700 lines
21 KiB
Markdown
700 lines
21 KiB
Markdown
---
|
|
type: Known
|
|
product: PAN-OS
|
|
version: 11.0.1
|
|
---
|
|
|
|
## WF500-5632
|
|
|
|
The number of registered WildFire appliances
|
|
reported in Panorama (PanoramaManaged WildFire AppliancesFirewalls ConnectedView) does not accurately reflect the
|
|
current status of connected WildFire appliances.
|
|
|
|
## PAN-260851
|
|
|
|
From the NGFW or Panorama CLI, you can override the existing
|
|
application tag even if Disable Override is enabled for the
|
|
application (ObjectsApplications) tag.
|
|
|
|
## PAN-250062
|
|
|
|
Device telemetry might fail at configured intervals due to bundle generation issues.
|
|
|
|
## PAN-243951
|
|
|
|
On the Panorama management sever in an active/passive High
|
|
Availability (HA) configuration, managed devices (PanoramaManaged DevicesSummary) display as out-of-sync
|
|
on the passive HA peer when configuration changes are made to the
|
|
SD-WAN (PanoramaSD-WAN) configuration on the active HA peer.
|
|
|
|
Workaround: Manually synchronize the Panorama HA peers.
|
|
|
|
1. Log in to the Panorama web
|
|
interface on the active HA peer.
|
|
2. Select Commit and Commit to
|
|
Panorama the SD-WAN configuration changes on
|
|
the active HA peer.
|
|
On the passive HA peer, select PanoramaManaged DevicesSummary and observe that the managed devices are now
|
|
out-of-sync.
|
|
3. Log in to the primary HA peer Panorama CLI and
|
|
trigger a manual synchronization between the active and
|
|
secondary HA peers.
|
|
request high-availability sync-to-remote
|
|
running-config
|
|
4. Log back in to the active HA peer Panorama web interface and
|
|
select CommitPush to Devices and Push.
|
|
|
|
## PAN-234408
|
|
|
|
Enterprise DLP cannot detect and block non-file based traffic for
|
|
ChatGPT from traffic forwarded to the DLP cloud service from an
|
|
NGFW.
|
|
|
|
## PAN-234015
|
|
|
|
The X-Forwarded-For (XFF) value is not displayed in traffic logs.
|
|
|
|
## PAN-242910
|
|
|
|
On the Panorama management server, Panorama administrators (PanoramaAdministrators) that are assigned a custom Panorama admin role (PanoramaAdmin Roles) with Push All Changes enabled
|
|
are unable to push configuration changes to managed firewalls when
|
|
Managed Devices and Push For
|
|
Other Admins are disabled.
|
|
|
|
## PAN-241041
|
|
|
|
On the Panorama management server exporting template or template
|
|
stack variables (PanoramaTemplates) in CSV format results in an empty CSV file.
|
|
|
|
## PAN-228515
|
|
|
|
The EleasticSearch SSH flaps on the M-600 appliance in Panorama or
|
|
Log Collector mode. This causes logs to not display on the Panorama
|
|
management server (MonitorLogs) and the Log Collector health status (PanoramaManaged CollectorsStatus) to display as degraded.
|
|
|
|
## PAN-228273
|
|
|
|
On the Panorama management server in FIPS-CC mode, the ElasticSearch
|
|
cluster fails to come up and the show
|
|
log-collector-es-cluster health command displays
|
|
the status is
|
|
red. This results in log ingestion
|
|
issues for Panorama in Panorama only or Log Collector mode.
|
|
|
|
## PAN-227344
|
|
|
|
On the Panorama management server, PDF Summary Reports (MonitorPDF ReportsManage PDF Summary) display no data and are blank when predefined
|
|
reports are included in the summary report.
|
|
|
|
## PAN-225886
|
|
|
|
If you enable explicit proxy mode for the web proxy, intermittent
|
|
errors and unexpected TCP reconnections may occur.
