firewallissues/web/data/issues/PAN-OS/known/9.0.13_2026-03-16.md

type, product, version, source, crawl

type	product	version	source	crawl
Known	PAN-OS	9.0.13	common-crawl	CC-MAIN-2026-12

BLANK-000000

Upgrading Panorama with a local Log Collector and Dedicated Log Collectors to PAN-OS 8.1 or a later PAN-OS release can take up to six hours to complete due to significant infrastructure changes. Ensure uninterrupted power to all appliances throughout the upgrade process.

BLANK-000000

A critical System log is generated on the VM-Series firewall if the minimum memory requirement for the model is not available.

• When the memory allocated is less than 4.5GB, you cannot upgrade the firewall. The following error message displays: Failed to install 9.0.0 with the following error: VM-50 in 9.0.0 requires 5.5GB memory, VM-50 Lite requires 4.5GB memory.Please configure this VM with enough memory before upgrading.
• If the memory allocation is more than 4.5GB but less that the licensed capacity requirement for the model, it will default to the capacity associated with the VM-50. The System log message System capacity adjusted to VM-50 capacity due to insufficient memory for VM-<xxx> license, indicates that you must allocate the additional memory required for licensed capacity for the firewall model.

BLANK-000000

A Panorama management server running PAN-OS 9.0 does not currently support management of appliances running WildFire 7.1 or earlier releases. Even though these management options are visible on the Panorama 9.0 web interface (Panorama > Managed WildFire Clusters and Panorama > Managed WildFire Appliances), making changes to these settings for appliances running WildFire 7.1 or an earlier release has no effect.

WF500-4200

The Create Date shown when using the show wildfire global sample-status sha256 equal<hash> or show wildfire global sample-analysis CLI command is two hours behind the actual time for WF-500 appliance samples.

PLUG-1854

PAN-OS 9.0.2 and later releases on AWS and GCP only

You cannot swap the management interface.

PLUG-1827

Microsoft Azure only

The firewall drops packets due to larger than expected packet sizes when Accelerated networking is enabled on the firewall (Settings > Networking).

PLUG-1709

Microsoft Azure only

There is an intermittent issue where the secondary IP address becomes associated with the passive firewall after multiple failovers.

Workaround: Reassign IP addresses to the active and passive firewalls in Azure as needed.

PLUG-1694

PAYG licenses only

Your pay-as-you-go (PAYG) license is not retained when you upgrade from a PAN-OS 8.1 release to a PAN-OS 9.0 release.

Workaround: Upgrade to VM-Series plugin 1.0.2 (or later) after you upgrade to a PAN-OS 9.0 release and then reboot the firewall to recover your PAYG license.

PLUG-1681

If you bootstrap a PAN-OS 9.0.1 image while using VM-Series plugin 1.0.0, the firewall will not apply the capacity license. To downgrade the VM-Series plugin from version 1.0.2 to 1.0.0, first bootstrap the PAN-OS 9.0.1 image and then downgrade the plugin.

PLUG-1642

This issue is resolved with VM-Series plugin 1.0.2.

After a high availability (HA) failover, the dataplane interface on a VM-Series firewall on Azure with Accelerated Networking (SR-IOV) becomes disabled when, as a result of the failover, the secondary IP address is detached from or attached to the firewall and moved to its HA peer.

PLUG-1503

This issue is resolved with VM-Series plugin 1.0.3.

When a VM-Series firewall on AWS running on a C5 or M5 instance experiences a high availability (HA) failover, the dataplane interfaces from the previously active firewall are not moved to the newly active (previously passive) peer.

Workaround: Check for the latest VM-Series plugin version and install the VM-Series plugin 9.0.0 version; the built-in version is 9.0.0-c29.

PLUG-1074

On the VM-Series firewall on AWS, when you change the instance type, the firewall no longer has a serial number or a license. Additionally, if you manage this firewall using Panorama, it is no longer connected to Panorama.

PLUG-380

When you rename a device group, template, or template stack in Panorama that is part of a VMware NSX service definition, the new name is not reflected in NSX Manager. Therefore, any ESXi hosts that you add to a vSphere cluster are not added to the correct device group, template, or template stack and your Security policy is not pushed to VM-Series firewalls that you deploy after you rename those objects. There is no impact to existing VM-Series firewalls.

