpecte
## PAN-272085 ## PAN-272085
```caveat
(This issue affects PAN-OS 11.1.6-h3.)
```
When DoH is enabled for DNS Security, multiple DoH transactions in a single HTTP/1 connection might unexpectedly cause the firewall to crash and reboot. When DoH is enabled for DNS Security, multiple DoH transactions in a single HTTP/1 connection might unexpectedly cause the firewall to crash and reboot.
Workaround: Manually disable DoH support for DNS Security using the set deviceconfig setting dns-over-https enable no CLI command. Alternatively, you can remove the DNS Security configuration used to handle DoH traffic. **Workaround:** Manually disable DoH support for DNS Security using the `set deviceconfig setting dns-over-https enable no` CLI command. Alternatively, you can remove the DNS Security configuration used to handle DoH traffic.
## PAN-269193 ## PAN-269193
```caveat
This issue is now resolved. See PAN-OS 11.1.8 Addressed Issues.
```
When multiple application are configured for GlobalProtect Clientless VPN, users are directed to the first application instead of portal page with a list of application. When multiple application are configured for GlobalProtect Clientless VPN, users are directed to the first application instead of portal page with a list of application.
## PAN-268705
```caveat
This issue is now resolved. See PAN-OS 11.1.6-h10 Addressed Issues.
```
The firewall intermittently fails to process FTP traffic.
**Workaround**: Configure an application override policy rule for FTP applications.
## PAN-262556 ## PAN-262556
The ElasticSearch cluster health status might continue to remain yellow for an extended period after upgrading to PAN-OS 11.1 The ElasticSearch cluster health status might continue to remain yellow for an extended period after upgrading to PAN-OS 11.1
## PAN-261429 ## PAN-261429
The command show auth radius-require-msg-authentic might return no output. ```caveat
This issue is now resolved. See PAN-OS 11.1.6-h10 Addressed Issues and PAN-OS 11.1.8 Addressed Issues.
```
The command `show auth radius-require-msg-authentic` might return no output.
## PAN-260851 ## PAN-260851
From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (ObjectsApplications) tag. From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (**Objects** > **Applications**) tag.
## PAN-254240 ## PAN-254240
@@ -364,17 +485,22 @@ Cloud application information is missing from traffic logs on NGFW cluster nodes
## PAN-237106 ## PAN-237106
```caveat
This issue is now resolved. See PAN-OS 11.1.8 Addressed Issues
```
LSVPN satellite certificates may be generated with serial numbers exceeding 40 hexadecimal characters. This causes certificate revocation and deletion operations to fail with the following error messages: LSVPN satellite certificates may be generated with serial numbers exceeding 40 hexadecimal characters. This causes certificate revocation and deletion operations to fail with the following error messages:
db-serialno can be at most 40 characters - `db-serialno can be at most 40 characters`
- `db-serialno is invalid`
db-serialno is invalid **Workaround:**
To resolve this issue, use the following CLI commands with the LSVPN satellite serial number to manually delete or revoke the affected certificates: To resolve this issue, use the following CLI commands with the LSVPN satellite serial number to manually delete or revoke the affected certificates:
Delete certificate information:delete sslmgr-store certificate-info portal name <name> serialno <satellite_serial> **Delete certificate information**:`delete sslmgr-store certificate-info portal name <name> serialno <satellite_serial>`
Revoke satellite certificates:delete sslmgr-store satellite-info-revoke-certificate portal <name> serialno <list_of_satellite_serials> **Revoke satellite certificates**:`delete sslmgr-store satellite-info-revoke-certificate portal <name> serialno <list_of_satellite_serials>`
## PAN-234015 ## PAN-234015
@@ -386,7 +512,7 @@ The autocommit time of the VM-Series firewall running PAN-OS 11.1.0 might take l
## PAN-220180 ## PAN-220180
Configured botnet reports (MonitorBotnet) are not generated. Configured botnet reports (**Monitor** > **Botnet**) are not generated.
## PAN-207733 ## PAN-207733
@@ -398,21 +524,13 @@ When a DHCPv6 client is configured on HA Active/Passive firewalls, the Passive f
## PAN-207442 ## PAN-207442
For M-700 appliances in an active/passive high availability (PanoramaHigh Availability) configuration, the active-primary HA peer configuration sync to the secondary-passive HA peer may fail. When the config sync fails, the job Results is Successful (Tasks), however the sync status on the Dashboard displays as Out of Sync for both HA peers. For M-700 appliances in an active/passive high availability (**Panorama** > **High Availability**) configuration, the `active-primary` HA peer configuration sync to the `secondary-passive` HA peer may fail. When the config sync fails, the job Results is `Successful` (**Tasks**), however the sync status on the **Dashboard** displays as `Out of Sync` for both HA peers.
Workaround: Perform a local commit on the active-primary HA peer and then synchronize the HA configuration. **Workaround**: Perform a local commit on the `active-primary` HA peer and then synchronize the HA configuration.
Log in to the Panorama web interface of the active-primary HA peer. 1. [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface) of the `active-primary` HA peer.
2. Select **Commit** and **Commit to Panorama**.
Log in to the Panorama web interface of the active-primary HA peer. 3. In the `active-primary` HA peer **Dashboard**, click **Sync to Peer** in the High Availability widget.
Select Commit and Commit to Panorama.
Select Commit and Commit to Panorama.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
## PAN-207040 ## PAN-207040
@@ -420,41 +538,22 @@ If you disable Advanced Routing, remove logical routers, and downgrade from PAN-
## PAN-206913 ## PAN-206913
When a DHCPv6 client is configured on HA Active/Passive firewalls, releasing the IPv6 address from the client (using Release in the UI or using the request dhcp client ipv6 release all CLI command) releases the IPv6 address from the Active firewall, but not the Passive firewall. When a DHCPv6 client is configured on HA Active/Passive firewalls, releasing the IPv6 address from the client (using Release in the UI or using the `request dhcp client ipv6 release all` CLI command) releases the IPv6 address from the Active firewall, but not the Passive firewall.
## PAN-206909 ## PAN-206909
The Dedicated Log Collector is unable to reconnect to the Panorama management server if the configd process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection Status (PanoramaManaged Collector) displaying connected and the managed colletor Health status displaying as healthy. The Dedicated Log Collector is unable to reconnect to the Panorama management server if the `configd` process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection `Status` (**Panorama** > **Managed Collector**) displaying `connected` and the managed colletor `Health` status displaying as healthy.
This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted. This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted.
Workaround: Restart the mgmtsrvr process on the Dedicated Log Collector. **Workaround:** Restart the `mgmtsrvr` process on the Dedicated Log Collector.
Log in to the Dedicated Log Collector CLI. 1. [Log in to the Dedicated Log Collector CLI](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli).
2. Confirm the Dedicated Log Collector is disconnected from Panorama.
Log in to the Dedicated Log Collector CLI. `admin>``show panorama-status`
Verify the `Connected` status is `no`.
Confirm the Dedicated Log Collector is disconnected from Panorama.admin> show panorama-status Verify the Connected status is no. 3. Restart the `mgmtsrvr` process.
`admin>``debug software restart process management-server`
Confirm the Dedicated Log Collector is disconnected from Panorama.
admin> show panorama-status Verify the Connected status is no.
admin> show panorama-status
admin> show panorama-status
Verify the Connected status is no.
Restart the mgmtsrvr process.admin> debug software restart process management-server
Restart the mgmtsrvr process.
admin> debug software restart process management-server
admin> debug software restart process management-server
admin> debug software restart process management-server
## PAN-197588 ## PAN-197588
@@ -466,11 +565,11 @@ The PAN-OS ACC (Application Command Center) does not display a widget detailing
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, the power over Ethernet (PoE) ports do not display a Tag value. In **Network** > **Interface** > **Ethernet**, the power over Ethernet (PoE) ports do not display a **Tag** value.
## PAN-196758 ## PAN-196758
On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you Preview Changes (CommitPush to DevicesEdit Selections or CommitCommit and PushEdit Selections). On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you **Preview Changes** (**Commit** > **Push to Devices** > **Edit Selections** or **Commit** > **Commit and Push** > **Edit Selections**).
## PAN-195968 ## PAN-195968
@@ -486,23 +585,23 @@ When using the CLI to configure power over Ethernet (PoE) on a non-PoE port, the
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, hovering the mouse over a power over Ethernet (PoE) Link State icon does not display link speed and link duplex details. In **Network** > **Interface** > **Ethernet**, hovering the mouse over a power over Ethernet (PoE) **Link State** icon does not display link speed and link duplex details.
## PAN-187685 ## PAN-187685
On the Panorama management server, the Template Status displays no synchronization status (PanoramaManaged DevicesSummary) after a bootstrapped firewall is successfully added to Panorama. On the Panorama management server, the Template Status displays no synchronization status (**Panorama** > **Managed Devices** > **Summary**) after a bootstrapped firewall is successfully added to Panorama.
Workaround: After the bootstrapped firewall is successfully added to Panorama, log in to the Panorama web interface and select CommitPush to Devices. **Workaround:** After the bootstrapped firewall is successfully added to Panorama, [log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) and select **Commit** > **Push to Devices**.
## PAN-187407 ## PAN-187407
The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to Hold client request for category lookup and the action set to Reset-Both and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed. The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to **Hold client request for category lookup**and the action set to **Reset-Both** and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed.
## PAN-186283 ## PAN-186283
Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS. Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS.
Workaround: Use CommitPush to Devices to synchronize the templates. **Workaround**: Use **Commit** > **Push to Devices** to synchronize the templates.
## PAN-184708 ## PAN-184708
@@ -510,29 +609,24 @@ Workaround: Use CommitPush to Devices to synchronize the templates.
Panorama managed firewalls Panorama managed firewalls
``` ```
Scheduled report emails (MonitorPDF ReportsEmail Scheduler) are not emailed if: Scheduled report emails (**Monitor** > **PDF Reports** > **Email Scheduler**) are not emailed if:
A scheduled report email contains a Report Group (MonitorPDF ReportsReport Group) which includes a SaaS Application Usage report. - A scheduled report email contains a Report Group (**Monitor** > **PDF Reports** > **Report Group**) which includes a SaaS Application Usage report.
- A scheduled report contains only a SaaS Application Usage Report.
A scheduled report contains only a SaaS Application Usage Report. **Workaround:** To receive a scheduled report email for all other PDF report types:
Workaround: To receive a scheduled report email for all other PDF report types: 1. Select **Monitor** > **PDF Reports** > **Report Groups** and remove all SaaS Application Usage reports from all Report Groups.
2. Select **Monitor** > **PDF Reports** > **Email Scheduler** and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select **Disable** and click **OK**.
