--- type: Addressed product: PAN-OS version: 8.1.6 --- ## WF500-4901 Fixed an issue where files sent by Traps™ to WildFire® were referenced for trusted signers in the incorrect database, which resulted in a malicious file verdict and caused conflicting post detection events. ## WF500-4893 ```caveat RADIUS server profile configurations only ``` Fixed an issue where the RADIUS authentication protocol was incorrectly changed to CHAP authentication when you pushed a commit from a Panorama™ appliance running a PAN-OS® 8.1 release to a WF-500 appliance running a PAN-OS 8.0 release. ## WF500-4869 Fixed an issue on a WF-500 appliance where the sample analysis failed when using FIPS-CC mode. ## WF500-4815 Fixed an intermittent issue on WF-500 appliances where the Redis command line interface (CLI) failed to execute during master node re-balancing. ## WF500-4747 Fixed an issue on a WF-500 appliance where the Panorama™ management server ran unrelated Logging Service threads. ## WF500-4636 ```caveat WF-500 Appliances only ``` Fixed a rare issue that occurred after upgrading from a PAN-OS 8.0 release to a PAN-OS 8.1 release where the disk partition became full due to the amount of data on the drive and, when you tried to delete the backup database to free up space, the `debug wildfire reset backup-database-for-old-samples` CLI command failed and resulted in the following error: `Server error : Client wf_devsrvr not ready.` ## PAN-111305 Fixed an issue where you were unable to reference certificate profiles from the External Dynamic Lists (**Objects** > **External Dynamic Lists** > **Add** > **Create List**) but instead, you had to type in the certificate profile. ## PAN-110448 Fixed an issue on PA-3200 Series firewalls where the dataplane took longer than expected to respond or intermittently stopped responding after a firewall reboot. ## PAN-109594 Fixed an issue where the dataplane restarted when an IPsec rekey event occurred and caused a tunnel process (tund) failure when one--but not both--HA peer is running PAN-OS 8.0.14 or PAN-OS 8.1.5. ## PAN-109124 A security-related fix was made to address an issue where you were unable to retrieve GlobalProtect™ cloud service threat packet captures from the Logging Service on Panorama M-Series and virtual appliances. ## PAN-108785 Fixed an intermittent issue on a firewall in an HA active/passive configuration where a ping test stopped responding on Ethernet 1/1, 1/2, and 1/4 due to input errors on the corresponding switch port after an HA failover. ## PAN-108241 Fixed an issue on a PA-3200 Series firewall where multiple dataplane processes (all_pktproc, flow_mgmt, flow_ctrl, and pktlog_forwarding) stopped responding when overloaded with traffic. ## PAN-108165 Fixed memory issues on Palo Alto Networks hardware and virtual appliances that caused intermittent management plane instability. ## PAN-108161 Fixed an issue on an HA active/passive configuration where GTP sessions did not properly sync to the passive firewall, which caused a failure on the passive firewall during a failover. ## PAN-107895 Fixed an issue where PDP Delete Response packet did not match the GTPv1-C tunnel session, which caused the generated GTP log to display incorrect session data. ## PAN-107893 Fixed an issue where a **Delete PDP Context Response** (**Monitor** > **Logs** > **GTP**) did not correlate with a **Delete PDP Context Request** and appeared as a new session. ## PAN-107790 Fixed an issue where Application incorrectly displayed as `unknown-udp` instead of `gtp-c` for the **GTPv1-C tunnel management message** GTP Event Type. ## PAN-107734 Fixed an intermittent issue where IPSec Tunnels failed due to a race condition between the (pan_task) process and (tund) process. ## PAN-107694 Fixed an issue on Panorama M-Series and virtual appliances where after you selected **Allow with Ticket** (**Networks** > **GlobalProtect** > **Portals ** > **App**) the web interface **Generate Ticket** did not display. ## PAN-107290 Fixed an issue where a single API call failed to locate a Device Group node and create a device node for the Device Group when necessary. ## PAN-107262 A security-related fix was made to prevent cross-site scripting (XSS) attacks through the PAN-OS Management Web Interface (CVE-2019-1566). ## PAN-106947 Fixed an intermittent issue where a large number of out-of-order TCP packets caused packet buffer depletion. ## PAN-106776 A security-related fix was made to prevent