PAN-178194

Firewalls licensed for Advanced URL Filtering generate a message indicating that a License required for URL filtering to function is unavailable displays at the bottom of the UI, due to a PAN-OS UI issue. This error does not affect the operation of Advanced URL Filtering or URL Filtering.

PAN-161121

On the Panorama management server, invalid reference errors occur when attempting to delete an address object (Objects > Addresses) after removing the address object reference from an address group (Objects > Address Groups) resulting in you being unable commit and push the configuration to managed firewalls.

Workaround: Log in to the Panorama CLI and restart configd.

admin>``debug software restart process configd

PAN-154247

On the Panorama management server, context switching to and from the managed firewall web interface may cause the Panorama administrator to be logged out.

Workaround: Log out and back in to the Panorama web interface.

PAN-151909

On the Panorama management server, Preview Changes (Commit > Commit to Panorama) incorrectly displays an existing route as Added and the new route as an existing route in the Candidate Configuration when you configure a new virtual router route (Network > Virtual Router).

PAN-150172

This issue is now resolved. See PAN-OS 9.0.9-h1 Addressed Issues.

Dataplane processes restart when attempting to access websites that have the NotBefore attribute less than or equal to Unix Epoch Time in the server certificate with forward proxy enabled.

PAN-146573

PA-7000 Series firewalls configured with a large number of interfaces experience impacted performance and possible timeouts when performing SNMP queries.

PAN-136701

PA-7000b Series firewalls only

Packets for new sessions drop when handling predict sessions.

Workaround: Use the following CLI command to bypass this issue:

• set session hwpredict disable yes

To enable hwpredict again set session hwpredict disable no.

To verify the current settings, show session hwpredict status.

PAN-131915

There is an issue when you implement a new firewall bootstrap with a USB drive where the bootstrap fails and displays the following error message: no USB device found.

Workaround: Perform a factory reset or run the request system private-data-reset CLI command and then proceed with bootstrapping.

PAN-124956

There is an issue where VM-Series firewalls do not support packet buffer protection.

PAN-120440

There is an issue on M-500 Panorama management servers where any ethernet interface with an IPv6 address having Private PAN-DB-URL connectivity only supports the following format: 2001:DB9:85A3:0:0:8A2E:370:2.

PAN-120303

There is an issue where the firewall remains connected to the PAN-DB-URL server through the old management IP address on the M-500 Panorama management server, even when you configured the Eth1/1 interface.

Workaround: Update the PAN-DB-URL IP address on the firewall using one of the methods below.

• Modify the PAN-DB Server IP address on the managed firewall.
  1. On the web interface, delete the PAN-DB Server IP address (Device > Setup > Content ID > URL Filtering settings).
  2. Commit your changes.
  3. Add the new M-500 Eth1/1 IP PAN-DB IP address.
  4. Commit your changes.
• Restart the firewall (devsrvr) process.
  1. Log in to the firewall CLI.
  2. Restart the devsrvr process: debug software restart process device-server

PAN-118414

PAN-OS 9.0.2 and later releases only

There is an intermittent issue where a Panorama management server and managing Prisma™ Access or Cortex™ Data Lake fails to authorize one-time-password (OTP) submissions during the onboarding process.

Workaround: Downgrade to PAN-OS 9.0.1.

PAN-117043

There is an issue on the Panorama management server and all supported firewalls where special characters contained in the tag names of the Security policy rules returns the following error message: group-tag is invalid when you commit or push a configuration.

Workaround: Modify the tags and group tags (Objects > Tags) to exclude special characters.

PAN-116017

Google Cloud Platform (GCP) only

The firewall does not accept the DNS value from the initial configuration (init-cfg) file when you bootstrap the firewall.

Workaround: Add DNS value as part of the bootstrap.xml in the bootstrap folder and complete the bootstrap process.

PAN-115816

Microsoft Azure only

There is an intermittent issue where an Ethernet (eth1) interface does not come up when you first boot up the firewall.

Workaround: Reboot the firewall.

PAN-115733

PAN-OS firewalls in an HA configuration only

There is a rare issue where data interfaces do not come up after you reboot the firewall when running a C5 or M5 instance type in AWS.