Select MonitorPDF ReportsReport Groups and remove all SaaS Application Usage reports from all Report Groups. Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
3. **Commit**.
Select MonitorPDF ReportsEmail Scheduler and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select Disable and click OK.Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report. () Select **Commit** > **Commit and Push**
Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
Commit.() Select CommitCommit and Push
() Select CommitCommit and Push
## PAN-184406 ## PAN-184406
Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash. Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash.
Workaround: Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance. **Workaround:** Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance.
## PAN-183404 ## PAN-183404
@@ -544,4 +638,4 @@ If you use multiple log forwarding cards (LFCs) on the PA-7000 series, all of th
## PAN-164885 ## PAN-164885
On the Panorama management server, pushes to managed firewalls (CommitPush to Devices or Commit and Push) may fail when an EDL (ObjectsExternal Dynamic Lists) is configured to Check for updates every 5 minutes due to the commit and EDL fetch processes overlapping. This is more likely to occur when multiple EDLs are configured to check for updates every 5 minutes. On the Panorama management server, pushes to managed firewalls (**Commit** > **Push to Devices** or **Commit and Push**) may fail when an EDL (**Objects** > **External Dynamic Lists**) is configured to **Check for updates** every 5 minutes due to the commit and EDL fetch processes overlapping. This is more likely to occur when multiple EDLs are configured to check for updates every 5 minutes.
web/data/issues/PAN-OS/known/11.1.7.md
+186 -118
View File
@@ -4,23 +4,57 @@ product: PAN-OS
version: 11.1.7 version: 11.1.7
--- ---
## PAN-308564
Packets are dropped on SD-WAN interfaces if they require fragmentation for an interface but have the **Don't Fragment (DF)** bit set. This results in unexpected packet drops. This affects client to server sessions when using SD-WAN for NGFW.
**Workaround:** Allow fragmenting packets with DF bit set (`debug dataplane set ip4-ignore-df yes`).
## PAN-304756 ## PAN-304756
```caveat
This issue is now resolved. See PAN-OS 11.1.13-h1 Addressed Issues.
```
After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems. After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems.
## PAN-304576 ## PAN-304576
Traffic interruption may occur when inspection of HTTP/2 traffic is enabled. Traffic interruption may occur when inspection of HTTP/2 traffic is enabled.
Workaround: Disable HTTP/2 server push using the set deviceconfig setting http2 server-push no CLI command. **Workaround:** Disable HTTP/2 server push using the `set deviceconfig setting http2 server-push no` CLI command.
## PAN-303051
```caveat
This issue is now resolved. See PAN-OS 11.1.13 Addressed Issues
```
The reportd process experiences a memory leak because it retains memory that was temporarily used for report generation. Once a task is complete, the process fails to release this memory for reuse, leading to continuous accumulation and eventual memory exhaustion on the Panorama device.
## PAN-298505 ## PAN-298505
```caveat
This issue is now resolved. See PAN-OS 11.1.10-h7 Addressed Issues and PAN-OS 11.1.12 Addressed Issues
```
After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing auto-commit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems managed by Panorama, and the vsys ID sequence breaks when unused virtual systems are deleted and the changes are pushed to the firewall. After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing auto-commit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems managed by Panorama, and the vsys ID sequence breaks when unused virtual systems are deleted and the changes are pushed to the firewall.
## PAN-294179 ## PAN-294179
On the Panorama Config Audit page, some commit versions might display incorrect or missing data. Fields such as, COMMITTED BY , COMMIT DATE , and OBJECT CHANGES might not be visible for some commit versions. Sometimes, commit versions can disappear after a refresh and the commit description field might display corrupted characters. ```caveat
This issue is now resolved. See PAN-OS 11.1.10-h4 Addressed Issues.
```
On the**Panorama Config Audit** page, some commit versions might display incorrect or missing data. Fields such as, **COMMITTED BY**, **COMMIT DATE**, and**OBJECT CHANGES** might not be visible for some commit versions. Sometimes, commit versions can disappear after a refresh and the commit description field might display corrupted characters.
## PAN-293673
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
When the firewall generates a high volume of logs and attempts to export these logs to an FTP server, it may consume excessive memory leading to all PAN-OS processes crashing.
## PAN-292202 ## PAN-292202
@@ -32,14 +66,26 @@ An active firewall might unexpectedly reboot due to a pan_task crash caused by a
## PAN-290996 ## PAN-290996
```caveat
This issue is now resolved. See PAN-OS 11.1.7-h1 Addressed Issues and PAN-OS 11.1.10-h1 Addressed Issues
```
When performing an SNMP walk, the Connections Per Second (CPS) counters incorrectly return a value of 0 for each virtual system (VSYS), despite the firewall actively processing connections. When performing an SNMP walk, the Connections Per Second (CPS) counters incorrectly return a value of 0 for each virtual system (VSYS), despite the firewall actively processing connections.
## PAN-290235 ## PAN-290235
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues.
```
The dscd process crashes continuously on MIPS platforms (for example, PA-850 firewalls) due to a runtime error related to an invalid memory address or nil pointer dereference. This occurs when the golang library upgrade in CIE is not compatible with the MIPS platform. The dscd process crashes continuously on MIPS platforms (for example, PA-850 firewalls) due to a runtime error related to an invalid memory address or nil pointer dereference. This occurs when the golang library upgrade in CIE is not compatible with the MIPS platform.
## PAN-290088 ## PAN-290088
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
When pushing configurations from Panorama to a firewall, a memory leak might occur in the firewall's configd process, particularly when the configurations contain shared policies. Each configuration push causes the configd process to consume additional memory that is not released after the commit completes. When pushing configurations from Panorama to a firewall, a memory leak might occur in the firewall's configd process, particularly when the configurations contain shared policies. Each configuration push causes the configd process to consume additional memory that is not released after the commit completes.
## PAN-289383 ## PAN-289383
@@ -50,21 +96,33 @@ PA-800 series firewalls only
Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation. Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation.
Workaround: Enable auto-negotiation on the connected peer firewall. **Workaround:** Enable auto-negotiation on the connected peer firewall.
## PAN-288097 ## PAN-288097
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
Routed process may stop responding after changing MTU or any link parameters when OSPF and PIM are enabled on the same interface. Routed process may stop responding after changing MTU or any link parameters when OSPF and PIM are enabled on the same interface.
## PAN-287056 ## PAN-287056
```caveat
This issue is now resolved. See PAN-OS 11.1.10-h1 Addressed Issues
```
A BGP export policy rule that matches on a next hop fails to block the advertisement of static routes, and the firewall incorrectly matches the egress interface IP address instead of the original next-hop IP address of the static route, which causes the deny rule to fail. A BGP export policy rule that matches on a next hop fails to block the advertisement of static routes, and the firewall incorrectly matches the egress interface IP address instead of the original next-hop IP address of the static route, which causes the deny rule to fail.
## PAN-286897 ## PAN-286897
```caveat
This issue is now resolved. See PAN-OS 11.1.10 Addressed Issues.
```
The pan_task process might fail when the firewall attempts to forward files to the WildFire public cloud, which can cause the dataplane to experience heartbeat failures. The pan_task process might fail when the firewall attempts to forward files to the WildFire public cloud, which can cause the dataplane to experience heartbeat failures.
Workaround: Disable the firewall WildFire Analysis profile. **Workaround:** Disable the firewall WildFire Analysis profile.
## PAN-286848 ## PAN-286848
@@ -80,39 +138,38 @@ URL-continue and override continue selections will function like a general URL-b
## PAN-286255 ## PAN-286255
```caveat
This issue affects PAN-OS 11.1.7-h2 This issue is now resolved. See PAN-OS 11.1.9 Addressed Issues.
```
When a firewall receives an unexpected termination request for certain SSL sessions , NGFW dataplane might experience a slow buffer resource leak. When a firewall receives an unexpected termination request for certain SSL sessions , NGFW dataplane might experience a slow buffer resource leak.
Workaround: Disable accumulation proxy on the NGFW. **Workaround**: Disable accumulation proxy on the NGFW.
## PAN-286231 ## PAN-286231
When performing a partial Commit and Push on Panorama, there is a risk that unintended configuration changes might be pushed to a firewall. ```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
This issue is more likely to occur in the following scenarios:When you run Commit and Push operations as a single action.When you trigger multiple parallel commit-all jobs at the same time.Device groups and templates have different configuration synchronization versions. When performing a partial **Commit and Push** on Panorama, there is a risk that unintended configuration changes might be pushed to a firewall.
When you run Commit and Push operations as a single action. This issue is more likely to occur in the following scenarios:
When you run Commit and Push operations as a single action. - When you run **Commit and Push** operations as a single action.
- When you trigger multiple parallel commit-all jobs at the same time.
- Device groups and templates have different configuration synchronization versions.
When you trigger multiple parallel commit-all jobs at the same time. **Workaround:** Perform one of the following steps:
When you trigger multiple parallel commit-all jobs at the same time. - Perform commit and push as two separate, sequential steps.
- Perform a full push instead of selective push.
Device groups and templates have different configuration synchronization versions.
Device groups and templates have different configuration synchronization versions.
Workaround: Perform one of the following steps:
Perform commit and push as two separate, sequential steps.
Perform a full push instead of selective push.
## PAN-285894 ## PAN-285894
If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots. If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots.
Workaround: Disable the Preserve Pre-NAT feature using the set deviceconfig setting preserve-prenat-feature no CLI command. **Workaround:** Disable the Preserve Pre-NAT feature using the `set deviceconfig setting preserve-prenat-feature no` CLI command.
## PAN-283467 ## PAN-283467
@@ -122,13 +179,13 @@ PA-3400 Series firewalls only
The firewall might unexpectedly reboot and enter maintenance mode due to a ctd-agent out-of-memory (OOM) condition when undergoing advanced services load testing with a high volume of IoT EAL log forwarding. The firewall might unexpectedly reboot and enter maintenance mode due to a ctd-agent out-of-memory (OOM) condition when undergoing advanced services load testing with a high volume of IoT EAL log forwarding.
Workaround: Limit the number of EAL logs generated by the firewall using the following CLI command: debug iot eal key-value EAL_PENDING_BYTES=1000. **Workaround:** Limit the number of EAL logs generated by the firewall using the following CLI command: `debug iot eal key-value EAL_PENDING_BYTES=1000`.
## PAN-283429 ## PAN-283429
When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted. When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted.
Workaround: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates. **Workaround**: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates.
## PAN-281885 ## PAN-281885
@@ -136,46 +193,50 @@ When exporting and importing the CSV file, the hash values of pre-shared key (PS
## PAN-280532 ## PAN-280532
```caveat
This issue is now resolved. See PAN-OS 11.1.10 Addressed Issues.
