--- type: Addressed product: PAN-OS version: 9.1.8 --- ## PAN-161121 Fixed an issue on the Panorama management server that caused invalid reference errors when attempting to delete an address object (**Objects > Addresses**) after removing the address object reference from an address group (**Objects > Address Groups**) resulting in you being unable commit and push the configuration to managed firewalls. ## PAN-160376 Fixed an issue where, for local administrators using an authentication profile, the **save filter** (**Monitor > Logs**) option was grayed out. ## PAN-158650 Fixed an issue where several operations and processes stopped responding due to a deadlock issue between the CLI thread and the Terminal Server (TS) agent message processing the thread. ## PAN-158638 Fixed an issue where the firewall returned the following error message when attempting to request a device certificate using a one-time password (OTP): invalid ocsp response sig-alg. ## PAN-158293 Fixed an issue where a sudden increase in packet buffer descriptors disrupted traffic. ## PAN-158122 Fixed an issue where SNMP readings reported 0 for dataplane interface packet statistics when using PacketMMAP mode. This issue occurred because the physical port counters read from MAC addresses were reported as 0. ## PAN-157786 Fixed an issue where the **Device > Setup** page was blank after downgrading from a PAN-OS 10.0 release to a PAN-OS 9.1 release. ## PAN-157319 ```caveat PA-7000 Series firewalls with Log Forwarding Cards (LFCs) only ``` Fixed an issue where GlobalProtect logs showed the incorrect client version and did not show event ID information. ## PAN-157168 Fixed an issue where a process (mprelay) stopped responding when displaying debug PDT commands ## PAN-157049 ```caveat PA-3200 Series firewalls only ``` Fixed an issue where the firewall processed internal path monitoring packets more slowly than expected when processing large amounts of traffic, which caused the dataplane to restart. ## PAN-156891 Fixed an issue where some zip files did not download and the following error message displayed: resources-unavailable. ## PAN-156716 Fixed an issue where the firewall sent ARP replies without checking the ingress interface when the requested IP address was configured as a destination NAT (DNAT) address. ## PAN-155665 Fixed an issue where, if an authentication profile was configured with an authorization type of **none**, users were inappropriately prompted for a password. Since the authentication type was set to **none**, any input was successful. This issue occurred when **Allow Authentication with User Credentials OR Client Certificate** was set to **no**. ## PAN-155326 Fixed an issue where the BGP **AS Number** template variable was not referenceable from the web interface. ## PAN-155294 Fixed an issue where iPad devices did not display Captive Portal multi-factor authentication (MFA) pages correctly when using Okta for push notifications. ## PAN-155124 Fixed an issue where IP address-to-username mapping did not correctly sync to the secondary active firewall in an active/active HA configuration if a logout and a log in event occurred within the same second. ## PAN-154899 Fixed an out-of-memory (OOM) issue on the firewalls that caused LACP, BGP, and OSPF to go down, resulting in the firewall not receiving LACPDU messages. ## PAN-154844 Fixed an issue where commits and autocommits repeatedly failed due to an OOM condition that disrupted the processes pan_task and devsrvr. ## PAN-154812 Fixed a memory leak issue related to a process (configd) that was caused by log queries filtering by address. ## PAN-154591 Fixed an issue where NULL users in panGlobalProtectGetConfig were not checked for before calling strcmp(). ## PAN-154391 Fixed an issue where a Log Collector did not forward correlation logs to the syslog server over TCP. ## PAN-154365 Fixed an issue where Security policy rules targeted by tags incorrectly displayed as deleted when previewing commit changes. ## PAN-153814 Fixed an issue where the firewall displayed the URL Filtering Safe Search Block Page on the specific site only, even when the traffic was matched to a specific rule that did not have any URL filtering policies. ## PAN-153705 Fixed an issue where packets were not evenly distributed among a process (pan_tasks), which caused latency and poor performance. ## PAN-153631 Fixed an issue where the firewalls did not generate traffic logs for implicitly allowed applications. ## PAN-153614 Fixed an issue where user-based policies did not correctly match if the same user was included in both a policy with the username in NetBIOS format and another policy with the username in FQDN format. ## PAN-153294 Fixed an issue on the firewall where a GlobalProtect username authenticated via Kerberos was unnecessarily normalized to SAMAccountName format. ## PAN-153261 Fixed an issue where not all fragmented packets were transmitted, which caused increased packet buffer usage. ## PAN-152998 Fixed an issue where the User-ID process CPU usage remained high when a large number of Terminal Server (TS) agents were configured but only a few were connected. ## PAN-152813 Fixed an issue with configuration memory leaks on Panorama that caused a process (configd) to restart. ## PAN-152677 ```caveat VM-Series firewalls on Azure only ``` Fixed an issue where packet buffers showed high values when Data Plane Development Kit (DPDK) was enabled. ## PAN-152648 Fixed an issue where multiple all_pktproc processes stopped responding, which caused the dataplane to restart. ## PAN-152103 Fixed a memory leak issue where a process (dnsproxy) did not properly release memory after use. ## PAN-151997 Fixed an issue where the option to sinkhole was not displayed in the ACC filter drop-down (**ACC > Threat Activity > Global filters > Action**). ## PAN-151888 Fixed an issue where remote users were able to save log filters, which created a local user with the same username. With this fix, remote users cannot save a log filter. ## PAN-151808 Fixed an issue where an EDL refresh job did not complete when the configuration for EDL servers used certificate