Workaround: Reboot the firewall.

PAN-114495

Alibaba Cloud runs on a KVM hypervisor and supports two Virtio modes: DPDK (default) and MMAP. If you deploy a VM-Series firewall running PAN-OS 9.0 in DPDK packet mode and you then switch to MMAP packet mode, the VM-Series firewall duplicates packets that originate from or terminate on the firewall. As an example, if a load balancer or a server behind the firewall pings the VM-Series firewall after you switch from DPDK packet mode to MMAP packet mode, the firewall duplicates the ping packets.

Throughput traffic is not duplicated if you deploy the VM-Series firewall using MMAP packet mode.

PAN-113117

A newly launched firewall does not get its configuration from Panorama when it first connects if you installed the VM-Series plugin on Panorama. When a newly launched firewall that is bootstrapped connects to Panorama, a process restart occurs on Panorama. Upon restart, you are logged out of the user interface and you need to log in and push the device group and template configuration to the newly connected firewall.

PAN-113098

In the firewall web interface, you can temporarily submit change requests for the following URL categories: insufficient-content, high-risk, medium-risk, low-risk, and newly-registered-domains. However, Palo Alto Networks does not support or process change requests for these categories.

PAN-112983

Firewalls with multiple virtual systems only; no impact to Panorama

If you select any Location other than Shared when you generate or import a new CA Certificate in a Certificate Profile (Device > Certificate Management > Certificate Profile), the firewall adds the newly generated or imported certificate to vsys1. For example, if you specify vsys3 as the Location, Add a CA Certificate, and then Generate a new certificate, the firewall adds the certificate to vsys1 instead of vsys3. When you click OK to configure the Certificate Profile, the firewall returns an Operation Failed error message because it sees a certificate for vsys1 added to vsys3.

Workaround 1:

1. Generate or import the new certificate in a Certificate Profile (Device > Certificate Management > Certificates > Device Certificates) and select the appropriate vsys Location when you generate or import the certificate.
2. When you create or edit the Certificate Profile, specify the vsys Location and Add the certificate that you generated (or imported) from the list of existing certificates.

Workaround 2: When you generate or import a new certificate when you configure a Certificate Profile for a vsys other than vsys1, specify the Location as Shared.

PAN-112694

Firewalls with multiple virtual systems only

If you configure dynamic DNS (DDNS) on a new interface (associated with vsys1 or another virtual system) and you then create a New Certificate Profile from the drop-down, you must set the location for the Certificate Profile to Shared. If you configure DDNS on an existing interface and then create a new Certificate Profile, we also recommend that you choose the Shared location instead of a specific virtual system. Alternatively, you can select a preexisting certificate profile instead of creating a new one.

PAN-112626

When you upgrade to PAN-OS 9.0 with a PAYG Bundle 2 license, the new DNS Security subscription is not available on your VM-Series firewall.

This subscription is included with the BYOL and VM-Series ELA when you upgrade.

PAN-112562

The Log Forwarding Card (LFC) subinterface incorrectly uses the interface IP address instead of the subinterface IP address for all services that forward logs (such as syslog, email, and SNMP) for selected virtual systems.

PAN-112456

You can temporarily submit a change request for a URL Category with more than two suggested categories. However, we support only two suggested categories so add no more than two suggested categories to a change request until we address this issue. If you submit more than two suggested categories, we will use only the first two categories you enter.

PAN-111928

Invalid configuration errors are not displayed as expected when you revert a Panorama management server configuration.

Workaround: After you revert the Panorama configuration, Commit (Commit > Commit to Panorama) the reverted configuration to display the invalid configuration errors.

PAN-111866

The push scope selection on the Panorama web interface displays incorrectly even though the commit scope displays as expected. This issue occurs when one administrator makes configuration changes to separate device groups or templates that affect multiple firewalls and a different administrator attempts to push those changes.

Workaround: Perform one of the following tasks.

• Initiate a Commit to Panorama operation followed by a Push to Devices operation for the modified device group and template configurations.
• Manually select the devices that belong to the modified device group and template configurations.

PAN-111729

If you disable DPDK mode and enable it again, you must immediately reboot the firewall.