```
When you use a single syslog server over TCP for log forwarding, and the connectivity to the syslog server breaks, syslog forwarding does not resume even after the connectivity to the server restores. When you use a single syslog server over TCP for log forwarding, and the connectivity to the syslog server breaks, syslog forwarding does not resume even after the connectivity to the server restores.
Workaround: Performing one of the following tasks: **Workaround:** Performing one of the following tasks:
Reboot the firewall. - Reboot the firewall.
- Temporarily, configure syslog to use UDP, commit the configuration, revert to TCP, and then commit.
Temporarily, configure syslog to use UDP, commit the configuration, revert to TCP, and then commit.
## PAN-279901 ## PAN-279901
When decryption is enabled, segmented Client Hello packets can cause website access issues and memory leaks under the following conditions: When decryption is enabled, segmented Client Hello packets can cause website access issues and memory leaks under the following conditions:
The segmented Client Hello packets arrive out-of-order - The segmented Client Hello packets arrive out-of-order
- The segmented Client Hello packets arrive out-of-order and can be reassembled into a complete Client Hello when the first contiguous segment is formed by NGFW
- The first segment of the Client Hello packets is less than 5 bytes
- A decryption policy rule excludes this traffic from decryption and a Security policy rule (URL filtering) denies this session
The segmented Client Hello packets arrive out-of-order To enable this fix, run the CLI command `bug dataplane set ssl-decrypt accumulate-client-hello disjoined yes`
The segmented Client Hello packets arrive out-of-order and can be reassembled into a complete Client Hello when the first contiguous segment is formed by NGFW
The segmented Client Hello packets arrive out-of-order and can be reassembled into a complete Client Hello when the first contiguous segment is formed by NGFW
The first segment of the Client Hello packets is less than 5 bytes
The first segment of the Client Hello packets is less than 5 bytes
A decryption policy rule excludes this traffic from decryption and a Security policy rule (URL filtering) denies this session
A decryption policy rule excludes this traffic from decryption and a Security policy rule (URL filtering) denies this session
To enable this fix, run the CLI command bug dataplane set ssl-decrypt accumulate-client-hello disjoined yes
## PAN-279746 ## PAN-279746
```caveat
This issue is now resolved. See PAN-OS 11.1.8 Addressed Issues.
```
An SSL/TLS Client Hello may not be transmitted out of the firewall if the Client Hello arrives in multiple TCP segments and the traffic is not subject to SSL decryption (for example, SMTP over SSL). An SSL/TLS Client Hello may not be transmitted out of the firewall if the Client Hello arrives in multiple TCP segments and the traffic is not subject to SSL decryption (for example, SMTP over SSL).
## PAN-279621 ## PAN-279621
```caveat
This issue is now resolved. See PAN-OS 11.1.9 Addressed Issues.
```
Early aging and removal of firewall session while they are still active can lead to intermittent instabilities and crashes for proxy traffic, the Content and Threat detection engine, and any data-path processing. Early aging and removal of firewall session while they are still active can lead to intermittent instabilities and crashes for proxy traffic, the Content and Threat detection engine, and any data-path processing.
## PAN-279415 ## PAN-279415
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
Service routes configured for a data plane interface might incorrectly route traffic through the management plane interface instead. This issue impacts Syslog and CRL status traffic when the service route lacks a specific destination custom service route. Service routes configured for a data plane interface might incorrectly route traffic through the management plane interface instead. This issue impacts Syslog and CRL status traffic when the service route lacks a specific destination custom service route.
## PAN-278296 ## PAN-278296
@@ -184,19 +245,31 @@ The system MAC address of the aggregate interface is the same on both the active
## PAN-277417 ## PAN-277417
```caveat
This issue is now resolved. See PAN-OS 11.1.9 Addressed Issues.
```
Memory leak issues can occur during the parsing of server certificates used for SSL Inbound Inspection, preventing the firewall from completing inspection. Memory leak issues can occur during the parsing of server certificates used for SSL Inbound Inspection, preventing the firewall from completing inspection.
## PAN-277034 ## PAN-277034
```caveat
This issue is now resolved. See PAN-OS 11.1.10-h5 Addressed Issues
```
WildFire reports might not fully display or be downloadable because some static resources fail to load. WildFire reports might not fully display or be downloadable because some static resources fail to load.
## PAN-276920 ## PAN-276920
URL filtering response pages may load slowly or fail to display when users request websites that are blocked in the URL Filtering profile (site access for the corresponding URL category is block, continue, or override) attached to the matching Security policy rule. This occurs on an intermittent basis. URL filtering response pages may load slowly or fail to display when users request websites that are blocked in the URL Filtering profile (site access for the corresponding URL category is **block**, **continue**, or **override**) attached to the matching Security policy rule. This occurs on an intermittent basis.
## PAN-275601 ## PAN-275601
When Panorama is not internet-connected and you try to upload images to the managed firewalls by using the Validate option, the upload fails with the following error: Failed to create multi-upload job. No valid software deploy targets found. ```caveat
This issue is now resolved. See PAN-OS 11.1.10 Addressed Issues
```
When Panorama is not internet-connected and you try to upload images to the managed firewalls by using the **Validate** option, the upload fails with the following error: `Failed to create multi-upload job. No valid software deploy targets found.`
## PAN-275047 ## PAN-275047
@@ -208,25 +281,47 @@ After an upgrade, the firewall is unable to send logs to the Strata Logging Serv
## PAN-272085 ## PAN-272085
```caveat
This issue is now resolved. See PAN-OS 11.1.8 Addressed Issues.
```
When DoH is enabled for DNS Security, multiple DoH transactions in a single HTTP/1 connection might unexpectedly cause the firewall to crash and reboot. When DoH is enabled for DNS Security, multiple DoH transactions in a single HTTP/1 connection might unexpectedly cause the firewall to crash and reboot.
Workaround: Manually disable DoH support for DNS Security using the following CLI command: set deviceconfig setting dns-over-https enable no. Alternatively, you can remove the DNS Security configuration used to handle DoH traffic. **Workaround:** Manually disable DoH support for DNS Security using the following CLI command: `set deviceconfig setting dns-over-https enable no`. Alternatively, you can remove the DNS Security configuration used to handle DoH traffic.
## PAN-269193 ## PAN-269193
```caveat
This issue is now resolved. See PAN-OS 11.1.8 Addressed Issues.
```
When multiple application are configured for GlobalProtect Clientless VPN, users are directed to the first application instead of portal page with a list of application. When multiple application are configured for GlobalProtect Clientless VPN, users are directed to the first application instead of portal page with a list of application.
## PAN-268705
```caveat
This issue is now resolved. See PAN-OS 11.1.9 Addressed Issues..
```
The firewall intermittently fails to process FTP traffic.
**Workaround**: Configure an application override policy rule for FTP applications.
## PAN-262556 ## PAN-262556
The ElasticSearch cluster health status might continue to remain yellow for an extended period after upgrading to PAN-OS 11.1 The ElasticSearch cluster health status might continue to remain yellow for an extended period after upgrading to PAN-OS 11.1
## PAN-261429 ## PAN-261429
The command show auth radius-require-msg-authentic might return no output. ```caveat
This issue is now resolved. See PAN-OS 11.1.8 Addressed Issues.
```
The command `show auth radius-require-msg-authentic` might return no output.
## PAN-260851 ## PAN-260851
From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (ObjectsApplications) tag. From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (**Objects** > **Applications**) tag.
## PAN-254240 ## PAN-254240
@@ -270,17 +365,22 @@ LACP flap is expected during a device failover in an NGFW cluster due to an L2 c
## PAN-237106 ## PAN-237106
```caveat
This issue is now resolved. See PAN-OS 11.1.8 Addressed Issues
```
LSVPN satellite certificates may be generated with serial numbers exceeding 40 hexadecimal characters. This causes certificate revocation and deletion operations to fail with the following error messages: LSVPN satellite certificates may be generated with serial numbers exceeding 40 hexadecimal characters. This causes certificate revocation and deletion operations to fail with the following error messages:
db-serialno can be at most 40 characters - `db-serialno can be at most 40 characters`
- `db-serialno is invalid`
db-serialno is invalid **Workaround:**
To resolve this issue, use the following CLI commands with the LSVPN satellite serial number to manually delete or revoke the affected certificates: To resolve this issue, use the following CLI commands with the LSVPN satellite serial number to manually delete or revoke the affected certificates:
Delete certificate information:delete sslmgr-store certificate-info portal name <name> serialno <satellite_serial> **Delete certificate information**:`delete sslmgr-store certificate-info portal name <name> serialno <satellite_serial>`
Revoke satellite certificates:delete sslmgr-store satellite-info-revoke-certificate portal <name> serialno <list_of_satellite_serials> **Revoke satellite certificates**:`delete sslmgr-store satellite-info-revoke-certificate portal <name> serialno <list_of_satellite_serials>`
## PAN-234015 ## PAN-234015
@@ -292,11 +392,11 @@ The autocommit time of the VM-Series firewall running PAN-OS 11.1.0 might take l
## PAN-220180 ## PAN-220180
Configured botnet reports (MonitorBotnet) are not generated. Configured botnet reports (**Monitor** > **Botnet**) are not generated.
## PAN-219644 ## PAN-219644
Firewalls forwarding logs to a syslog server over TLS (ObjectsLog Forwarding) use the default Palo Alto Networks certificate instead of the custom certificate configured on the firewall. Firewalls forwarding logs to a syslog server over TLS (**Objects** > **Log Forwarding**) use the default Palo Alto Networks certificate instead of the custom certificate configured on the firewall.
## PAN-207733 ## PAN-207733
@@ -308,21 +408,13 @@ When a DHCPv6 client is configured on HA Active/Passive firewalls, the Passive f
## PAN-207442 ## PAN-207442
For M-700 appliances in an active/passive high availability (PanoramaHigh Availability) configuration, the active-primary HA peer configuration sync to the secondary-passive HA peer may fail. When the config sync fails, the job Results is Successful (Tasks), however the sync status on the Dashboard displays as Out of Sync for both HA peers. For M-700 appliances in an active/passive high availability (**Panorama** > **High Availability**) configuration, the `active-primary` HA peer configuration sync to the `secondary-passive` HA peer may fail. When the config sync fails, the job Results is `Successful` (**Tasks**), however the sync status on the **Dashboard** displays as `Out of Sync` for both HA peers.
Workaround: Perform a local commit on the active-primary HA peer and then synchronize the HA configuration. **Workaround**: Perform a local commit on the `active-primary` HA peer and then synchronize the HA configuration.
