3217 lines
107 KiB
HTML
3217 lines
107 KiB
HTML
<table class="table colsep rowsep table-striped">
|
|
<!--cq:include script="../../common/tablestack.jsp" /-->
|
|
|
|
<colgroup>
|
|
<col style="width: 25%" />
|
|
<col style="width: 75%" />
|
|
</colgroup>
|
|
<thead class="thead">
|
|
<tr class="row">
|
|
<th class="entry">
|
|
<div class="p">Issue ID</div>
|
|
</th>
|
|
<th class="entry">
|
|
<div class="p">Description</div>
|
|
</th>
|
|
</tr>
|
|
</thead>
|
|
|
|
<tbody class="tbody">
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-327009</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>all_task</a
|
|
>
|
|
process stopped responding.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-326677</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where a selective push from Panorama to the firewall
|
|
was successful even when applying rename operation failed in selective
|
|
push, which resulted in configurations on the firewall being deleted.
|
|
With this fix, the selective push will fail when applying rename
|
|
operation fails.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-325903</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where, after upgrading Panorama, a custom admin role
|
|
with Object Level Changes disabled did not automatically populate
|
|
out-of-sync firewalls in the push scope.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-325890</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where licenses were not installed after bootstrapping a
|
|
VM-Series firewall in an air-gapped environment.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-325120</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on PA-415, PA-415-5G, PA-445, PA-455, and PA-455-5G
|
|
platforms where certain PAN-OS versions caused intermittent
|
|
connectivity failures on the Eth1/1 data port and loss of power on PoE
|
|
ports.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-324966</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on the web interface where you were unable to view new
|
|
or modified App-IDs under
|
|
<span class="ph uicontrol">Review Policy</span> or
|
|
<span class="ph uicontrol">Review Apps</span>.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-324370</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where IDE traffic did not function as expected when
|
|
both HTTP head insertion and DLP inspection were enabled.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-324275</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where requesting logging service forwarding
|
|
certification information via the CLI did not work.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-324014</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where logging disks were reported with a byte size of
|
|
zero in the system status even when they were properly mounted.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-323974</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where you were unable to add logging drives to the
|
|
firewall, and validation errors occurred when pushing configurations
|
|
from Panorama.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-323862</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where SAML re-authentication failed when both IP
|
|
address-to-user mapping and session cookies expired simultatneously.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-323825</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt"
|
|
>Panorama appliances in Microsoft Azure environments only</tt
|
|
>) Fixed an issue where Panorama continuously displayed disk-related
|
|
read/write errors in the console logs.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-323809</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where attempting to generate a ticket for the
|
|
GlobalProtect portal caused Panorama to restart unexpectedly with the
|
|
error message <span class="ph systemoutput">tpl is invalid</span>.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-323485</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where multicast radio RTP based traffic was dropped
|
|
after an upgrade when the firewall performed Cloud Inline inspection,
|
|
which led to an exceeded session queue for Cloud Threat Detection.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-323243</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>configd</a
|
|
>
|
|
process stopped responding occurred when a Security policy rule was
|
|
updated or refreshed in the web interface.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-322815</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt"
|
|
>VM-Series firewalls on Microsoft Azure environments only</tt
|
|
>) Fixed an issue where the firewall entered maintenance mode after
|
|
enabling FIPS-CC mode and rebooted.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-322681</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the PDF Summary Reports were not generated
|
|
correctly after upgrading to an affected release.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-322630</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where IKE gateways were not visible within Panorama
|
|
Templates under
|
|
<span class="ph uicontrol">Network Profiles</span> from a custom
|
|
administrator role after upgrading to an affected PAN-OS release.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-322402</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where ACC reports for a duration of seven or more days
|
|
did not fully load or displayed partial information.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-322390</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the Enhanced Application Logging status in the
|
|
Logging Service Status dashboard displayed as gray and indicated 0/0
|
|
connections, even though EAL logs were successfully forwarded to
|
|
Cortex XDR.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-322325</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt"
|
|
>PA-3400, PA-5400, PA-5500, and PA-5500l platforms with dedicated
|
|
log interfaces only</tt
|
|
>) Fixed an issue where email forwarding failed silently when the SMTP
|
|
gateway was reachable only via the log-interface, even when test
|
|
emails were forwarded successfully.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-321937</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where an expired SD-WAN license caused SD-WAN tunnels