PAN-111670

Tagged VLAN traffic fails when sent through an SR-IOV adapter.

PAN-110794

DGA-based threats shown in the firewall threat log display the same name for all such instances.

PAN-110603

In some cases, when a port on an PA-7000 Series 100Gbps Network Processor Card (NPC) has an SFP+ transceiver inserted but no cable is connected, the system detects a signal and attempts to tune and link with that port. As a result, if the device at the other end of the connection is rebooted or has an HA failover event, the link is sometimes held down for an extended period of time while the interface attempts to tune itself.

Workaround: Connect a cable to the installed SFP+ transceiver to allow the system to tune and link. Then, when you disconnect the cable, the system will correctly detect that the link is down. Alternatively, remove the SFP+ transceiver from the port.

PAN-109526

The system log does not correctly display the URL for CRL files; instead, the URLs are displayed with encoded characters.

PAN-106989

There is a display-only issue on Panorama that results in a commit failed status for Template Last Commit State (Panorama > Managed Devices > Summary).

Workaround: Push templates to managed devices.

PAN-106675

After upgrading the Panorama management server to PAN-OS 8.1 or a later release, predefined reports do not display a list of top attackers.

Workaround: Create new threat summary reports (Monitor > PDF Reports > Manage PDF Summary) containing the top attackers to mimic the predefined reports.

PAN-105210

Panorama in FIPS mode only when managing non-FIPS firewalls

You cannot configure a GlobalProtect portal on Panorama in FIPS mode when managing a non-FIPS firewall. If you attempt to do so, you will receive the following error message: agent-user-override-key unexpected here Portal_fips.

PAN-104780

If you configure a HIP object to match only when a connecting endpoint is managed (Objects > GlobalProtect > HIP Objects > > General > Managed), iOS and Android endpoints that are managed by AirWatch are unable to successfully match the HIP object and the HIP report incorrectly indicates that these endpoints are not managed. This issue occurs because GlobalProtect gateways cannot correctly identify the managed status of these endpoints.

Additionally, iOS endpoints that are managed by AirWatch are unable to match HIP objects based on the endpoint serial number because GlobalProtect gateways cannot identify the serial numbers of these endpoints; these serial numbers do not appear in the HIP report.

PAN-103336

HA configurations only

When you downgrade a VM-Series firewall on Azure from PAN-OS 9.0 to an earlier release, you do not receive warnings. Do not downgrade your firewall without saving and exporting your current configuration.

Workaround: Because HA is not supported in earlier versions of VM-Series firewalls on Azure, to prevent the loss of your configuration:

• Save and export the configuration before you downgrade.
• After you downgrade, load the saved configuration and commit your changes. The firewall will resume operation without the HA configuration.

PAN-103276

Adding a disk to a virtual appliance running Panorama 8.1 or a later release on VMware ESXi 6.5 update1 causes the Panorama virtual appliance and host web client to become unresponsive.

Workaround: Upgrade the ESXi host to ESXi 6.5 update2 and add the disk again.

PAN-103018

Panorama plugins

When you use the AND/OR boolean operators to define the match criteria for Dynamic Address Groups on Panorama, the boolean operators do not function properly. The member IP addresses are not included in the address group as expected.

PAN-101688

Panorama plugins

The IP address-to-tag mapping information registered on a firewall or virtual system is not deleted when you remove the firewall or virtual system from a Device Group.

Workaround: Log in to the CLI on the firewall and enter the following command to unregister the IP address-to-tag mappings: debug object registered-ip clear all.

PAN-101537

After you configure and push address and address group objects in Shared and vsys-specific device groups from the Panorama management server to managed firewalls, executing the show log <log-type> direction equal <direction> <dst> | <src> in <object-name> command on a managed firewall only returns address and address group objects pushed form the Shared device group.

Workaround: Specify the vsys in the query string:

admin> set system target-vsys <vsys-name>

admin> show log <log-type> direction equal <direction> query equal ‘vsys eq <vsys-name>’ <dst> | <src> in <object-name>

PAN-98803

If you configure the Panorama plugin to monitor virtual machines or endpoints in your AWS, Azure, or Cisco ACI environment without installing the NSX plugin, the IP-address-to-tag mappings for Dynamic Address Groups are not displayed on Panorama.