a cross-site scripting (XSS) vulnerability in PAN-OS External Dynamic Lists (CVE-2019-1565). ## PAN-106759 Fixed an issue in an HA active/passive configuration where a process (configd) restarted due to a memory error. ## PAN-106253 Fixed an issue where the GTP Message Type **Modify Bearer Response** and GTP Event Code **124223** were denied due to failed stateful inspections. ## PAN-106251 Fixed an issue where the list of Panorama Managed Devices did not display (**Panorama** > **Device** > **Deployment** > **Licenses**). ## PAN-105928 Fixed an issue on a firewall where server side data packets dropped after a terminated challenge ACK session was reused. ## PAN-105759 Fixed an issue on PA-3200 Series and PA-5200 Series firewalls in an HA active/active configuration where the SNMP notification did not report the HA interfaces. ## PAN-105570 ```caveat PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls only ``` Fixed an issue where the QoS profile rule did not match non-offloaded traffic as expected. ## PAN-105567 Fixed an intermittent issue on Panorama M-Series and virtual appliances where a cloned security or NAT policy used the incorrect **Rule order**. ## PAN-105348 Fixed an issue on Panorama M-Series and virtual appliances where Dynamic Updates (**Device** > **Dynamic Updates**) did not allow local overrides on an existing template. ## PAN-105281 ```caveat PAN-OS 8.1.6 and later ``` Fixed an issue where a SAML based GlobalProtect re-authentication portal displayed an authentication error after you have previously logged in. ## PAN-105157 Fixed an intermittent issue on Panaoram M-Series and virtual appliances where logs did not display due to a file descriptor limit by the process (Elasticsearch). ## PAN-105103 Fixed an intermittent issue where GTP logs did not display due to GTP packets with an APN > 14 bytes caused the traffic log to reach the limit and stopped generating logs. ## PAN-105012 Fixed an issue on Panorama M-Series and virtual appliances where a log migration from an old-disk pair to a new-disk pair failed with the following error message: `Error restoring disks from RMAed device`, which caused the (configd) process to fail. ## PAN-104463 Fixed an intermittent issue where the DNS resolution stopped responding when the firewall acted as a DNS proxy and the DNS request volume was higher than expected. ## PAN-104361 Fixed an issue on a firewall in an HA active/passive configuration where a process (all_task) failed due to a (bad_gtp_header) code on the passive firewall after upgrading from PAN-OS 8.0.12. ## PAN-104300 Fixed an issue on a firewall where a process (mprelay) stopped responding while the (`> debug dataplane internal pdt`) command was processed. ## PAN-104165 Fixed an issue on a VM-Series firewall configured to use the i40e single-root input/output virtualization (SR-IOV) virtual function (VF) with VLAN tagging dropped Ethernet frames exceeding 1496 bytes. ## PAN-104077 Fixed an intermittent issue where User-ID™ stopped responding, which caused the user IP mapping to not display. ## PAN-104042 Fixed an issue where directly connected IPv4 routes do not display in the routing table after the firewall was restarted. ## PAN-104041 Fixed an issue where the web interface management session failed to time out as expected when you set the **Idle Timeout** (**Device** > **Setup** > **Management** > **Authentication Settings** > **Edit**) to more than five minutes. ## PAN-103665 Fixed an issue on an HA active/active configuration where the active primary LLDP profile could not be copied to the active secondary firewall. ## PAN-103224 Fixed an issue on a VM-Series firewall where the initialization buffer caused the firewall to stop responding when five or more interfaces were active. ## PAN-102954 A security-related fix was made to address a code parameter in the clientless VPN portal. ## PAN-102625 Fixed an issue on a firewall where traffic stopped passing due to higher than normal duplicate TCP ACK packets sent from the client side, which caused a spike in packet buffers and packet descriptor usage. ## PAN-102338 Fixed an issue where you were unable to configure **Maximum Egress** (**Network** > **QoS**) to 10000 Mbps on a 10000 Mbps port. ## PAN-101990 Fixed an issue on Panorama M-Series and virtual appliances in an HA active/passive configuration where you were unable to edit the template variables (**Panorama** > **Summary**). ## PAN-101973 Fixed