Log in to the Panorama web interface of the active-primary HA peer. 1. [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface) of the `active-primary` HA peer.
2. Select **Commit** and **Commit to Panorama**.
Log in to the Panorama web interface of the active-primary HA peer. 3. In the `active-primary` HA peer **Dashboard**, click **Sync to Peer** in the High Availability widget.
Select Commit and Commit to Panorama.
Select Commit and Commit to Panorama.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
## PAN-207040 ## PAN-207040
@@ -330,41 +422,22 @@ If you disable Advanced Routing, remove logical routers, and downgrade from PAN-
## PAN-206913 ## PAN-206913
When a DHCPv6 client is configured on HA Active/Passive firewalls, releasing the IPv6 address from the client (using Release in the UI or using the request dhcp client ipv6 release all CLI command) releases the IPv6 address from the Active firewall, but not the Passive firewall. When a DHCPv6 client is configured on HA Active/Passive firewalls, releasing the IPv6 address from the client (using Release in the UI or using the `request dhcp client ipv6 release all` CLI command) releases the IPv6 address from the Active firewall, but not the Passive firewall.
## PAN-206909 ## PAN-206909
The Dedicated Log Collector is unable to reconnect to the Panorama management server if the configd process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection Status (PanoramaManaged Collector) displaying connected and the managed colletor Health status displaying as healthy. The Dedicated Log Collector is unable to reconnect to the Panorama management server if the `configd` process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection `Status` (**Panorama** > **Managed Collector**) displaying `connected` and the managed colletor `Health` status displaying as healthy.
This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted. This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted.
Workaround: Restart the mgmtsrvr process on the Dedicated Log Collector. **Workaround:** Restart the `mgmtsrvr` process on the Dedicated Log Collector.
Log in to the Dedicated Log Collector CLI. 1. [Log in to the Dedicated Log Collector CLI](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli).
2. Confirm the Dedicated Log Collector is disconnected from Panorama.
Log in to the Dedicated Log Collector CLI. `admin>``show panorama-status`
Verify the `Connected` status is `no`.
Confirm the Dedicated Log Collector is disconnected from Panorama.admin> show panorama-status Verify the Connected status is no. 3. Restart the `mgmtsrvr` process.
`admin>``debug software restart process management-server`
Confirm the Dedicated Log Collector is disconnected from Panorama.
admin> show panorama-status Verify the Connected status is no.
admin> show panorama-status
admin> show panorama-status
Verify the Connected status is no.
Restart the mgmtsrvr process.admin> debug software restart process management-server
Restart the mgmtsrvr process.
admin> debug software restart process management-server
admin> debug software restart process management-server
admin> debug software restart process management-server
## PAN-197588 ## PAN-197588
@@ -376,11 +449,11 @@ The PAN-OS ACC (Application Command Center) does not display a widget detailing
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, the power over Ethernet (PoE) ports do not display a Tag value. In **Network** > **Interface** > **Ethernet**, the power over Ethernet (PoE) ports do not display a **Tag** value.
## PAN-196758 ## PAN-196758
On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you Preview Changes (CommitPush to DevicesEdit Selections or CommitCommit and PushEdit Selections). On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you **Preview Changes** (**Commit** > **Push to Devices** > **Edit Selections** or **Commit** > **Commit and Push** > **Edit Selections**).
## PAN-195968 ## PAN-195968
@@ -396,23 +469,23 @@ When using the CLI to configure power over Ethernet (PoE) on a non-PoE port, the
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, hovering the mouse over a power over Ethernet (PoE) Link State icon does not display link speed and link duplex details. In **Network** > **Interface** > **Ethernet**, hovering the mouse over a power over Ethernet (PoE) **Link State** icon does not display link speed and link duplex details.
## PAN-187685 ## PAN-187685
On the Panorama management server, the Template Status displays no synchronization status (PanoramaManaged DevicesSummary) after a bootstrapped firewall is successfully added to Panorama. On the Panorama management server, the Template Status displays no synchronization status (**Panorama** > **Managed Devices** > **Summary**) after a bootstrapped firewall is successfully added to Panorama.
Workaround: After the bootstrapped firewall is successfully added to Panorama, log in to the Panorama web interface and select CommitPush to Devices. **Workaround:** After the bootstrapped firewall is successfully added to Panorama, [log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) and select **Commit** > **Push to Devices**.
## PAN-187407 ## PAN-187407
The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to Hold client request for category lookup and the action set to Reset-Both and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed. The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to **Hold client request for category lookup**and the action set to **Reset-Both** and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed.
## PAN-186283 ## PAN-186283
Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS. Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS.
Workaround: Use CommitPush to Devices to synchronize the templates. **Workaround**: Use **Commit** > **Push to Devices** to synchronize the templates.
## PAN-184708 ## PAN-184708
@@ -420,29 +493,24 @@ Workaround: Use CommitPush to Devices to synchronize the templates.
Panorama managed firewalls Panorama managed firewalls
``` ```
Scheduled report emails (MonitorPDF ReportsEmail Scheduler) are not emailed if: Scheduled report emails (**Monitor** > **PDF Reports** > **Email Scheduler**) are not emailed if:
A scheduled report email contains a Report Group (MonitorPDF ReportsReport Group) which includes a SaaS Application Usage report. - A scheduled report email contains a Report Group (**Monitor** > **PDF Reports** > **Report Group**) which includes a SaaS Application Usage report.
- A scheduled report contains only a SaaS Application Usage Report.
A scheduled report contains only a SaaS Application Usage Report. **Workaround:** To receive a scheduled report email for all other PDF report types:
Workaround: To receive a scheduled report email for all other PDF report types: 1. Select **Monitor** > **PDF Reports** > **Report Groups** and remove all SaaS Application Usage reports from all Report Groups.
2. Select **Monitor** > **PDF Reports** > **Email Scheduler** and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select **Disable** and click **OK**.
Select MonitorPDF ReportsReport Groups and remove all SaaS Application Usage reports from all Report Groups. Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
3. **Commit**.
Select MonitorPDF ReportsEmail Scheduler and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select Disable and click OK.Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report. () Select **Commit** > **Commit and Push**
Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
Commit.() Select CommitCommit and Push
() Select CommitCommit and Push
## PAN-184406 ## PAN-184406
Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash. Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash.
Workaround: Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance. **Workaround:** Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance.
## PAN-183404 ## PAN-183404
web/data/issues/PAN-OS/known/11.1.8.md
+161 -112
View File
@@ -4,26 +4,56 @@ product: PAN-OS
version: 11.1.8 version: 11.1.8
--- ---
## PAN-308564
Packets are dropped on SD-WAN interfaces if they require fragmentation for an interface but have the **Don't Fragment (DF)** bit set. This results in unexpected packet drops. This affects client to server sessions when using SD-WAN for NGFW.
**Workaround:** Allow fragmenting packets with DF bit set (`debug dataplane set ip4-ignore-df yes`).
## PAN-304756 ## PAN-304756
```caveat
This issue is now resolved. See PAN-OS 11.1.13-h1 Addressed Issues.
```
After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems. After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems.
## PAN-304576 ## PAN-304576
Traffic interruption may occur when inspection of HTTP/2 traffic is enabled. Traffic interruption may occur when inspection of HTTP/2 traffic is enabled.
Workaround: Disable HTTP/2 server push using the set deviceconfig setting http2 server-push no CLI command. **Workaround:** Disable HTTP/2 server push using the `set deviceconfig setting http2 server-push no` CLI command.
## PAN-303051
```caveat
This issue is now resolved. See PAN-OS 11.1.13 Addressed Issues
```
The reportd process experiences a memory leak because it retains memory that was temporarily used for report generation. Once a task is complete, the process fails to release this memory for reuse, leading to continuous accumulation and eventual memory exhaustion on the Panorama device.
## PAN-298505 ## PAN-298505
```caveat
This issue is now resolved. See PAN-OS 11.1.10-h7 Addressed Issues and PAN-OS 11.1.12 Addressed Issues
```
After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing auto-commit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems managed by Panorama, and the vsys ID sequence breaks when unused virtual systems are deleted and the changes are pushed to the firewall. After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing auto-commit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems managed by Panorama, and the vsys ID sequence breaks when unused virtual systems are deleted and the changes are pushed to the firewall.
## PAN-294179 ## PAN-294179
On the Panorama Config Audit page, some commit versions might display incorrect or missing data. Fields such as, COMMITTED BY , COMMIT DATE , and OBJECT CHANGES might not be visible for some commit versions. Sometimes, commit versions can disappear after a refresh and the commit description field might display corrupted characters. ```caveat
This issue is now resolved. See PAN-OS 11.1.10-h4 Addressed Issues.
```
On the**Panorama Config Audit** page, some commit versions might display incorrect or missing data. Fields such as, **COMMITTED BY**, **COMMIT DATE**, and**OBJECT CHANGES** might not be visible for some commit versions. Sometimes, commit versions can disappear after a refresh and the commit description field might display corrupted characters.
## PAN-293673 ## PAN-293673
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
When the firewall generates a high volume of logs and attempts to export these logs to an FTP server, it may consume excessive memory leading to all PAN-OS processes crashing. When the firewall generates a high volume of logs and attempts to export these logs to an FTP server, it may consume excessive memory leading to all PAN-OS processes crashing.
## PAN-292202 ## PAN-292202
@@ -38,14 +68,26 @@ Could not get parameters for double encryption. This occurred when the certifica
## PAN-290996 ## PAN-290996
```caveat
This issue is now resolved. See PAN-OS 11.1.10-h1 Addressed Issues
```
When performing an SNMP walk, the Connections Per Second (CPS) counters incorrectly return a value of 0 for each virtual system (VSYS), despite the firewall actively processing connections. When performing an SNMP walk, the Connections Per Second (CPS) counters incorrectly return a value of 0 for each virtual system (VSYS), despite the firewall actively processing connections.
## PAN-290235 ## PAN-290235
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues.
```
The dscd process crashes continuously on MIPS platforms (for example, PA-850 firewalls) due to a runtime error related to an invalid memory address or nil pointer dereference. This occurs when the golang library upgrade in CIE is not compatible with the MIPS platform. The dscd process crashes continuously on MIPS platforms (for example, PA-850 firewalls) due to a runtime error related to an invalid memory address or nil pointer dereference. This occurs when the golang library upgrade in CIE is not compatible with the MIPS platform.
## PAN-290088 ## PAN-290088
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
When pushing configurations from Panorama to a firewall, a memory leak might occur in the firewall's configd process, particularly when the configurations contain shared policies. Each configuration push causes the configd process to consume additional memory that is not released after the commit completes. When pushing configurations from Panorama to a firewall, a memory leak might occur in the firewall's configd process, particularly when the configurations contain shared policies. Each configuration push causes the configd process to consume additional memory that is not released after the commit completes.