Workaround: Install the NSX plugin (you do not need to use the NSX plugin for the installation to resolve this display issue).

PAN-98520

When booting or rebooting a PA-7000 Series Firewall with the SMC-B installed, the BIOS console output displays attempts to connect to the card's controller in the System Memory Speed section. The messages can be ignored.

PAN-97757

GlobalProtect authentication fails with an Invalid username/password error (because the user is not found in Allow List) after you enable GlobalProtect authentication cookies and add a RADIUS group to the Allow List of the authentication profile used to authenticate to GlobalProtect.

Workaround: Disable GlobalProtect authentication cookies. Alternatively, disable (clear) Retrieve user group from RADIUS in the authentication profile and configure group mapping from Active Directory (AD) through LDAP.

PAN-97524

Panorama management server only

The Security Zone and Virtual System columns (Network tab) display None after a Device Group and Template administrator with read-only privileges performs a context switch.

PAN-96985

The request shutdown system command does not shut down the Panorama management server.

PAN-96960

You cannot restart or shutdown a Panorama on KVM from the Virtual-manager console or virsch CLI.

PAN-96446

A firewall that is not included in a Collector Group fails to generate a system log if logs are dropped when forwarded to a Panorama management server that is running in Management Only mode.

PAN-95773

On VM-Series firewalls that have Data Plane Development Kit (DPDK) enabled and that use the i40e network interface card (NIC), the show session info CLI command displays an inaccurate throughput and packet rate.

Workaround: Disable DPDK by running the set system setting dpdk-pkt-io off CLI command.

PAN-95717

After 30,000 or more end users log in to the GlobalProtect gateway within a two- to three-hour period, the firewall web interface responds slowly, commits take longer than expected or intermittently fail, and Tech Support File generation times out and fails.

PAN-95602

In a deployment where a Log Collector connects to Panorama management servers in a high availability (HA) configuration, after you switch the Log Collector appliance to Panorama mode, commit operations fail on the appliance.

Workaround: Remove the following node from the running-config.xml file on the Log Collector before switching it to Panorama mode: devices/entry[@name='localhost.localdomain']/deviceconfig/system/panorama-server-2

PAN-95511

The name for an address object, address group, or an external dynamic list must be unique. Duplicate names for these objects can result in unexpected behavior when you reference the object in a policy rule.

PAN-95028

For administrator accounts that you created in PAN-OS 8.0.8 and earlier releases, the firewall does not apply password profile settings (Device > Password Profiles) until after you upgrade to PAN-OS 8.0.9 or a later release and then only after you modify the account passwords. (Administrator accounts that you create in PAN-OS 8.0.9 or a later release do not require you to change the passwords to apply password profile settings.)

PAN-94966

After you delete disconnected and connected Terminal Server (TS) agents in the same operation, the firewall still displays the IP address-to-port-user mappings (show user ip-port-user-mapping CLI command) for the disconnected TS agents you deleted (Device > User Identification > Terminal Services Agents).

Workaround: Do not delete both disconnected and connected TS agents in the same operation.

PAN-94846

When DPDK is enabled on the VM-Series firewall with i40e virtual function (VF) driver, the VF does not detect the link status of the physical link. The VF link status remains up, regardless of changes to the physical link state.

PAN-94093

HTTP Header Insertion does not work when jumbo frames are received out of order.

PAN-93968

The firewall and Panorama web interfaces display vulnerability threat IDs that are not available in PAN-OS 9.0 releases (Objects > Security Profiles > Vulnerability Protection > > Exceptions). To confirm whether a particular threat ID is available in your release, monitor the release notes for each new Applications and Threats content update or check the Palo Alto Networks Threat Vault to see the minimum PAN-OS release version for a threat signature.

PAN-93842

The logging status of a Panorama Log Collector deployed on AWS or Azure displays as disconnected when you configure the ethernet1/1 to ethernet1/5 interfaces for log collection (Panorama > Managed Collectors > Interfaces). This results in firewalls not sending logs to the Log Collector.

Workaround: Configure the management (MGT) interface for log collection.