|
|
|
|
## PAN-225337
|
|
|
|
On the Panorama management server, the configuration push to a
|
|
multi-vsys firewall fails if you:
|
|
|
|
1. Create a Shared and vsys-specific
|
|
device group configuration object with an indentical name.
|
|
For example, a Shared address object
|
|
called SharedAO1 and a
|
|
vsys-specific address object also called
|
|
SharedAO1.
|
|
2. Reference the Shared object in another
|
|
Shared configuration. For
|
|
example, reference the Shared address
|
|
object (SharedAO1) in a
|
|
Shared address group called
|
|
SharedAG1.
|
|
3. Use the Shared configuration object
|
|
with the reference in a vsys-specific configuration. For
|
|
example, reference the Shared address
|
|
group (SharedAG1) in a
|
|
vsys-specific policy rule.
|
|
|
|
Workaround: Select PanoramaSetupManagement and edit the Panorama Settings to enable one of the
|
|
following:
|
|
|
|
- Shared Unused Address and Service Objects with
|
|
Devices—This options pushes all
|
|
Shared objects, along with device
|
|
group specific objects, to managed firewalls.
|
|
This is a global setting and applies to all managed
|
|
firewalls, and may result in pushing too many configuration
|
|
objects to your managed firewalls.
|
|
- Objects defined in ancestors will take higher
|
|
precedence—This option specifies that in the event
|
|
of objects with the same name, ancestor object take
|
|
precedence over descendent objects. In this case, the
|
|
Shared objects take precedence
|
|
over the vsys-specific object.
|
|
This is a global setting and applies to all managed
|
|
firewalls. In the example above, if the IP address for the
|
|
Shared
|
|
SharedAO1 object was
|
|
10.1.1.1 and the device
|
|
group specific SharedAO1 was
|
|
10.2.2.2, the
|
|
10.1.1.1 IP address takes
|
|
precedence.
|
|
|
|
Alternatively, you can remove the duplicate address objects from the
|
|
device group configuration to allow only the
|
|
Shared objects in your configuration.
|
|
|
|
## PAN-223488
|
|
|
|
Closed ElasticSearch shards are not deleted from the Panorama
|
|
M-Series and virtual appliance. This causes the ElasticSearch shard
|
|
purging to not work as expected, resulting in high disk usage.
|
|
|
|
## PAN-223365
|
|
|
|
The Panorama management server is unable to query any logs if the
|
|
ElasticSearch health status for any Log Collector (PanoramaManaged Collector is degraded.
|
|
|
|
Workaround:
|
|
Log in to the Log Collector
|
|
CLI and restart ElasticSearch.
|
|
|
|
admindebug elasticsearch es-restart all
|
|
|
|
## PAN-222586
|
|
|
|
On PA-5410, PA-5420, PA-5430, and PA-5440 firewalls, the Filter
|
|
dropdown menus, Forward Methods, and Built-In Actions for
|
|
Correlation Log settings (DeviceLog Settings) are not displayed and cannot be configured.
|
|
|
|
## PAN-222253
|
|
|
|
On the Panorama management server, policy rulebase reordering when
|
|
you View Rulebase by Groups (Policy<policy-rulebase>) does not persist if you reorder the policy rulebase
|
|
by dragging and dropping individual policy rules and then moving the
|
|
entire tag group.
|
|
|
|
## PAN-221126
|
|
|
|
Email server profiles (DeviceServer ProfilesEmail and PanoramaServer ProfilesEmail) to forward logs as email notifications are not
|
|
forwarded in a readable format.
|
|
|
|
Workaround: Use a Custom Log Format to
|
|
forward logs as email notifications in a readable format.
|
|
|
|
## PAN-221015
|
|
|
|
On M-600 appliances in Panorama or Log Collector mode, the
|
|
es-1 and
|
|
es-2 ElasticSearch processes fail
|
|
to restart when the M-600 appliance is rebooted. The results in the
|
|
Managed Collector ES health status (PanoramaManaged CollectorsHealth Status) to be degraded.