## PAN-289383 ## PAN-289383
@@ -56,21 +98,33 @@ PA-800 series firewalls only
Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation. Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation.
Workaround: Enable auto-negotiation on the connected peer firewall. **Workaround:** Enable auto-negotiation on the connected peer firewall.
## PAN-288097 ## PAN-288097
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
Routed process may stop responding after changing MTU or any link parameters when OSPF and PIM are enabled on the same interface. Routed process may stop responding after changing MTU or any link parameters when OSPF and PIM are enabled on the same interface.
## PAN-287056 ## PAN-287056
```caveat
This issue is now resolved. See PAN-OS 11.1.10-h1 Addressed Issues
```
A BGP export policy rule that matches on a next hop fails to block the advertisement of static routes, and the firewall incorrectly matches the egress interface IP address instead of the original next-hop IP address of the static route, which causes the deny rule to fail. A BGP export policy rule that matches on a next hop fails to block the advertisement of static routes, and the firewall incorrectly matches the egress interface IP address instead of the original next-hop IP address of the static route, which causes the deny rule to fail.
## PAN-286897 ## PAN-286897
```caveat
This issue is now resolved. See PAN-OS 11.1.10 Addressed Issues.
```
The pan_task process might fail when the firewall attempts to forward files to the WildFire public cloud, which can cause the dataplane to experience heartbeat failures. The pan_task process might fail when the firewall attempts to forward files to the WildFire public cloud, which can cause the dataplane to experience heartbeat failures.
Workaround: Disable the firewall WildFire Analysis profile. **Workaround:** Disable the firewall WildFire Analysis profile.
## PAN-286848 ## PAN-286848
@@ -86,43 +140,46 @@ URL-continue and override continue selections will function like a general URL-b
## PAN-286306 ## PAN-286306
When getting transceiver information from ESCC for SFP 25G modules, the transceiver code incorrectly displays Unknown instead of 25GBase-SR. ```caveat
This issue is now resolved. See PAN-OS 11.1.10-h1 Addressed Issues
```
When getting transceiver information from ESCC for SFP 25G modules, the transceiver code incorrectly displays `Unknown` instead of `25GBase-SR`.
## PAN-286255 ## PAN-286255
```caveat
This issue affects PAN-OS 11.1.7-h2 This issue is now resolved. See PAN-OS 11.1.9 Addressed Issues.
```
When a firewall receives an unexpected termination request for certain SSL sessions , NGFW dataplane might experience a slow buffer resource leak. When a firewall receives an unexpected termination request for certain SSL sessions , NGFW dataplane might experience a slow buffer resource leak.
Workaround: Disable accumulation proxy on the NGFW. **Workaround**: Disable accumulation proxy on the NGFW.
## PAN-286231 ## PAN-286231
When performing a partial Commit and Push on Panorama, there is a risk that unintended configuration changes might be pushed to a firewall. ```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
This issue is more likely to occur in the following scenarios:When you run Commit and Push operations as a single action.When you trigger multiple parallel commit-all jobs at the same time.Device groups and templates have different configuration synchronization versions. When performing a partial **Commit and Push** on Panorama, there is a risk that unintended configuration changes might be pushed to a firewall.
When you run Commit and Push operations as a single action. This issue is more likely to occur in the following scenarios:
When you run Commit and Push operations as a single action. - When you run **Commit and Push** operations as a single action.
- When you trigger multiple parallel commit-all jobs at the same time.
- Device groups and templates have different configuration synchronization versions.
When you trigger multiple parallel commit-all jobs at the same time. **Workaround:** Perform one of the following steps:
When you trigger multiple parallel commit-all jobs at the same time. - Perform commit and push as two separate, sequential steps.
- Perform a full push instead of selective push.
Device groups and templates have different configuration synchronization versions.
Device groups and templates have different configuration synchronization versions.
Workaround: Perform one of the following steps:
Perform commit and push as two separate, sequential steps.
Perform a full push instead of selective push.
## PAN-285894 ## PAN-285894
If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots. If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots.
Workaround: Disable the Preserve Pre-NAT feature using the set deviceconfig setting preserve-prenat-feature no CLI command. **Workaround:** Disable the Preserve Pre-NAT feature using the `set deviceconfig setting preserve-prenat-feature no` CLI command.
## PAN-283467 ## PAN-283467
@@ -132,73 +189,87 @@ PA-3400 Series firewalls only
The firewall might unexpectedly reboot and enter maintenance mode due to a ctd-agent out-of-memory (OOM) condition when undergoing advanced services load testing with a high volume of IoT EAL log forwarding. The firewall might unexpectedly reboot and enter maintenance mode due to a ctd-agent out-of-memory (OOM) condition when undergoing advanced services load testing with a high volume of IoT EAL log forwarding.
Workaround: Limit the number of EAL logs generated by the firewall using the following CLI command: debug iot eal key-value EAL_PENDING_BYTES=1000. **Workaround:** Limit the number of EAL logs generated by the firewall using the following CLI command: `debug iot eal key-value EAL_PENDING_BYTES=1000`.
## PAN-283429 ## PAN-283429
When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted. When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted.
Workaround: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates. **Workaround**: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates.
## PAN-282854 ## PAN-282854
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
The Elasticsearch cluster fails to start after deploying dedicated log collectors in a multi-collector environment. The Elasticsearch cluster fails to start after deploying dedicated log collectors in a multi-collector environment.
**Workaround:** Restart all the involved log collectors.
## PAN-281885 ## PAN-281885
When exporting and importing the CSV file, the hash values of pre-shared key (PSK) variables set at template and template stack levels inconsistently change, resulting in both variables displaying the same hash value. When exporting and importing the CSV file, the hash values of pre-shared key (PSK) variables set at template and template stack levels inconsistently change, resulting in both variables displaying the same hash value.
## PAN-280532 ## PAN-280532
```caveat
This issue is now resolved. See PAN-OS 11.1.10 Addressed Issues.
```
When you use a single syslog server over TCP for log forwarding, and the connectivity to the syslog server breaks, syslog forwarding does not resume even after the connectivity to the server restores. When you use a single syslog server over TCP for log forwarding, and the connectivity to the syslog server breaks, syslog forwarding does not resume even after the connectivity to the server restores.
Workaround: Performing one of the following tasks: **Workaround:** Performing one of the following tasks:
Reboot the firewall. - Reboot the firewall.
- Temporarily, configure syslog to use UDP, commit the configuration, revert to TCP, and then commit.
Temporarily, configure syslog to use UDP, commit the configuration, revert to TCP, and then commit.
## PAN-279901 ## PAN-279901
When decryption is enabled, segmented Client Hello packets can cause website access issues and memory leaks under the following conditions: When decryption is enabled, segmented Client Hello packets can cause website access issues and memory leaks under the following conditions:
The segmented Client Hello packets arrive out-of-order - The segmented Client Hello packets arrive out-of-order
- The segmented Client Hello packets arrive out-of-order and can be reassembled into a complete Client Hello when the first contiguous segment is formed by NGFW
- The first segment of the Client Hello packets is less than 5 bytes
- A decryption policy rule excludes this traffic from decryption and a Security policy rule (URL filtering) denies this session
The segmented Client Hello packets arrive out-of-order To enable this fix, run the CLI command `bug dataplane set ssl-decrypt accumulate-client-hello disjoined yes`
The segmented Client Hello packets arrive out-of-order and can be reassembled into a complete Client Hello when the first contiguous segment is formed by NGFW
The segmented Client Hello packets arrive out-of-order and can be reassembled into a complete Client Hello when the first contiguous segment is formed by NGFW
The first segment of the Client Hello packets is less than 5 bytes
The first segment of the Client Hello packets is less than 5 bytes
A decryption policy rule excludes this traffic from decryption and a Security policy rule (URL filtering) denies this session
A decryption policy rule excludes this traffic from decryption and a Security policy rule (URL filtering) denies this session
To enable this fix, run the CLI command bug dataplane set ssl-decrypt accumulate-client-hello disjoined yes
## PAN-279621 ## PAN-279621
```caveat
This issue is now resolved. See PAN-OS 11.1.9 Addressed Issues.
```
Early aging and removal of firewall session while they are still active can lead to intermittent instabilities and crashes for proxy traffic, the Content and Threat detection engine, and any data-path processing. Early aging and removal of firewall session while they are still active can lead to intermittent instabilities and crashes for proxy traffic, the Content and Threat detection engine, and any data-path processing.
## PAN-279415 ## PAN-279415
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
Service routes configured for a data plane interface might incorrectly route traffic through the management plane interface instead. This issue impacts Syslog and CRL status traffic when the service route lacks a specific destination custom service route. Service routes configured for a data plane interface might incorrectly route traffic through the management plane interface instead. This issue impacts Syslog and CRL status traffic when the service route lacks a specific destination custom service route.
## PAN-277417 ## PAN-277417
```caveat
This issue is now resolved. See PAN-OS 11.1.9 Addressed Issues.
```
Memory leak issues can occur during the parsing of server certificates used for SSL Inbound Inspection, preventing the firewall from completing inspection. Memory leak issues can occur during the parsing of server certificates used for SSL Inbound Inspection, preventing the firewall from completing inspection.
## PAN-276920 ## PAN-276920
URL filtering response pages may load slowly or fail to display when users request websites that are blocked in the URL Filtering profile (site access for the corresponding URL category is block, continue, or override) attached to the matching Security policy rule. This occurs on an intermittent basis. URL filtering response pages may load slowly or fail to display when users request websites that are blocked in the URL Filtering profile (site access for the corresponding URL category is **block**, **continue**, or **override**) attached to the matching Security policy rule. This occurs on an intermittent basis.
## PAN-275601 ## PAN-275601
When Panorama is not internet-connected and you try to upload images to the managed firewalls by using the Validate option, the upload fails with the following error: Failed to create multi-upload job. No valid software deploy targets found. ```caveat
This issue is now resolved. See PAN-OS 11.1.10 Addressed Issues
```
When Panorama is not internet-connected and you try to upload images to the managed firewalls by using the **Validate** option, the upload fails with the following error: `Failed to create multi-upload job. No valid software deploy targets found.`
## PAN-275047 ## PAN-275047
@@ -208,13 +279,23 @@ VM-Series firewalls only
After an upgrade, the firewall is unable to send logs to the Strata Logging Service (SLS) when using a specific proxy server, and the SSL connection status displays as failed when attempting to forward logs through the web proxy. After an upgrade, the firewall is unable to send logs to the Strata Logging Service (SLS) when using a specific proxy server, and the SSL connection status displays as failed when attempting to forward logs through the web proxy.