|
|
to become unavailable, which resulted in traffic interruptions. With
|
|
this fix, the device provides logs and commit messages about expired
|
|
licenses.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-321816</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where processes stopped responding unexpectedly.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-321699</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where device telemetry intermittently failed to send
|
|
files, which resulted in critical alerts in system files.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-321527</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt"
|
|
>PA-7500 firewalls in HA cluster configurations only</tt
|
|
>) Fixed an issue where, when one firewall suspended operations, the
|
|
other firewall also suspended operations instead of initiating a
|
|
failover, which resulted in a complete traffic outage.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-321516</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the dataplane restarted due to a race condition
|
|
in the dataplane cache infrastructure.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-321340</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt">Firewalls in FIPS mode only</tt>) Fixed an issue
|
|
where GlobalProtect unexpectedly prompted for RADIUS authentication
|
|
instead of client certificate authentication due to an OSCP validation
|
|
error and subsequent CRL verification failure, which led to
|
|
certificates being marked as invalid.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-321222</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where you were unable to create an HTTP server profile
|
|
an API key certificate was configured. This occurred because the
|
|
generated API key exceeded the maximum character limit.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-321150</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the interface remained down after an upgrade.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-321084</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt">VM-Series firewalls on ESXi platforms only</tt>)
|
|
Fixed an issue where enabling link monitoring caused the
|
|
<span class="ph systemoutput">brdagent</span> process to stop
|
|
responding, which caused system instability, interface outages,
|
|
split-brain conditions in HA pairs, and a reboot during failover.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-321081</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where
|
|
<span class="ph uicontrol">Log Quotas</span> incorrectly displayed a
|
|
value that was higher than possible.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-320598</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where internal and external DNS names did not resolve
|
|
when connected to a GlobalProtect gateway.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-320420</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the
|
|
<span class="ph systemoutput"
|
|
>show running resource-monitor ingress-backlogs</span
|
|
>
|
|
API call returned an unexpected error instead of the expected resource
|
|
monitoring information.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-320290</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where ACC reports did not display data under the
|
|
<span class="ph uicontrol">Area</span> and
|
|
<span class="ph uicontrol">Column</span> graphs. This occurred when
|
|
the report included dates prior to March 8.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-320245</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt">PA-7500 Series firewalls in vwire mode only</tt>)
|
|
Fixed an issue where Oracle application traffic was intermittently not
|
|
processed even though connected devices sent the traffic, which led to
|
|
service distruptions.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-319798</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt"
|
|
>Panorama virtual appliances in AWS environments only</tt
|
|
>) Fixed an issue where logging disks failed to mount or reported an
|
|
unknown file system type.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-319793</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where, after upgrading to PAN-OS 12.1.5, GlobalProtect
|
|
Clientless VPN failed to access JavaScripts.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-319557</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where graphical counters did not display correctly in
|
|
the control plane or dataplane monitor logs.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-319481</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on Panorama where system logs did not display the
|
|
firewall serial numbers when Panorama retrieved logs from the SLS.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-319419</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt"
|
|
>Firewalls in active/passive HA configurations only</tt
|
|
>) Fixed an issue where active firewalls were unable to send device
|
|
telemetry data to CDL.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-319335</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall did not follow configured management
|
|
proxy settings for OCSP and CRL queries, and instead reverted to
|
|
default configurations after a process restart.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-319288</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where a DPC in Slot 4 restarted repeatedly, which
|
|
caused internal path monitoring failures and a failover event.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-319266</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt">Cloud IPS only</tt>) Increased scale limit for zone
|
|
mappings.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-319228</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where External Dynamic List (EDL) refresh and commit
|
|
operations remained in a pending state, which prevented any subsequent
|
|
operations from completing.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-319136</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall generated high-severity system log
|
|
