|
PAN-308507
|
Strata Logging Service (SLS) log-forwarding streams intermittently
show as inactive. When checking the status of log-forwarding
connections, one or more streams are reported as inactive. Restarting
the log-receiver process temporarily
resolves the issue, but the streams become inactive again after
approximately 1-2 hours. This intermittent inactivity results in log
loss.
|
|
PAN-304756
|
After you disable the shared optimization feature in Panorama, ensure
that you perform a full configuration push to all managed multi-vsys
devices to re-establish a baseline. Failure to include every device
group associated with the multi-vsys device during this push may
result in incomplete or inconsistent configurations across virtual
systems.
|
|
PAN-301801
|
On Log Collectors, the Elasticsearch process might fluctuate between
green and red states, causing log collection interruptions. This issue
occurs when the number of shards exceeds the supported threshold of
1,000 shards per Elasticsearch instance.
|
|
PAN-298505
|
After upgrading multi-vsys firewalls, the sequence of the virtual
system IDs (vsys ID) changes causing auto-commit failures with
validation errors. This occurs when the multi-vsys firewall has
virtual systems managed by Panorama, and the vsys ID sequence breaks
when unused virtual systems are deleted and the changes are pushed to
the firewall.
|
|
PAN-296752
|
The PA-1410 firewalls experience a spike in the management plane CPU
utilization when the monitor-dp process attempts to retrieve the power
cycle count from the NVMe drive’s SMART data. This condition leads to
repeated reboots of the device, requiring a hard reset for recovery.
|
|
PAN-295803
|
A configd memory leak occurs post
commit (during Panorama connectivity check), potentially leading to
OOM (out of memory condition) and device reboot.
|
|
PAN-294179
|
On the Panorama Config Audit page,
some commit versions might display incorrect or missing data. Fields
such as, COMMITTED BY,
COMMIT DATE, and
OBJECT CHANGES
might not be visible for some commit versions. Sometimes, commit
versions can disappear after a refresh and the commit description field
might display corrupted characters.
|
|
PAN-292344
|
Upgrading to an affected release causes the firewall to reboot
multiple times if the config contains an EDL (External Dynamic List)
that doesn't have an associated certificate profile.
|
|
PAN-291661
|
Upon upgrade, the ElasticSearch health status intermittently
transitions to the Red status for sometime, and then auto-recovers
back to Green. During the Red status periods, the cluster logs are
unavailable. This occurs due to disk write operations being
excessively slow, failing to meet the minimum time threshold required
to save the cluster state.
|
|
|
An active firewall might unexpectedly reboot due to a
pan_task crash caused by a page
allocation failure. This issue is observed after a period of runtime
with traffic and telemetry collection.
|
|
|
The scheduled vulnerability reports that are configured to be sent via
email with multiple attachments send the first attached report only. The
remaining attachments are dropped.
|
|
PAN-290088
|
When pushing configurations from Panorama to a firewall, a memory leak
might occur in the firewall's
configd process, particularly when the
configurations contain shared policies. Each configuration push causes
the configd process to consume
additional memory that is not released after the commit completes.
|
|
PAN-287871
|
When SSL Inbound Inspection is enabled and the firewall receives
fragmented Client Hello packets that include the TCP timestamp option,
the Client Hello message is forwarded to the destination server
without the timestamp option.
|
|
PAN-286231
|
When performing a partial Commit and Push on
Panorama, there is a risk that unintended configuration changes might
be pushed to a firewall.
This issue is more likely to occur in the following scenarios:
-
When you run Commit and Push operations as a
single action.
-
When you trigger multiple parallel commit-all jobs at the same
time.
-
Device groups and templates have different configuration
synchronization versions.
Workaround: Perform one of the following steps:
-
Perform commit and push as two separate, sequential steps.
- Perform a full push instead of selective push.
|
|
PAN-283429
|
When you use custom certificates for the connection between Panorama
and a log collector, the automated renewal for the predefined
ElasticSearch certificates gets disrupted.
Workaround: Remove the custom certificates before
the ElasticSearch certificates expire. This allows the system to
correctly identify and renew the predefined ElasticSearch
certificates. After the renewal is complete, re-install the custom
certificates.
|
|
PAN-281885
|
When exporting and importing the CSV file, the hash values of
pre-shared key (PSK) variables set at template and template stack
levels inconsistently change, resulting in both variables displaying
the same hash value.
|
|
PAN-280471
|
When applying filters or searching for logs in the
section, you might experience slow performance.
|
|
PAN-279746
|
An SSL/TLS Client Hello may not be transmitted out of the firewall if
the Client Hello arrives in multiple TCP segments and the traffic is
not subject to SSL decryption (for example, SMTP over SSL).
|
|
PAN-279415
|
Service routes configured for a data plane interface might incorrectly
route traffic through the management plane interface instead. This
issue impacts Syslog and CRL status traffic when the service route
lacks a specific destination custom service route.
|
|
PAN-277034
|
WildFire reports might not fully display or be downloadable because some
static resources fail to load.
|
|
PAN-275601
|
When Panorama is not internet-connected and you try to upload images
to the managed firewalls by using the
Validate option, the upload fails
with the following error:
Failed to create multi-upload job. No valid software deploy targets
found.
|
|
PAN-273300
|
When upgrading Panorama from PAN-OS 10.2 or PAN-OS 11.0 to PAN-OS 11.1
or a later release, Panorama fails to upgrade if it is operating
within a Collector Group. The following error appears:Error: Traceback (most recent call last):File
"/opt/panrepo/releases/<PANOS release version>/validate"...