## PAN-268705
```caveat
This issue is now resolved. See PAN-OS 11.1.9 Addressed Issues.
```
The firewall intermittently fails to process FTP traffic.
**Workaround**: Configure an application override policy rule for FTP applications.
## PAN-262556 ## PAN-262556
The ElasticSearch cluster health status might continue to remain yellow for an extended period after upgrading to PAN-OS 11.1 The ElasticSearch cluster health status might continue to remain yellow for an extended period after upgrading to PAN-OS 11.1
## PAN-260851 ## PAN-260851
From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (ObjectsApplications) tag. From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (**Objects** > **Applications**) tag.
## PAN-254240 ## PAN-254240
@@ -246,7 +327,7 @@ The autocommit time of the VM-Series firewall running PAN-OS 11.1.0 might take l
## PAN-220180 ## PAN-220180
Configured botnet reports (MonitorBotnet) are not generated. Configured botnet reports (**Monitor** > **Botnet**) are not generated.
## PAN-207733 ## PAN-207733
@@ -258,21 +339,13 @@ When a DHCPv6 client is configured on HA Active/Passive firewalls, the Passive f
## PAN-207442 ## PAN-207442
For M-700 appliances in an active/passive high availability (PanoramaHigh Availability) configuration, the active-primary HA peer configuration sync to the secondary-passive HA peer may fail. When the config sync fails, the job Results is Successful (Tasks), however the sync status on the Dashboard displays as Out of Sync for both HA peers. For M-700 appliances in an active/passive high availability (**Panorama** > **High Availability**) configuration, the `active-primary` HA peer configuration sync to the `secondary-passive` HA peer may fail. When the config sync fails, the job Results is `Successful` (**Tasks**), however the sync status on the **Dashboard** displays as `Out of Sync` for both HA peers.
Workaround: Perform a local commit on the active-primary HA peer and then synchronize the HA configuration. **Workaround**: Perform a local commit on the `active-primary` HA peer and then synchronize the HA configuration.
Log in to the Panorama web interface of the active-primary HA peer. 1. [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface) of the `active-primary` HA peer.
2. Select **Commit** and **Commit to Panorama**.
Log in to the Panorama web interface of the active-primary HA peer. 3. In the `active-primary` HA peer **Dashboard**, click **Sync to Peer** in the High Availability widget.
Select Commit and Commit to Panorama.
Select Commit and Commit to Panorama.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
## PAN-207040 ## PAN-207040
@@ -280,41 +353,22 @@ If you disable Advanced Routing, remove logical routers, and downgrade from PAN-
## PAN-206913 ## PAN-206913
When a DHCPv6 client is configured on HA Active/Passive firewalls, releasing the IPv6 address from the client (using Release in the UI or using the request dhcp client ipv6 release all CLI command) releases the IPv6 address from the Active firewall, but not the Passive firewall. When a DHCPv6 client is configured on HA Active/Passive firewalls, releasing the IPv6 address from the client (using Release in the UI or using the `request dhcp client ipv6 release all` CLI command) releases the IPv6 address from the Active firewall, but not the Passive firewall.
## PAN-206909 ## PAN-206909
The Dedicated Log Collector is unable to reconnect to the Panorama management server if the configd process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection Status (PanoramaManaged Collector) displaying connected and the managed colletor Health status displaying as healthy. The Dedicated Log Collector is unable to reconnect to the Panorama management server if the `configd` process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection `Status` (**Panorama** > **Managed Collector**) displaying `connected` and the managed colletor `Health` status displaying as healthy.
This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted. This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted.
Workaround: Restart the mgmtsrvr process on the Dedicated Log Collector. **Workaround:** Restart the `mgmtsrvr` process on the Dedicated Log Collector.
Log in to the Dedicated Log Collector CLI. 1. [Log in to the Dedicated Log Collector CLI](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli).
2. Confirm the Dedicated Log Collector is disconnected from Panorama.
Log in to the Dedicated Log Collector CLI. `admin>``show panorama-status`
Verify the `Connected` status is `no`.
Confirm the Dedicated Log Collector is disconnected from Panorama.admin> show panorama-status Verify the Connected status is no. 3. Restart the `mgmtsrvr` process.
`admin>``debug software restart process management-server`
Confirm the Dedicated Log Collector is disconnected from Panorama.
admin> show panorama-status Verify the Connected status is no.
admin> show panorama-status
admin> show panorama-status
Verify the Connected status is no.
Restart the mgmtsrvr process.admin> debug software restart process management-server
Restart the mgmtsrvr process.
admin> debug software restart process management-server
admin> debug software restart process management-server
admin> debug software restart process management-server
## PAN-197588 ## PAN-197588
@@ -326,11 +380,11 @@ The PAN-OS ACC (Application Command Center) does not display a widget detailing
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, the power over Ethernet (PoE) ports do not display a Tag value. In **Network** > **Interface** > **Ethernet**, the power over Ethernet (PoE) ports do not display a **Tag** value.
## PAN-196758 ## PAN-196758
On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you Preview Changes (CommitPush to DevicesEdit Selections or CommitCommit and PushEdit Selections). On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you **Preview Changes** (**Commit** > **Push to Devices** > **Edit Selections** or **Commit** > **Commit and Push** > **Edit Selections**).
## PAN-195968 ## PAN-195968
@@ -346,23 +400,23 @@ When using the CLI to configure power over Ethernet (PoE) on a non-PoE port, the
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, hovering the mouse over a power over Ethernet (PoE) Link State icon does not display link speed and link duplex details. In **Network** > **Interface** > **Ethernet**, hovering the mouse over a power over Ethernet (PoE) **Link State** icon does not display link speed and link duplex details.
## PAN-187685 ## PAN-187685
On the Panorama management server, the Template Status displays no synchronization status (PanoramaManaged DevicesSummary) after a bootstrapped firewall is successfully added to Panorama. On the Panorama management server, the Template Status displays no synchronization status (**Panorama** > **Managed Devices** > **Summary**) after a bootstrapped firewall is successfully added to Panorama.
Workaround: After the bootstrapped firewall is successfully added to Panorama, log in to the Panorama web interface and select CommitPush to Devices. **Workaround:** After the bootstrapped firewall is successfully added to Panorama, [log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) and select **Commit** > **Push to Devices**.
## PAN-187407 ## PAN-187407
The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to Hold client request for category lookup and the action set to Reset-Both and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed. The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to **Hold client request for category lookup**and the action set to **Reset-Both** and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed.
## PAN-186283 ## PAN-186283
Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS. Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS.
Workaround: Use CommitPush to Devices to synchronize the templates. **Workaround**: Use **Commit** > **Push to Devices** to synchronize the templates.
## PAN-184708 ## PAN-184708
@@ -370,29 +424,24 @@ Workaround: Use CommitPush to Devices to synchronize the templates.
Panorama managed firewalls Panorama managed firewalls
``` ```
Scheduled report emails (MonitorPDF ReportsEmail Scheduler) are not emailed if: Scheduled report emails (**Monitor** > **PDF Reports** > **Email Scheduler**) are not emailed if:
A scheduled report email contains a Report Group (MonitorPDF ReportsReport Group) which includes a SaaS Application Usage report. - A scheduled report email contains a Report Group (**Monitor** > **PDF Reports** > **Report Group**) which includes a SaaS Application Usage report.
- A scheduled report contains only a SaaS Application Usage Report.
A scheduled report contains only a SaaS Application Usage Report. **Workaround:** To receive a scheduled report email for all other PDF report types:
Workaround: To receive a scheduled report email for all other PDF report types: 1. Select **Monitor** > **PDF Reports** > **Report Groups** and remove all SaaS Application Usage reports from all Report Groups.
2. Select **Monitor** > **PDF Reports** > **Email Scheduler** and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select **Disable** and click **OK**.
Select MonitorPDF ReportsReport Groups and remove all SaaS Application Usage reports from all Report Groups. Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
3. **Commit**.
Select MonitorPDF ReportsEmail Scheduler and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select Disable and click OK.Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report. () Select **Commit** > **Commit and Push**
Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
Commit.() Select CommitCommit and Push
() Select CommitCommit and Push
## PAN-184406 ## PAN-184406
Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash. Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash.
Workaround: Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance. **Workaround:** Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance.
## PAN-183404 ## PAN-183404
web/data/issues/PAN-OS/known/11.1.9.md
+138 -111
View File
@@ -4,26 +4,56 @@ product: PAN-OS
version: 11.1.9 version: 11.1.9
--- ---
## PAN-308564
Packets are dropped on SD-WAN interfaces if they require fragmentation for an interface but have the **Don't Fragment (DF)** bit set. This results in unexpected packet drops. This affects client to server sessions when using SD-WAN for NGFW.
**Workaround:** Allow fragmenting packets with DF bit set (`debug dataplane set ip4-ignore-df yes`).
## PAN-304756 ## PAN-304756
```caveat
This issue is now resolved. See PAN-OS 11.1.13-h1 Addressed Issues.
```
After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems. After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push might result in incomplete or inconsistent configurations across virtual systems.
## PAN-304576 ## PAN-304576
Traffic interruption may occur when inspection of HTTP/2 traffic is enabled. Traffic interruption may occur when inspection of HTTP/2 traffic is enabled.
Workaround: Disable HTTP/2 server push using the set deviceconfig setting http2 server-push no CLI command. **Workaround:** Disable HTTP/2 server push using the `set deviceconfig setting http2 server-push no` CLI command.
## PAN-303051
```caveat
This issue is now resolved. See PAN-OS 11.1.13 Addressed Issues
```
The reportd process experiences a memory leak because it retains memory that was temporarily used for report generation. Once a task is complete, the process fails to release this memory for reuse, leading to continuous accumulation and eventual memory exhaustion on the Panorama device.
## PAN-298505 ## PAN-298505
```caveat
This issue is now resolved. See PAN-OS 11.1.10-h7 Addressed Issues and PAN-OS 11.1.12 Addressed Issues
```
After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing auto-commit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems managed by Panorama, and the vsys ID sequence breaks when unused virtual systems are deleted and the changes are pushed to the firewall. After upgrading multi-vsys firewalls, the sequence of the virtual system IDs (vsys ID) changes causing auto-commit failures with validation errors. This occurs when the multi-vsys firewall has virtual systems managed by Panorama, and the vsys ID sequence breaks when unused virtual systems are deleted and the changes are pushed to the firewall.