profiles, due to the large server certificates. ## PAN-151803 Fixed an issue on Panorama where commits failed when using device-id as a template variable. ## PAN-151503 Fixed an intermittent issue where memory was not fully freed after a Panorama commitAll completion on the firewall. ## PAN-151218 ```caveat PA-3200 Series firewalls only ``` Fixed an issue where the crashinfo file was not generated after a process (all_pktproc) stopped responding on the dataplane before path monitoring triggered a device reboot. ## PAN-150867 An enhancement was made to enable additional logging during kernel panic/oops that helps identify the cause. ## PAN-150798 ```caveat PA-7000 Series firewalls only ``` Fixed an issue where Network Processing Cards (NPC) took longer than expected or failed to boot. ## PAN-150534 Fixed an issue where authentication logs with the subtype SAML were not forwarded to the syslog server. ## PAN-150467 Fixed a memory leak issue with a unified query that caused a process (mprelay) to restart due to an OOM condition. ## PAN-150085 Fixed an issue where a process (configd) stopped responding which caused context switches to slow. ## PAN-150008 Fixed an issue on the firewall where configuring auto-tagging based on URL filtering logs resulted in tags being added to source IP addresses and not matching the log forwarding filter match criteria. ## PAN-149283 Fixed an issue where editing device log forwarding in the collector group then filtering specific firewalls and adding new firewalls caused the old firewalls to disappear from the log forwarding preferences list. ## PAN-148800 Fixed an issue where the firewall used port 1080 to reach dns.service.paloaltonetworks.com when web-proxy was configured. ## PAN-148549 Fixed an issue where newly created interface management profiles were unable to be linked to subinterfaces. ## PAN-148359 Fixed an issue where SD-WAN server-to-client symmetric return did not function correctly in certain circumstances. This issue intermittently affected path selection of parent/child applications, such as FTP. ## PAN-147254 jQuery was updated to 3.5.1. ## PAN-147221 Improved QoS scheduling for Bidirectional Forwarding Detection (BFD) and BGP to address the internal handling of BGP and BFD packets under high resource constraints ## PAN-145733 Fixed an issue where the SNMP INDEX for panZoneTable on the PAN-COMMON-MIB.my file did not work as expected, which led to entries in panZoneTable not being uniquely identified. ## PAN-145417 Debug commands were added to address an issue where the firewall connect to Cortex Data Lake due to the Online Certificate Status Protocol (OSCP) message missing the nextUpdate value in the OSCP response. ## PAN-144975 Fixed an intermittent issue where a high traffic load in a Layer 2 deployment caused SNMP and Panorama health monitoring failures. ## PAN-144887 ```caveat Panorama virtual appliances in high availability (HA) configurations with VMware NSX plugin only ``` Fixed an issue where dynamic address group updates and configuration pushes failed when new plugins were installed or uninstalled, or when a process (configd) was restarted or reinitialized. ## PAN-144594 Fixed an issue where web pages failed to launch over clientless VPN when cookies had the expiry value set to 0 in the packet. ## PAN-143485 Fixed a memory leak issue related to a process (devsrvr). ## PAN-141813 Fixed an issue where multiple daemons restarted due to a management plane ARP overflow. ## PAN-140093 ```caveat PA-220 firewalls only ``` Fixed an issue where the master key was unable to be changed. ## PAN-137205 Fixed an issue where **Review Policies** did not show all related policies. ## PAN-136478 ```caveat PA-7000 Series firewalls ``` where syslog forwarding over TCP did not work in a multi-vsys environment. ## PAN-136073 Fixed an issue where the High Speed Chassis Interconnect (HSCI) port flapped continuously after an upgrade or reboot. ## PAN-134461 Fixed an issue where an admin user authenticated to Panorama with RADIUS and assigned a Device Group and Template Admin role using access domains was unable to add a managed firewall to Panorama and received the following error message: Import failed user does not exist. ## PAN-133886 Fixed an issue where GlobalProtect users were unable to connect to mobile gateways when download of a large CRL failed due to timeouts that resulted in CRL check failures. ## PAN-133863 Fixed an issue where the Panorama Virtual Appliance in Log Collector mode went into maintenance mode due to a process (reportd) not responding. ## PAN-132035 Fixed an issue on Panorama appliances in an active/passive high availability configuration where a managed firewall generated high priority alerts that it failed to connect to the passive Panorama appliance's User-ID agent server. This issue occurred because the firewall was only able to connect to one Panorama User-ID server at a time, and it connected only to the active Panorama appliance's User-ID server. ## PAN-131462 Fixed an issue where the title page of PDF reports did not show the entire Palo Alto Networks logo. ## PAN-129927 ```caveat VM-Series firewalls only ``` Fixed an issue where firewalls with Layer 3 subinterfaces reset Class of Service (CoS) bits in 802.1q. ## PAN-120013 Fixed an issue where secure communication settings were incorrectly synchronized between Panorama appliances in an HA configuration. ## PAN-115494 Fixed an issue where the /opt/pancfg/ partition became full due to a configuration preview operation not responding. ## PAN-114351 Fixed an issue where SSL decryption slowed traffic with the TCP timestamp option enabled. ## PAN-113386 Fixed an issue where an address object with a tag that contained a space character inside quotation marks was not properly processed and assigned to the appropriate Dynamic Address Group. ## PAN-110962 Fixed an issue where a process (*all_pktproc*) stopped responding when SSH decryption was enabled, which caused the dataplane to restart. ## PAN-100693 Fixed an issue where you were unable to process Address Group match criteria when the match name included the double quotation ( " ) character.