|
|
|
|
Workaround:
|
|
Log in to the Panorama or Log
|
|
Collector CLI experiencing degraded ElasticSearch health
|
|
and restart all ElasticSearch processes.
|
|
|
|
admin>debug elasticsearch es-restart optional all
|
|
|
|
Code copied to clipboard
|
|
|
|
Unable to copy due to lack of browser support.
|
|
|
|
Copy
|
|
|
|
## PAN-220180
|
|
|
|
Configured botnet reports (MonitorBotnet) are not generated.
|
|
|
|
## PAN-220176
|
|
|
|
```caveat
|
|
PAN-OS 11.0.1-h2 hotfix
|
|
```
|
|
|
|
System process crashes might occur
|
|
with VoIP traffic when NAT is enabled with Persistent Dynamic IP and
|
|
Port settings.
|
|
|
|
## PAN-219644
|
|
|
|
Firewalls forwarding logs to a syslog server over TLS (ObjectsLog Forwarding) use the default Palo Alto Networks certificate
|
|
instead of the custom certificate configured on the firewall.
|
|
|
|
## PAN-218521
|
|
|
|
The ElasticSearch process on the M-600 appliance in Log Collector
|
|
mode may enter a continuous reboot cycle. This results in the M-600
|
|
appliance becoming unresponsive, consuming logging disk space, and
|
|
preventing new log ingestion.
|
|
|
|
## PAN-217307
|
|
|
|
The following Security policy rule (PoliciesSecurity) filters return no results:
|
|
|
|
log-start eq no
|
|
|
|
log-end eq no
|
|
|
|
log-end eq yes
|
|
|
|
## PAN-216821
|
|
|
|
The reportd process crashes after you
|
|
successfully upgrade an M-200 appliance to PAN-OS 10.2.4.
|
|
|
|
## PAN-216314
|
|
|
|
Upon upgrade or downgrade to or from PAN-OS 10.1.9 or 10.1.9-h1,
|
|
offloaded application traffic sessions may disconnect after a period
|
|
of time even if a session is active. The disconnect occurs after the
|
|
application's default session timeout value is exceeded. This
|
|
behavior affects only PAN-OS 10.1.9 and 10.1.9-h1. If you are on
|
|
PAN-OS 10.1.9 and 10.1.9-h1, please use the following workaround. If
|
|
you have already upgraded or downgraded to another PAN-OS version,
|
|
use the following workaround in that version.
|
|
|
|
Workaround: Run the CLI command debug dataplane
|
|
internal pdt fe100 csr wr_sem_ctrl_ctr_scan_dis value
|
|
0 to set the value to zero (0).
|
|
|
|
## PAN-216214
|
|
|
|
For Panorama-managed firewalls in an Active/Active High Availability
|
|
(HA) configuration where you configure the firewall HA settings (DeviceHigh Availability) in a template or template stack (PanoramaTemplates), performing a local commit on one of the HA
|
|
firewalls triggers an HA config sync on the peer firewall. This
|
|
causes the HA peer configuration to go Out of
|
|
Sync.
|
|
|
|
## PAN-215778
|
|
|
|
On the M-600 appliance in Management Only mode, XML API Get requests
|
|
for /config fail with the following
|
|
error due to exceeding the total configuration size
|
|
supported on the M-600 appliance.
|
|
|
|
504 Gateway timeout
|
|
|
|
## PAN-215082
|
|
|
|
M-300 and M-700 appliances may generate erroneous system logs (MonitorLogsSystem) to alert that the M-Series appliance memory usage
|
|
limits are reached.
|
|
|
|
## PAN-213746
|
|
|
|
On the Panorama management server, the Hostkey
|
|
displayed as undefined undefined if you
|
|
override an SSH Service Profile (DeviceCertificate ManagementSSH Service Profile) Hostkey configured in a Template from the Template
|
|
Stack.