## PAN-294179 ## PAN-294179
On the Panorama Config Audit page, some commit versions might display incorrect or missing data. Fields such as, COMMITTED BY , COMMIT DATE , and OBJECT CHANGES might not be visible for some commit versions. Sometimes, commit versions can disappear after a refresh and the commit description field might display corrupted characters. ```caveat
This issue is now resolved. See PAN-OS 11.1.10-h4 Addressed Issues.
```
On the**Panorama Config Audit** page, some commit versions might display incorrect or missing data. Fields such as, **COMMITTED BY**, **COMMIT DATE**, and**OBJECT CHANGES** might not be visible for some commit versions. Sometimes, commit versions can disappear after a refresh and the commit description field might display corrupted characters.
## PAN-293673 ## PAN-293673
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
When the firewall generates a high volume of logs and attempts to export these logs to an FTP server, it may consume excessive memory leading to all PAN-OS processes crashing. When the firewall generates a high volume of logs and attempts to export these logs to an FTP server, it may consume excessive memory leading to all PAN-OS processes crashing.
## PAN-292202 ## PAN-292202
@@ -38,10 +68,18 @@ Could not get parameters for double encryption. This occurred when the certifica
## PAN-290235 ## PAN-290235
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues.
```
The dscd process crashes continuously on MIPS platforms (for example, PA-850 firewalls) due to a runtime error related to an invalid memory address or nil pointer dereference. This occurs when the golang library upgrade in CIE is not compatible with the MIPS platform. The dscd process crashes continuously on MIPS platforms (for example, PA-850 firewalls) due to a runtime error related to an invalid memory address or nil pointer dereference. This occurs when the golang library upgrade in CIE is not compatible with the MIPS platform.
## PAN-290088 ## PAN-290088
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
When pushing configurations from Panorama to a firewall, a memory leak might occur in the firewall's configd process, particularly when the configurations contain shared policies. Each configuration push causes the configd process to consume additional memory that is not released after the commit completes. When pushing configurations from Panorama to a firewall, a memory leak might occur in the firewall's configd process, particularly when the configurations contain shared policies. Each configuration push causes the configd process to consume additional memory that is not released after the commit completes.
## PAN-289383 ## PAN-289383
@@ -52,21 +90,33 @@ PA-800 series firewalls only
Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation. Upgrading firewalls to PAN-OS 11.0 or later causes SFP ports to go non-operational when the firewall uses forced port mode and the connected peer device operates without auto-negotiation.
Workaround: Enable auto-negotiation on the connected peer firewall. **Workaround:** Enable auto-negotiation on the connected peer firewall.
## PAN-288097 ## PAN-288097
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
Routed process may stop responding after changing MTU or any link parameters when OSPF and PIM are enabled on the same interface. Routed process may stop responding after changing MTU or any link parameters when OSPF and PIM are enabled on the same interface.
## PAN-287056 ## PAN-287056
```caveat
This issue is now resolved. See PAN-OS 11.1.10-h1 Addressed Issues
```
A BGP export policy rule that matches on a next hop fails to block the advertisement of static routes, and the firewall incorrectly matches the egress interface IP address instead of the original next-hop IP address of the static route, which causes the deny rule to fail. A BGP export policy rule that matches on a next hop fails to block the advertisement of static routes, and the firewall incorrectly matches the egress interface IP address instead of the original next-hop IP address of the static route, which causes the deny rule to fail.
## PAN-286897 ## PAN-286897
```caveat
This issue is now resolved. See PAN-OS 11.1.10 Addressed Issues.
```
The pan_task process might fail when the firewall attempts to forward files to the WildFire public cloud, which can cause the dataplane to experience heartbeat failures. The pan_task process might fail when the firewall attempts to forward files to the WildFire public cloud, which can cause the dataplane to experience heartbeat failures.
Workaround: Disable the firewall WildFire Analysis profile. **Workaround:** Disable the firewall WildFire Analysis profile.
## PAN-286848 ## PAN-286848
@@ -82,37 +132,36 @@ URL-continue and override continue selections will function like a general URL-b
## PAN-286306 ## PAN-286306
When getting transceiver information from ESCC for SFP 25G modules, the transceiver code incorrectly displays Unknown instead of 25GBase-SR. ```caveat
This issue is now resolved. See PAN-OS 11.1.10-h1 Addressed Issues
```
When getting transceiver information from ESCC for SFP 25G modules, the transceiver code incorrectly displays `Unknown` instead of `25GBase-SR`.
## PAN-286231 ## PAN-286231
When performing a partial Commit and Push on Panorama, there is a risk that unintended configuration changes might be pushed to a firewall. ```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
This issue is more likely to occur in the following scenarios:When you run Commit and Push operations as a single action.When you trigger multiple parallel commit-all jobs at the same time.Device groups and templates have different configuration synchronization versions. When performing a partial **Commit and Push** on Panorama, there is a risk that unintended configuration changes might be pushed to a firewall.
When you run Commit and Push operations as a single action. This issue is more likely to occur in the following scenarios:
When you run Commit and Push operations as a single action. - When you run **Commit and Push** operations as a single action.
- When you trigger multiple parallel commit-all jobs at the same time.
- Device groups and templates have different configuration synchronization versions.
When you trigger multiple parallel commit-all jobs at the same time. **Workaround:** Perform one of the following steps:
When you trigger multiple parallel commit-all jobs at the same time. - Perform commit and push as two separate, sequential steps.
- Perform a full push instead of selective push.
Device groups and templates have different configuration synchronization versions.
Device groups and templates have different configuration synchronization versions.
Workaround: Perform one of the following steps:
Perform commit and push as two separate, sequential steps.
Perform a full push instead of selective push.
## PAN-285894 ## PAN-285894
If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots. If the Preserve Pre-NAT feature is enabled, dataplane crashes may occur, which could result in firewall reboots.
Workaround: Disable the Preserve Pre-NAT feature using the set deviceconfig setting preserve-prenat-feature no CLI command. **Workaround:** Disable the Preserve Pre-NAT feature using the `set deviceconfig setting preserve-prenat-feature no` CLI command.
## PAN-283467 ## PAN-283467
@@ -122,65 +171,75 @@ PA-3400 Series firewalls only
The firewall might unexpectedly reboot and enter maintenance mode due to a ctd-agent out-of-memory (OOM) condition when undergoing advanced services load testing with a high volume of IoT EAL log forwarding. The firewall might unexpectedly reboot and enter maintenance mode due to a ctd-agent out-of-memory (OOM) condition when undergoing advanced services load testing with a high volume of IoT EAL log forwarding.
Workaround: Limit the number of EAL logs generated by the firewall using the following CLI command: debug iot eal key-value EAL_PENDING_BYTES=1000. **Workaround:** Limit the number of EAL logs generated by the firewall using the following CLI command: `debug iot eal key-value EAL_PENDING_BYTES=1000`.
## PAN-283429 ## PAN-283429
When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted. When you use custom certificates for the connection between Panorama and a log collector, the automated renewal for the predefined ElasticSearch certificates gets disrupted.
Workaround: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates. **Workaround**: Remove the custom certificates before the ElasticSearch certificates expire. This allows the system to correctly identify and renew the predefined ElasticSearch certificates. After the renewal is complete, re-install the custom certificates.
## PAN-282854 ## PAN-282854
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
The Elasticsearch cluster fails to start after deploying dedicated log collectors in a multi-collector environment. The Elasticsearch cluster fails to start after deploying dedicated log collectors in a multi-collector environment.
**Workaround:** Restart all the involved log collectors.
## PAN-280532 ## PAN-280532
```caveat
This issue is now resolved. See PAN-OS 11.1.10 Addressed Issues.
```
When you use a single syslog server over TCP for log forwarding, and the connectivity to the syslog server breaks, syslog forwarding does not resume even after the connectivity to the server restores. When you use a single syslog server over TCP for log forwarding, and the connectivity to the syslog server breaks, syslog forwarding does not resume even after the connectivity to the server restores.
Workaround: Performing one of the following tasks: **Workaround:** Performing one of the following tasks:
Reboot the firewall. - Reboot the firewall.
- Temporarily, configure syslog to use UDP, commit the configuration, revert to TCP, and then commit.
Temporarily, configure syslog to use UDP, commit the configuration, revert to TCP, and then commit.
## PAN-279901 ## PAN-279901
When decryption is enabled, segmented Client Hello packets can cause website access issues and memory leaks under the following conditions: When decryption is enabled, segmented Client Hello packets can cause website access issues and memory leaks under the following conditions:
The segmented Client Hello packets arrive out-of-order - The segmented Client Hello packets arrive out-of-order
- The segmented Client Hello packets arrive out-of-order and can be reassembled into a complete Client Hello when the first contiguous segment is formed by NGFW
- The first segment of the Client Hello packets is less than 5 bytes
- A decryption policy rule excludes this traffic from decryption and a Security policy rule (URL filtering) denies this session
The segmented Client Hello packets arrive out-of-order To enable this fix, run the CLI command `bug dataplane set ssl-decrypt accumulate-client-hello disjoined yes`
The segmented Client Hello packets arrive out-of-order and can be reassembled into a complete Client Hello when the first contiguous segment is formed by NGFW
The segmented Client Hello packets arrive out-of-order and can be reassembled into a complete Client Hello when the first contiguous segment is formed by NGFW
The first segment of the Client Hello packets is less than 5 bytes
The first segment of the Client Hello packets is less than 5 bytes
A decryption policy rule excludes this traffic from decryption and a Security policy rule (URL filtering) denies this session
A decryption policy rule excludes this traffic from decryption and a Security policy rule (URL filtering) denies this session
To enable this fix, run the CLI command bug dataplane set ssl-decrypt accumulate-client-hello disjoined yes
## PAN-279415 ## PAN-279415
```caveat
This issue is now resolved. See PAN-OS 11.1.11 Addressed Issues
```
Service routes configured for a data plane interface might incorrectly route traffic through the management plane interface instead. This issue impacts Syslog and CRL status traffic when the service route lacks a specific destination custom service route. Service routes configured for a data plane interface might incorrectly route traffic through the management plane interface instead. This issue impacts Syslog and CRL status traffic when the service route lacks a specific destination custom service route.
## PAN-277034 ## PAN-277034
```caveat
This issue is now resolved. See PAN-OS 11.1.10-h5 Addressed Issues
```
WildFire reports might not fully display or be downloadable because some static resources fail to load. WildFire reports might not fully display or be downloadable because some static resources fail to load.
## PAN-276920 ## PAN-276920
URL filtering response pages may load slowly or fail to display when users request websites that are blocked in the URL Filtering profile (site access for the corresponding URL category is block, continue, or override) attached to the matching Security policy rule. This occurs on an intermittent basis. URL filtering response pages may load slowly or fail to display when users request websites that are blocked in the URL Filtering profile (site access for the corresponding URL category is **block**, **continue**, or **override**) attached to the matching Security policy rule. This occurs on an intermittent basis.