PAN-93607

When you configure a VM-500 firewall with an SCTP Protection profile (Objects > Security Profiles > SCTP Protection) and you try to add the profile to an existing Security Profile Group (Objects > Security Profile Groups), the Security Profile Group doesn’t list the SCTP Protection profile in its drop-down list of available profiles.

Workaround: Create a new Security Profile Group and select the SCTP Protection profile from there.

PAN-93532

When you configure a firewall running PAN-OS 9.0 as an nCipher HSM client, the web interface on the firewall displays the nCipher server status as Not Authenticated, even though the HSM state is up (Device > Setup > HSM).

PAN-93193

The memory-optimized VM-50 Lite intermittently performs slowly and stops processing traffic when memory utilization is critically high. To prevent this issue, make sure that you do not:

• Switch to the firewall Context on the Panorama management server.
• Commit changes when a dynamic update is being installed.
• Generate a custom report when a dynamic update is being installed.
• Generate custom reports during a commit.

Workaround: When the firewall performs slowly, or you see a critical System log for memory utilization, wait for 5 minutes and then manually reboot the firewall.

Use the Task Manager to verify that you are not performing memory intensive tasks such as installing dynamic updates, committing changes or generating reports, at the same time, on the firewall.

PAN-91802

On a VM-Series firewall, the clear session all CLI command does not clear GTP sessions.

PAN-86903

In rare cases, PA-800 Series firewalls shut themselves down due to a false over-current measurement.

PAN-83610

In rare cases, a PA-5200 Series firewall (with an FE100 network processor) that has session offload enabled (default) incorrectly resets the UDP checksum of outgoing UDP packets.

Workaround: In PAN-OS 8.0.6 and later releases, you can persistently disable session off load for only UDP traffic using the set session udp-off load no CLI command.

PAN-83598

VM-Series firewalls cannot monitor more than 500 virtual machine (VM) information sources (Device > VM Information Sources).

PAN-83236

The VM-Series firewall on Google Compute Platform does not publish firewall metrics to Google Stack Monitoring when you manually configure a DNS server IP address (Device > Setup > Services).

Workaround: The VM-Series firewall on Google Cloud Platform must use the DNS server that Google provides.

PAN-83215

SSL decryption based on ECDSA certificates does not work when you import the ECDSA private keys onto an nCipher nShield hardware security module (HSM).

PAN-81521

Endpoints failed to authenticate to GlobalProtect through Kerberos when you specify an FQDN instead of an IP address in the Kerberos server profile (Device > Server Profiles > Kerberos).

Workaround: Replace the FQDN with the IP address in the Kerberos server profile.

PAN-79423

Panorama cannot push address group objects from device groups to managed firewalls when zones specify the objects in the User Identification ACL include or exclude lists (Network > Zones) and the Share Unused Address and Service Objects with Devices option is disabled (Panorama > Setup > Management > Panorama Settings).

PAN-77125

PA-7000 Series, PA-5200 Series, and PA-3200 Series firewalls configured in tap mode don’t close offloaded sessions after processing the associated traffic; the sessions remain open until they time out.

Workaround: Configure the firewalls in virtual wire mode instead of tap mode, or disable session offloading by running the set session off load no CLI command.

PAN-75457

PAN-OS 8.0.1 and later releases

In WildFire appliance clusters that have three or more nodes, the Panorama management server does not support changing node roles. In a three-node cluster for example, you cannot use Panorama to configure the worker node as a controller node by adding the HA and cluster controller configurations, configure an existing controller node as a worker node by removing the HA configuration, and then commit and push the configuration. Attempts to change cluster node roles from Panorama results in a validation error—the commit fails and the cluster becomes unresponsive.

PAN-73530

The firewall does not generate a packet capture (pcap) when a Data Filtering profile blocks files.

PAN-73401

PAN-OS 8.0.1 and later releases

When you import a two-node WildFire appliance cluster into the Panorama management server, the controller nodes report their state as out-of-sync if either of the following conditions exist:

• You did not configure a worker list to add at least one worker node to the cluster. (In a two-node cluster, both nodes are controller nodes configured as an HA pair. Adding a worker node would make the cluster a three-node cluster.)
• You did not configure a service advertisement (either by enabling or not enabling advertising DNS service on the controller nodes).