|
|
|
|
## PAN-213119
|
|
|
|
PA-5410 and PA-5420 firewalls display the following error when you
|
|
view the Block IP list (MonitorBlock IP):
|
|
|
|
show -> dis-block-table is
|
|
unexpected
|
|
|
|
## PAN-212889
|
|
|
|
On the Panorama management server, different threat names are used
|
|
when querying the same threat in the Threat Monitor (MonitorApp ScopeThreat Monitor) and ACC. This results in the
|
|
ACC displaying no data to display when
|
|
you are redirected to the ACC after clicking a threat name in the
|
|
Threat Monitor and filtering the same threat name in the Global
|
|
Filters.
|
|
|
|
## PAN-211531
|
|
|
|
On the Panorama management server, admins can still
|
|
perform a selective push to managed firewalls when Push All
|
|
Changes and Push for Other Admins
|
|
are disabled in the admin role profile (PanoramaAdmin Roles).
|
|
|
|
## PAN-209937
|
|
|
|
Certificate-based authentication for administrator accounts may be
|
|
unable to log into the Panorama or firewall web interface with the
|
|
following error:
|
|
|
|
Bad Request - Your browser sent a request that this
|
|
server could not understand
|
|
|
|
## PAN-208325
|
|
|
|
The following NextGen firewalls and Panorama management server models
|
|
are unable to automatically renew the device certificate (DeviceSetupManagement or PanoramaSetupManagement).
|
|
|
|
- M-300 and M-700
|
|
- PA-410 Firewall
|
|
- PA-415 and PA-445 Firewalls
|
|
- PA-440, PA-450, and PA-460 Firewalls
|
|
- PA-1400 Series
|
|
- PA-3400 Series
|
|
- PA-5410, PA-5420, and PA-5430 Firewalls
|
|
- PA-5440 Firewall
|
|
- PA-5450 Firewall
|
|
|
|
Workaround: Log in to the firewall CLI or Panorama CLI and fetch the
|
|
device certificate.
|
|
|
|
admin>request certificate fetch
|
|
|
|
## PAN-208189
|
|
|
|
Traffic fails to match and reach all destinations if a Security
|
|
policy rule includes FQDN objects that resolve to two or more IP
|
|
addresses.
|
|
|
|
## PAN-207770
|
|
|
|
Data filtering logs (MonitorLogsData Filtering)
|
|
incorrectly display the traffic Direction as server-to-client instead
|
|
of client-to-server for upload traffic
|
|
that matches Enterprise data loss prevention (DLP) data patterns (ObjectsDLPData
|
|
Filtering Patterns) in an Enterprise DLP data
|
|
filtering profile (ObjectsDLPData Filtering Profiles).
|
|
|
|
## PAN-207733
|
|
|
|
When a DHCPv6 client is configured on HA
|
|
Active/Passive firewalls, if the DHCPv6 server goes down, after
|
|
the lease time expires, the DHCPv6 client should enter SOLICIT state
|
|
on both the Active and Passive firewalls. Instead, the client is
|
|
stuck in BOUND state with an IPv6 address having lease time 0 on
|
|
the Passive firewall.
|
|
|
|
## PAN-207616
|
|
|
|
On the Panorama management server, after
|
|
selecting managed firewalls and creating a new Tag (PanoramaManaged DevicesSummary) the managed firewalls are
|
|
automatically unselected and any new tag created is applied to the
|
|
managed firewalls for which you initially created the new tag.
|
|
|
|
Workaround: Select
|
|
and then unselect the managed firewalls for which you created a
|
|
new tag.
|
|
|
|
## PAN-207611
|
|
|
|
When a DHCPv6 client is configured on HA
|
|
Active/Passive firewalls, the Passive firewall sometimes crashes.