an issue where you were unable to configure IPv6 variables (**Network** > **Virtual Routers** > **Add** > **Static** > **Routes** > **IPv6**). ## PAN-101882 Fixed an issue on Panorama M-Series and virtual appliances where a partial Commit and Push for one or more administrators incorrectly sets the Push scope to all relevant firewalls as if a full Commit and Push was performed. ## PAN-101851 Fixed an intermittent issue on PAN-OS 8.1.3 and later releases, where downloading files from email services were allowed when the file blocking profile was configured to block email service file downloads. ## PAN-101800 Fixed an issue where the parent session stopped responding during a file transfer using a decryption enabled FTP server with the following error message: `Lost connection`. ## PAN-101692 Fixed an issue where the (`show session all filter nat-rule`) command did not respond with destination NAT rules. ## PAN-101684 Fixed an issue on Panorama M-Series and virtual appliances where adding a threat exception for a child Device Group caused existing rules to be removed from the Global Device Group. ## PAN-101614 Fixed an issue on a firewall where SSL/TLS Service Profile (**Device** > **SSL/TLS Service Profile**) values failed to change after an override. ## PAN-101607 Fixed an issue where template administrators with the required permission made configuration changes on shared objects and the Commit failed with the following error message: `No pending change to commit`. ## PAN-101401 Fixed an issue where a DNS App-ID™ security policy allowed non-DNS traffic to flow through. ## PAN-101202 Fixed an issue on a firewall where the TFC padding parameter was set to **null** when negotiating with a peer device capable of TFC padding during IKEv2 negotiations. ## PAN-101185 Fixed an issue on Panorama M-Series and virtual appliances where the Decrypt Mirror (**Network** > **Interfaces** > **Ethernet** > **Interface Type**) template setting did not Push to a firewall. ## PAN-101031 Fixed an issue where you were unable to select existing certificates after you created an IKE gateway on a template stack and changed Authentication to Certificate. ## PAN-101029 Fixed an issue where routing traffic dropped due to an increased activity in global counter (`flow_fpga_rcv_egr_L3_NH_NF`) when an interface is moved from one virtual router to another. ## PAN-100962 Fixed an issue on Panorama M-Series and virtual appliances where the disk quota configuration exceeded a combined total of 100 percent when a Push was performed from Panorama due to value discrepancies between Panorama and the firewall. ## PAN-100717 Fixed an issue where the (configd) process depleted memory when you deleted multiple security rules with an XML API call. ## PAN-100623 Fixed an issue on a firewall in an HA active/passive configuration where a higher than normal rate of HA session update messages caused higher than normal CPU usage on both active and passive nodes. ## PAN-100381 Fixed an issue on a firewall in an HA configuration where a path monitoring variable was not available for Destination IP (**Device** > **High Availability** > **Link and Path Monitoring** > **Add Virtual Router Path**). ## PAN-100173 Fixed an issue where H.323 based calls had audio issues due to the predicted RTP session not following the policy-based forwarding (PBF) rules that sends traffic from the client to servers, which caused RTP traffic to be forwarded incorrectly by route. ## PAN-99924 Fixed an issue where the Panorama management server web and CLI stopped responding after a partial configuration load (**Panorama** > **Setup** > **Operations**). ## PAN-99764 Fixed an issue on VM-Series firewalls where CPU calculations for additional vCPUs in the dataplane did not display correctly. ## PAN-99742 Fixed an issue on a PA-500 Series firewall where SSL Forward Proxy was denied due to insufficient shared memory. ## PAN-99621 Fixed an issue on a firewall where Captive Portal sessions matched incorrect policies and were incorrectly logged in the traffic log. ## PAN-99504 Fixed an issue on a firewall where Group Mapping (**Device** > **User Identification** > **Group Mapping Settings**) did not display the list of LDAP server profile users when a Domino server with an empty distinguished name (DN) was used. ## PAN-99079 Fixed an issue on Panorama M-Series and virtual appliances where Logging Service was enabled, traffic log filters with a variable length