(min ([dts['min'] for dts in 10g_type_intv_dir.values() if
dts|'min']])-strftime ('%Y-%m-%d'),
|
|
PAN-260851
|
From the NGFW or Panorama CLI, you can override the existing
application tag even if Disable Override is enabled for the
application () tag.
|
|
PAN-260212
|
When viewing Applications (), child App-IDs may be listed under the incorrect container App-ID.
|
|
PAN-259853
|
When the DHCP server is enabled for GlobalProtect, the commit error
message is not properly displayed when
Any is selected as the source
interface in the service router configuration (
).
|
|
PAN-259423
|
When the GlobalProtect DHCP feature is enabled with two primary DHCP
servers on the GlobalProtect gateway, the gpsvc gets stuck during
renewal and after HA failover.
|
|
PAN-254108
|
when upgrading or downgrading a Panorama management server (), managed device (), or standalone firewall (), Base Releases and
Preferred Releases settings are
checked (enabled) by default and cause no PAN-OS software images to
display.
Workaround: Uncheck (disable)
Base Releases or
Preferred Releases to display either
the available base PAN-OS or preferred PAN-OS releases available to
download and install.
|
|
PAN-253963
|
The auto commit job may take longer than expected to complete when the
Panorama management server is in Panorama or Log Collector mode.
|
|
PAN-250062
|
Device telemetry might fail at configured intervals due to bundle
generation issues.
|
|
PAN-248836
|
The Advanced DNS Security trial license and trial license information
cannot be activated and viewed, respectively, on a managed firewall
(with expired or active status) from Panorama. These tasks can only be
performed on the firewall.
|
|
PAN-239612
|
When the firewall is running PAN-OS 11.2.0 and Advanced Routing is
enabled, DHCPv4 relay agent functions successfully, but DHCPv6 relay
agent doesn't work.
|
|
PAN-236649
|
If you change the configuration of a firewall acting as a PPPoEv4 or
PPPoEv6 client, old routes from the Forwarding Information Base (FIB)
and route table for an inherited configuration with dynamic-identifier
or client remain visible. Old routes also remain visible for an
inherited interface when you execute the CLI command,
show interface all.
Workaround: Unconfigure and configure the
Inherited Interface.
|
|
PAN-206909
|
The Dedicated Log Collector is unable to reconnect to the Panorama
management server if the configd
process crashes. This results in the Dedicated Log Collector losing
connectivity to Panorama despite the managed collector connection
Status () displaying connected and the
managed colletor Health status
displaying as healthy.
This results in the local Panorama config and system logs not being
forwarded to the Dedicated Log Collector. Firewall log forwarding to
the disconnected Dedicated Log Collector is not impacted.
Workaround: Restart the
mgmtsrvr process on the Dedicated
Log Collector.
-
-
Confirm the Dedicated Log Collector is disconnected from Panorama.
admin> show panorama-status
Verify the Connected status
is no.
-
Restart the mgmtsrvr process.
admin> debug software restart process management-server
|
|
PAN-197588
|
The PAN-OS ACC (Application Command Center) does not display a widget
detailing statistics and data associated with vulnerability exploits
that have been detected using inline cloud analysis.
|
|
PAN-197419
|
(PA-1400 Series firewalls only) In
, the power over Ethernet (PoE) ports do not display a
Tag value.
|
|
PAN-196758
|
On the Panorama management server, pushing a configuration change to
firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP
configurations for SD-WAN as being edited or deleted despite no edits
or deletions being made when you
Preview Changes (
or
).
|
|
PAN-195968
|
(PA-1400 Series firewalls only) When using the
CLI to configure power over Ethernet (PoE) on a non-PoE port, the CLI
prints an error depending on whether an interface type was selected on
the non-PoE port or not. If an interface type, such as tap, Layer 2,
or virtual wire, was selected before PoE was configured, the error
message will not include the interface name (eg. ethernet1/4). If an
interface type was not selected before PoE was configured, the error
message will include the interface name.
|
|
PAN-187685
|
On the Panorama management server, the Template Status displays no
synchronization status () after a bootstrapped firewall is successfully added to Panorama.
|
|
PAN-187407
|
The configured Advanced Threat Prevention inline cloud analysis action
for a given model might not be honored under the following condition:
If the firewall is set to
Hold client request for category lookup and the action set to
Reset-Both and the URL cache has
been cleared, the first request for inline cloud analysis will be
bypassed.
|
|
PAN-184406
|
Using the CLI to add a RAID disk pair to an M-700 appliance causes the
dmdb process to crash.
Workaround: Contact customer support to stop the
dmdb process before adding a RAID disk pair to a M-700 appliance.
|
|
PAN-183404
|
Static IP addresses are not recognized when "and" operators are used
with IP CIDR range.
|
|
PAN-181933
|
If you use multiple log forwarding cards (LFCs) on the PA-7000 series,
all of the cards may not receive all of the updates and the mappings
for the clients may become out of sync, which causes the firewall to
not correctly populate the Source User column in the session logs.
|