|
|
|
|
## PAN-207442
|
|
|
|
For M-700 appliances in an active/passive high availability (PanoramaHigh Availability) configuration, the
|
|
active-primary HA peer
|
|
configuration sync to the
|
|
secondary-passive HA peer may fail.
|
|
When the config sync fails, the job Results is
|
|
Successful
|
|
(Tasks), however the sync status on the
|
|
Dashboard displays as Out
|
|
of Sync for both HA peers.
|
|
|
|
Workaround: Perform a local commit on the
|
|
active-primary HA peer and then
|
|
synchronize the HA configuration.
|
|
|
|
1. Log in to the Panorama
|
|
web interface of the
|
|
active-primary HA peer.
|
|
2. Select Commit and Commit to
|
|
Panorama.
|
|
3. In the active-primary HA peer
|
|
Dashboard, click Sync
|
|
to Peer in the High Availability widget.
|
|
|
|
## PAN-207040
|
|
|
|
If you disable Advanced Routing, remove
|
|
logical routers, and downgrade from PAN-OS 11.0.0 to a PAN-OS 10.2.x
|
|
or 10.1.x release, subsequent commits fail and SD-WAN devices on
|
|
Panorama have no Virtual Router name.
|
|
|
|
## PAN-206913
|
|
|
|
When a DHCPv6 client is configured on HA
|
|
Active/Passive firewalls, releasing the IPv6 address from the client
|
|
(using Release in the UI or using the request dhcp client ipv6 release all CLI
|
|
command) releases the IPv6 address from the Active firewall, but
|
|
not the Passive firewall.
|
|
|
|
## PAN-206909
|
|
|
|
The Dedicated Log Collector is unable to
|
|
reconnect to the Panorama management server if the configd process
|
|
crashes. This results in the Dedicated Log Collector losing connectivity
|
|
to Panorama despite the managed collector connection Status (PanoramaManaged Collector)
|
|
displaying connected and the managed colletor Health status displaying
|
|
as healthy.
|
|
|
|
This results in the local Panorama config and
|
|
system logs not being forwarded to the Dedicated Log Collector.
|
|
Firewall log forwarding to the disconnected Dedicated Log Collector
|
|
is not impacted.
|
|
|
|
Workaround: Restart the mgmtsrvr process
|
|
on the Dedicated Log Collector.
|
|
|
|
1. Log in to the Dedicated Log Collector
|
|
CLI.
|
|
2. Confirm the Dedicated Log Collector is disconnected from
|
|
Panorama.
|
|
admin> show panorama-status
|
|
Verify
|
|
the Connected status is no.
|
|
3. Restart the mgmtsrvr process.
|
|
admin> debug software restart process management-server
|
|
|
|
## PAN-206416
|
|
|
|
On the Panorama management server, no data
|
|
filtering log (MonitorLogsData Filtering) is generated
|
|
when the managed firewall loses connectivity to the following cloud services,
|
|
and as a result fails to forward matched traffic for inspection.
|
|
|
|
- DLP cloud service
|
|
- Advanced Threat Protection inline cloud analysis service
|
|
- Advanced URL Filtering cloud service
|
|
|
|
## PAN-206315
|
|
|
|
```caveat
|
|
PA-1420 firewall only
|
|
```
|
|
|
|
In an active/passive high
|
|
availability (HA) configuration, the show session info CLI
|
|
command shows that the passive firewall has packet rate and throughput
|
|
values. The packet rate and throughput of the passive firewall should
|
|
be zero since it is not processing traffic.
|
|
|
|
## PAN-205009
|
|
|
|
```caveat
|
|
PA-1420 firewall only
|
|
```
|
|
|
|
In an active/passive high
|
|
availability (HA) configuration, the show interface all, show-high availability interface ha2,
|
|
and show high-availability all CLI
|
|
commands display the HSCI port state as unknown on both the active
|
|
and passive firewalls.