subnet mask did not display any logs. ## PAN-99058 Fixed an issue where threat log messages (`SCAN: UDP Port Scan`) appeared when the UDP port scan traffic rate was less than the Reconnaissance Protection UDP port scan threshold. ## PAN-99002 Fixed a rare issue where XML files with random file sizes failed to upload through API calls. ## PAN-99000 Fixed an issue where the packet capture option did not display (**Monitor** > **Traffic**) when administrators switched context from Panorama to a managed firewall. ## PAN-98861 Fixed an issue where shadowed rule warnings did not display during commits. ## PAN-98811 Fixed an issue on Panorama M-Series and virtual appliances where Group Mapping Settings (**Object** > **Security Profile** > **URL Filtering** > **User Credential Detection**) did not display profile names. ## PAN-98786 Fixed an issue where websites were not accessible when you configured a decryption policy Action to **No Decrypt** and enabled **Block sessions with expired certificates**. ## PAN-98625 Fixed an issue where the Threat Category (**Monitor** > **Threat**) did not display as expected on Panorama M-Series and virtual appliances when it received logs from PA-200, PA-220, PA-500, and PA-800 Series firewalls. ## PAN-97898 Fixed a rare issue where the traffic log did not generate data due to a negative log counter reading. ## PAN-97743 Fixed an issue where the firewall did not recognize the small form-factor pluggable (SFP) port, which caused the dataplane to restart when the path monitor process stopped responding. To ensure a successful upgrade to PAN-OS 8.1.6 for this fix, re-seat all connected SFP transceivers and then follow the [upgrade path](https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-new-features/upgrade-to-pan-os-81/upgrade-the-firewall-to-pan-os-81/determine-pan-os-upgrade-path.html) described in the PAN-OS 8.1 upgrade procedure ([PAN-OS 8.1 New Features Guide](https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-new-features.html)). ## PAN-97672 Fixed an issue where polled SNMP object identifiers (OID) stopped responding after the firewall was restarted. ## PAN-97670 Fixed an issue on a VM-Series firewall in an HA active/passive configuration where after a reboot, the passive firewall sent ARP packets during the initialization state, which caused a traffic conflict with the active firewall. ## PAN-97496 Fixed an issue on a firewall where the (`show running resource-monitor ingress-backlogs`) CLI command displayed invalid session IDs. ## PAN-97298 ```caveat PAN-OS 8.1.1 and later releases only ``` Fixed an issue where **Address Groups** (**Objects** > **Address Groups**) search results were cleared from the web interface when you switched between tabs. ## PAN-97223 Fixed an issue where an administrator with superuser access was unable to remove a configuration lock from a logged out administrator whose username contained a backslash (" \ "). ## PAN-97139 Fixed an issue where the GlobalProtect Data File (**Device** > **Dynamic Updates** > **GlobalProtect data File**) version did not update after a PAN-OS 8.1 upgrade. ## PAN-95975 Fixed an issue on a firewall in an HA active/passive configuration where the scheduled antivirus content update failed due to a process (mgmtsrvr) failure. ## PAN-95121 Fixed an issue where applications gets disabled after you enabled them during the install or revert of application and threat signatures. ## PAN-93112 Fixed an issue on a PA-5200 Series firewall where small form-factor pluggable (SFP) ports only linked in auto negotiation mode. ## PAN-91059 Fixed an issue where GTP log query filters did not work when you filtered based on a value of **unknown** for the message type or GTP interface fields (**Monitor** > **Logs** > **GTP**). ## PAN-90096 Fixed an issue where Threat logs recorded incorrect IMSI values for GTP packets when you enabled **Packet Capture** in Vulnerability Protection profiles (**Objects** > **Security Profiles** > **Vulnerability Protection** > **** > **Rules**). ## PAN-88461 Fixed an issue on PA-3050 and PA-3060 firewalls in an HA active/passive configuration with link state pass-through enabled in virtual wire (vwire) where the Aggregate Ethernet (AE) interface communication failed during an HA failover event. ## PAN-84292 Fixed an issue on a firewall where the (`show system state browser`) command window displayed live traffic values toggle between zero and other incorrect values.