Workaround: There are three possible workarounds to sync the controller nodes:

• After you import the two-node cluster into Panorama, push the configuration from Panorama to the cluster. After the push succeeds, Panorama reports that the controller nodes are in sync.
• Configure a worker list on the cluster controller: admin@wf500(active-controller)# set deviceconfig cluster mode controller worker-list <worker-ip-address> (<worker-ip-address> is the IP address of the worker node you are adding to the cluster.) This creates a three-node cluster. After you import the cluster into Panorama, Panorama reports that the controller nodes are in sync. When you want the cluster to have only two nodes, use a different workaround.
• Configure service advertisement on the local CLI of the cluster controller and then import the configuration into Panorama. The service advertisement can advertise that DNS is or is not enabled. admin@wf500(active-controller)# set deviceconfig cluster mode controller service-advertisement dns-service enabled yes or admin@wf500(active-controller)# set deviceconfig cluster mode controller service-advertisement dns-service enabled no Both commands result in Panorama reporting that the controller nodes are in sync.

PAN-71329

Local users and user groups in the Shared location (all virtual systems) are not available to be part of the user-to-application mapping for GlobalProtect Clientless VPN applications (Network > GlobalProtect > Portals > > Clientless VPN > Applications).

Workaround: Create users and user groups in specific virtual systems on firewalls that have multiple virtual systems. For single virtual systems (like VM-Series firewalls), users and user groups are created under Shared and are not configurable for Clientless VPN applications.

PAN-70906

If the PAN-OS web interface and the GlobalProtect portal are enabled on the same IP address, then when a user logs out of the GlobalProtect portal, the administrative user is also logged out from the PAN-OS web interface.

Workaround: Use the IP address to access the PAN-OS web interface and an FQDN to access the GlobalProtect portal.

PAN-69505

When viewing an external dynamic list that requires client authentication and you Test Source URL, the firewall fails to indicate whether it can reach the external dynamic list server and returns a URL access error (Objects > External Dynamic Lists).

PAN-41558

When you use a firewall loopback interface as a GlobalProtect gateway interface, traffic is not routed correctly for third-party IPSec clients, such as strongSwan.

Workaround: Use a physical firewall interface instead of a loopback firewall interface as the GlobalProtect gateway interface for third-party IPSec clients. Alternatively, configure the loopback interface that is used as the GlobalProtect gateway to be in the same zone as the physical ingress interface for third-party IPSec traffic.

PAN-40079

The VM-Series firewall on KVM, for all supported Linux distributions, does not support the Broadcom network adapters for PCI pass-through functionality.

PAN-39636

Regardless of the Time Frame you specify for a scheduled custom report on a Panorama M-Series appliance, the earliest possible start date for the report data is effectively the date when you configured the report (Monitor > Manage Custom Reports). For example, if you configure the report on the 15th of the month and set the Time Frame to Last 30 Days, the report that Panorama generates on the 16th will include only data from the 15th onward. This issue applies only to scheduled reports; on-demand reports include all data within the specified Time Frame.

Workaround: To generate an on-demand report, click Run Now when you configure the custom report.

PAN-38255

When you perform a factory reset on a Panorama virtual appliance and configure the serial number, logging does not work until you reboot Panorama or execute the debug software restart process management-server CLI command.

PAN-31832

The following issues apply when configuring a firewall to use a hardware security module (HSM):

• nCipher nShield Connect—The firewall requires at least four minutes to detect that an HSM was disconnected, causing SSL functionality to be unavailable during the delay.
• SafeNet Network—When losing connectivity to either or both HSMs in an HA configuration, the display of information from the show high-availability state and show hsm info commands are blocked for 20 seconds.

PAN-25046

Firewalls store SSH host keys used for SCP log exports in the known hosts file. In an HA deployment, PAN-OS synchronizes the SCP log export configuration between the firewall HA peers (Device > Scheduled Log Export), but not the known host file. When a failover occurs, the SCP log export fails.

Workaround: Log in to each peer in HA, select Device > Scheduled Log Export > <log_export_configuration>, and Test SCP server connection to confirm the host key so that SCP log forwarding continues to work after a failover.