|
|
|
|
## PAN-204689
|
|
|
|
Upon upgrade to PAN-OS 11.0.1, the following GlobalProtect settings
|
|
do not work:
|
|
|
|
- Allow user to disconnect GlobalProtect
|
|
AppAllow with Passcode
|
|
- Allow user to Disable GlobalProtect
|
|
AppAllow with Passcode
|
|
- Allow User to Uninstall GlobalProtect
|
|
AppAllow with Password
|
|
|
|
## PAN-201910
|
|
|
|
PAN-OS security profiles might consume a
|
|
large amount of memory depending on the profile configuration and
|
|
quantity. In some cases, this might reduce the number of supported security
|
|
profiles below the stated maximum for a given platform.
|
|
|
|
## PAN-199557
|
|
|
|
On M-600 appliances in an Active/Passive high availability (HA)
|
|
configuration, the configd process
|
|
restarts due to a memory leak on the
|
|
Active Panorama HA peer. This
|
|
causes the Panorama web interface and CLI to become unresponsive.
|
|
|
|
Workaround: Manually reboot the
|
|
Active Panorama HA peer.
|
|
|
|
## PAN-197588
|
|
|
|
The PAN-OS ACC (Application Command Center)
|
|
does not display a widget detailing statistics and data associated
|
|
with vulnerability exploits that have been detected using inline
|
|
cloud analysis.
|
|
|
|
## PAN-197419
|
|
|
|
```caveat
|
|
PA-1400 Series firewalls only
|
|
```
|
|
|
|
In NetworkInterfaceEthernet, the power over Ethernet
|
|
(PoE) ports do not display a Tag value.
|
|
|
|
## PAN-197097
|
|
|
|
Large Scale VPN (LSVPN) does not support
|
|
IPv6 addresses on the satellite firewall.
|
|
|
|
## PAN-196758
|
|
|
|
On the Panorama management server, pushing
|
|
a configuration change to firewalls leveraging SD-WAN erroneously
|
|
show the auto-provisioned BGP configurations for SD-WAN as being
|
|
edited or deleted despite no edits or deletions being made when
|
|
you Preview Changes (CommitPush to DevicesEdit Selections or CommitCommit and PushEdit Selections).
|
|
|
|
## PAN-196146
|
|
|
|
The VM-Series firewall on Azure does not
|
|
boot up with a hostname (specified in an init-cgf.txt or user data)
|
|
when bootstrapped.
|
|
|
|
## PAN-195968
|
|
|
|
```caveat
|
|
PA-1400 Series firewalls only
|
|
```
|
|
|
|
When using the CLI to configure power over Ethernet (PoE) on a non-PoE
|
|
port, the CLI prints an error depending on whether an interface
|
|
type was selected on the non-PoE port or not. If an interface type, such
|
|
as tap, Layer 2, or virtual wire, was selected before PoE was configured,
|
|
the error message will not include the interface name (eg. ethernet1/4).
|
|
If an interface type was not selected before PoE was configured,
|
|
the error message will include the interface name.
|
|
|
|
## PAN-195342
|
|
|
|
On the Panorama management server, Context
|
|
Switch fails when you try to Context Switch from a managed firewall running
|
|
PAN-OS 10.1.7 or earlier release back to Panorama and the following
|
|
error is displayed:
|
|
|
|
Could not find start token '@start@'
|
|
|
|
## PAN-194978
|
|
|
|
```caveat
|
|
PA-1400 Series firewalls only
|
|
```
|
|
|
|
In NetworkInterfaceEthernet, hovering the mouse over
|
|
a power over Ethernet (PoE) Link State icon
|
|
does not display link speed and link duplex details.
|
|
|
|
## PAN-194424
|
|
|
|
```caveat
|
|
PA-5450 firewall only
|
|
```
|
|
|
|
Upgrading
|
|
to PAN-OS 10.2.2 while having a log interface configured can cause
|
|
both the log interface and the management interface to remain connected
|
|
to the log collector.