## PAN-275601 ## PAN-275601
When Panorama is not internet-connected and you try to upload images to the managed firewalls by using the Validate option, the upload fails with the following error: Failed to create multi-upload job. No valid software deploy targets found. ```caveat
This issue is now resolved. See PAN-OS 11.1.10 Addressed Issues
```
When Panorama is not internet-connected and you try to upload images to the managed firewalls by using the **Validate** option, the upload fails with the following error: `Failed to create multi-upload job. No valid software deploy targets found.`
## PAN-275047 ## PAN-275047
@@ -196,7 +255,7 @@ The ElasticSearch cluster health status might continue to remain yellow for an e
## PAN-260851 ## PAN-260851
From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (ObjectsApplications) tag. From the NGFW or Panorama CLI, you can override the existing application tag even if Disable Override is enabled for the application (**Objects** > **Applications**) tag.
## PAN-254240 ## PAN-254240
@@ -228,7 +287,7 @@ The autocommit time of the VM-Series firewall running PAN-OS 11.1.0 might take l
## PAN-220180 ## PAN-220180
Configured botnet reports (MonitorBotnet) are not generated. Configured botnet reports (**Monitor** > **Botnet**) are not generated.
## PAN-207733 ## PAN-207733
@@ -240,21 +299,13 @@ When a DHCPv6 client is configured on HA Active/Passive firewalls, the Passive f
## PAN-207442 ## PAN-207442
For M-700 appliances in an active/passive high availability (PanoramaHigh Availability) configuration, the active-primary HA peer configuration sync to the secondary-passive HA peer may fail. When the config sync fails, the job Results is Successful (Tasks), however the sync status on the Dashboard displays as Out of Sync for both HA peers. For M-700 appliances in an active/passive high availability (**Panorama** > **High Availability**) configuration, the `active-primary` HA peer configuration sync to the `secondary-passive` HA peer may fail. When the config sync fails, the job Results is `Successful` (**Tasks**), however the sync status on the **Dashboard** displays as `Out of Sync` for both HA peers.
Workaround: Perform a local commit on the active-primary HA peer and then synchronize the HA configuration. **Workaround**: Perform a local commit on the `active-primary` HA peer and then synchronize the HA configuration.
Log in to the Panorama web interface of the active-primary HA peer. 1. [Log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface) of the `active-primary` HA peer.
2. Select **Commit** and **Commit to Panorama**.
Log in to the Panorama web interface of the active-primary HA peer. 3. In the `active-primary` HA peer **Dashboard**, click **Sync to Peer** in the High Availability widget.
Select Commit and Commit to Panorama.
Select Commit and Commit to Panorama.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
In the active-primary HA peer Dashboard, click Sync to Peer in the High Availability widget.
## PAN-207040 ## PAN-207040
@@ -262,41 +313,22 @@ If you disable Advanced Routing, remove logical routers, and downgrade from PAN-
## PAN-206913 ## PAN-206913
When a DHCPv6 client is configured on HA Active/Passive firewalls, releasing the IPv6 address from the client (using Release in the UI or using the request dhcp client ipv6 release all CLI command) releases the IPv6 address from the Active firewall, but not the Passive firewall. When a DHCPv6 client is configured on HA Active/Passive firewalls, releasing the IPv6 address from the client (using Release in the UI or using the `request dhcp client ipv6 release all` CLI command) releases the IPv6 address from the Active firewall, but not the Passive firewall.
## PAN-206909 ## PAN-206909
The Dedicated Log Collector is unable to reconnect to the Panorama management server if the configd process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection Status (PanoramaManaged Collector) displaying connected and the managed colletor Health status displaying as healthy. The Dedicated Log Collector is unable to reconnect to the Panorama management server if the `configd` process crashes. This results in the Dedicated Log Collector losing connectivity to Panorama despite the managed collector connection `Status` (**Panorama** > **Managed Collector**) displaying `connected` and the managed colletor `Health` status displaying as healthy.
This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted. This results in the local Panorama config and system logs not being forwarded to the Dedicated Log Collector. Firewall log forwarding to the disconnected Dedicated Log Collector is not impacted.
Workaround: Restart the mgmtsrvr process on the Dedicated Log Collector. **Workaround:** Restart the `mgmtsrvr` process on the Dedicated Log Collector.
Log in to the Dedicated Log Collector CLI. 1. [Log in to the Dedicated Log Collector CLI](https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-cli).
2. Confirm the Dedicated Log Collector is disconnected from Panorama.
Log in to the Dedicated Log Collector CLI. `admin>``show panorama-status`
Verify the `Connected` status is `no`.
Confirm the Dedicated Log Collector is disconnected from Panorama.admin> show panorama-status Verify the Connected status is no. 3. Restart the `mgmtsrvr` process.
`admin>``debug software restart process management-server`
Confirm the Dedicated Log Collector is disconnected from Panorama.
admin> show panorama-status Verify the Connected status is no.
admin> show panorama-status
admin> show panorama-status
Verify the Connected status is no.
Restart the mgmtsrvr process.admin> debug software restart process management-server
Restart the mgmtsrvr process.
admin> debug software restart process management-server
admin> debug software restart process management-server
admin> debug software restart process management-server
## PAN-197588 ## PAN-197588
@@ -308,11 +340,11 @@ The PAN-OS ACC (Application Command Center) does not display a widget detailing
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, the power over Ethernet (PoE) ports do not display a Tag value. In **Network** > **Interface** > **Ethernet**, the power over Ethernet (PoE) ports do not display a **Tag** value.
## PAN-196758 ## PAN-196758
On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you Preview Changes (CommitPush to DevicesEdit Selections or CommitCommit and PushEdit Selections). On the Panorama management server, pushing a configuration change to firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP configurations for SD-WAN as being edited or deleted despite no edits or deletions being made when you **Preview Changes** (**Commit** > **Push to Devices** > **Edit Selections** or **Commit** > **Commit and Push** > **Edit Selections**).
## PAN-195968 ## PAN-195968
@@ -328,23 +360,23 @@ When using the CLI to configure power over Ethernet (PoE) on a non-PoE port, the
PA-1400 Series firewalls only PA-1400 Series firewalls only
``` ```
In NetworkInterfaceEthernet, hovering the mouse over a power over Ethernet (PoE) Link State icon does not display link speed and link duplex details. In **Network** > **Interface** > **Ethernet**, hovering the mouse over a power over Ethernet (PoE) **Link State** icon does not display link speed and link duplex details.
## PAN-187685 ## PAN-187685
On the Panorama management server, the Template Status displays no synchronization status (PanoramaManaged DevicesSummary) after a bootstrapped firewall is successfully added to Panorama. On the Panorama management server, the Template Status displays no synchronization status (**Panorama** > **Managed Devices** > **Summary**) after a bootstrapped firewall is successfully added to Panorama.
Workaround: After the bootstrapped firewall is successfully added to Panorama, log in to the Panorama web interface and select CommitPush to Devices. **Workaround:** After the bootstrapped firewall is successfully added to Panorama, [log in to the Panorama web interface](https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-panorama-web-interface.html) and select **Commit** > **Push to Devices**.
## PAN-187407 ## PAN-187407
The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to Hold client request for category lookup and the action set to Reset-Both and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed. The configured Advanced Threat Prevention inline cloud analysis action for a given model might not be honored under the following condition: If the firewall is set to **Hold client request for category lookup**and the action set to **Reset-Both** and the URL cache has been cleared, the first request for inline cloud analysis will be bypassed.
## PAN-186283 ## PAN-186283
Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS. Templates appear out-of-sync on Panorama after successfully deploying the CFT stack using the Panorama plugin for AWS.
Workaround: Use CommitPush to Devices to synchronize the templates. **Workaround**: Use **Commit** > **Push to Devices** to synchronize the templates.
## PAN-184708 ## PAN-184708
@@ -352,29 +384,24 @@ Workaround: Use CommitPush to Devices to synchronize the templates.
Panorama managed firewalls Panorama managed firewalls
``` ```
Scheduled report emails (MonitorPDF ReportsEmail Scheduler) are not emailed if: Scheduled report emails (**Monitor** > **PDF Reports** > **Email Scheduler**) are not emailed if:
A scheduled report email contains a Report Group (MonitorPDF ReportsReport Group) which includes a SaaS Application Usage report. - A scheduled report email contains a Report Group (**Monitor** > **PDF Reports** > **Report Group**) which includes a SaaS Application Usage report.
- A scheduled report contains only a SaaS Application Usage Report.
A scheduled report contains only a SaaS Application Usage Report. **Workaround:** To receive a scheduled report email for all other PDF report types:
Workaround: To receive a scheduled report email for all other PDF report types: 1. Select **Monitor** > **PDF Reports** > **Report Groups** and remove all SaaS Application Usage reports from all Report Groups.
2. Select **Monitor** > **PDF Reports** > **Email Scheduler** and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select **Disable** and click **OK**.
Select MonitorPDF ReportsReport Groups and remove all SaaS Application Usage reports from all Report Groups. Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
3. **Commit**.
Select MonitorPDF ReportsEmail Scheduler and edit the scheduled report email that contains only a SaaS Application Usage report. For the Recurrence, select Disable and click OK.Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report. () Select **Commit** > **Commit and Push**
Repeat this step for all scheduled report emails that contain only a SaaS Application Usage report.
Commit.() Select CommitCommit and Push
() Select CommitCommit and Push
## PAN-184406 ## PAN-184406
Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash. Using the CLI to add a RAID disk pair to an M-700 appliance causes the dmdb process to crash.
Workaround: Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance. **Workaround:** Contact customer support to stop the dmdb process before adding a RAID disk pair to a M-700 appliance.
## PAN-183404 ## PAN-183404
web/data/products.json
+3 -1
View File
@@ -83,7 +83,8 @@
"11.2.7.md", "11.2.7.md",
"11.2.8.md", "11.2.8.md",
"11.2.9.md", "11.2.9.md",
"11.2.10.md" "11.2.10.md",
"11.2.11.md"
] ]
}, },
"11.1": { "11.1": {
@@ -144,6 +145,7 @@
"11.1.6-h22.md", "11.1.6-h22.md",
"11.1.6-h23.md", "11.1.6-h23.md",
"11.1.6-h25.md", "11.1.6-h25.md",
"11.1.6-h29.md",
"11.1.7.md", "11.1.7.md",
"11.1.7-h1.md", "11.1.7-h1.md",
"11.1.7-h2.md", "11.1.7-h2.md",