|
|
|
|
Workaround: Restart the log receiver service
|
|
by running the following CLI command:
|
|
|
|
debug software restart process log-receiver
|
|
|
|
## PAN-187685
|
|
|
|
On the Panorama management server, the Template Status
|
|
displays no synchronization status (PanoramaManaged DevicesSummary)
|
|
after a bootstrapped firewall is successfully added to Panorama.
|
|
|
|
Workaround: After
|
|
the bootstrapped firewall is successfully added to Panorama, log in to the Panorama web interface and
|
|
select CommitPush
|
|
to Devices.
|
|
|
|
## PAN-187407
|
|
|
|
The configured Advanced Threat Prevention
|
|
inline cloud analysis action for a given model might not be honored
|
|
under the following condition: If the firewall is set to Hold
|
|
client request for category lookup and the action set
|
|
to Reset-Both and the URL cache has been
|
|
cleared, the first request for inline cloud analysis will be bypassed.
|
|
|
|
## PAN-186283
|
|
|
|
Templates appear out-of-sync on Panorama
|
|
after successfully deploying the CFT stack using the Panorama plugin for
|
|
AWS.
|
|
|
|
Workaround: Use CommitPush to Devices to synchronize
|
|
the templates.
|
|
|
|
## PAN-184708
|
|
|
|
```caveat
|
|
Panorama managed firewalls
|
|
```
|
|
|
|
Scheduled report emails (MonitorPDF ReportsEmail Scheduler) are not emailed if:
|
|
|
|
- A scheduled report email contains
|
|
a Report Group (MonitorPDF
|
|
ReportsReport Group)
|
|
which includes a SaaS Application Usage report.
|
|
- A scheduled report contains only a SaaS Application Usage Report.
|
|
|
|
Workaround: To
|
|
receive a scheduled report email for all other PDF report types:
|
|
|
|
1. Select MonitorPDF ReportsReport Groups and
|
|
remove all SaaS Application Usage reports from all Report Groups.
|
|
2. Select MonitorPDF
|
|
ReportsEmail Scheduler and
|
|
edit the scheduled report email that contains only a SaaS Application Usage
|
|
report. For the Recurrence, select Disable and
|
|
click OK.
|
|
Repeat this step for all scheduled
|
|
report emails that contain only a SaaS Application Usage report.
|
|
3. Commit.
|
|
()
|
|
Select CommitCommit
|
|
and Push
|
|
|
|
## PAN-184406
|
|
|
|
Using the CLI to add a RAID disk pair to
|
|
an M-700 appliance causes the dmdb process to crash.
|
|
|
|
Workaround: Contact
|
|
customer support to stop the dmdb process before adding a RAID disk
|
|
pair to a M-700 appliance.
|
|
|
|
## PAN-183404
|
|
|
|
Static IP addresses are not recognized when
|
|
"and" operators are used with IP CIDR range.
|
|
|
|
## PAN-182734
|
|
|
|
On an Advanced Routing Engine, if you change
|
|
the IPSec tunnel configuration, BGP flaps.
|
|
|
|
## PAN-181933
|
|
|
|
If you use multiple log forwarding cards
|
|
(LFCs) on the PA-7000 series, all of the cards may not receive all
|
|
of the updates and the mappings for the clients may become out of sync,
|
|
which causes the firewall to not correctly populate the Source User
|
|
column in the session logs.
|
|
|
|
## PAN-171938
|
|
|
|
No results are displayed when you Show Application
|
|
Filter for a Security policy rule (PoliciesSecurityApplicationValueShow Application Filter).
|
|
|
|
## PAN-164885
|
|
|
|
On the Panorama management server, pushes to managed firewalls (CommitPush to Devices or Commit and Push) may fail
|
|
when an EDL (ObjectsExternal Dynamic Lists) is configured to Check for
|
|
updates every 5 minutes due to the commit and EDL
|
|
fetch processes overlapping. This is more likely to occur when
|
|
multiple EDLs are configured to check for updates every 5
|
|
minutes.
|