alerts due to a certificate trust issue during SSL handshakes.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-318990</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt"
|
|
>GlobalProtect dual-profile MacOS/Windows deployments only</tt
|
|
>) Fixed an issue where GlobalProtect commit warnings incorrectly
|
|
flagged SAML
|
|
<span class="ph uicontrol">default browser</span> mismatches between
|
|
authentication profiles and agent configurations.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-318949</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where irrelevant error messages related to IoT devices
|
|
filled the
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>logrcvr</a
|
|
>
|
|
logs.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-318784</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall stopped processing traffic and all
|
|
VPN tunnels went down even when the firewall remained in an active
|
|
state, and the CLI became unresponsive.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-318619</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where Geneve ingress traffic did not use the correct
|
|
public IP address for return traffic.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-318567</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the OpenConfig plugin stopped working after a
|
|
configuration update.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-318288</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where traffic initiated from Microsoft Azure to an
|
|
on-premises firewall was not decrypted, which caused the firewall to
|
|
drop the traffic. This occurred due to the firewall incorrectly
|
|
identifying SPI values.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-318275</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt">VM-Series firewalls only</tt>) Fixed an issue where
|
|
the firewall became unresponsive and did not automatically reboot,
|
|
which led to prolonged outages. With this fix, the Linux kernel
|
|
configuration will trigger a system panic and reboot.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-318120</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where SSL traffic was silently dropped when traffic was
|
|
processed by a Security policy with an Anti-Spyware profile that had
|
|
Inline cloud Analysis enabled for SSL C2 Detector with an action other
|
|
than allow or alert.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-318106</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where SCM did not update device telemetry for the
|
|
firewall after upgrading to an affected release.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-318030</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
<tt class="ph tt">VM-Series firewalls in Hyper-V only</tt>) Fixed an
|
|
issue where the throughput was reported to be twice as high as the
|
|
actual traffic rate.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-317867</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where Panorama became inaccessible and a manual reboot
|
|
was required to restore access. This occurred due rapid increase in
|
|
memory usage on the
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>reportd</a
|
|
>
|
|
process, which led to OOM events.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-317858</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Added a CLI command to address an issue where ethernet trailer padding
|
|
was not removed during IPv4-to-IPv6 packet translation. This occurred
|
|
when the original packet contained ethernet trailers and the
|
|
translated packet exceeded the minimum MTU.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-317772</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Added a fix to improve performance in lossy network conditions.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-317755</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on Panorama where selective push operations failed when
|
|
plugin configurations included access-domain or log-collector
|
|
references.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-317749</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the commit scope preview for a vsys incorrectly
|
|
displayed configuration changes made in other vsys, even when the
|
|
commit only applied changes to the intended vsys.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-317614</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where high throughput and increased packet rates caused
|
|
high dataplane CPU usage.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-317600</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt">Firewalls in HA configurations only</tt>) Fixed an
|
|
issue where autocommit operations took longer than expected to
|
|
complete when the firewalls were configured with multiple vsys and
|
|
EDLs. This occurred because the firewalls were unable to reach the DNS
|
|
server during the autocommit process.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-317583</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue with intermittent ICMP ping drops and packet loss in
|
|
traffic flows between a hub and branch after upgrading to an affected
|
|
PAN-OS release due to incorrect SD-WAN path monitor state.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-317548</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where an IMA violation occurred when Panorama accessed
|
|
GRUB during the installation process, which caused upgrades from
|
|
PAN-OS 12.1.4 to PAN-OS 12.1.5 to fail.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-317466</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where SIP sessions stopped progressing after the
|
|
firewall received fragmented packets, fragmented at header field.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-317372</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where custom administrators received an
|
|
<span class="ph uicontrol">access denied</span> error when attempting
|
|
to view specific policy rule details from the
|
|
<span class="ph uicontrol">Rule Shadow</span> tab after a push from
|
|
Panorama, even when the administrator had permissions to view Security
|
|
policy rules.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-317215</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt"
|
|
>VM-Series firewalls on ESXi with Intel E810 NICs using PCI
|
|
passthrough</tt
|
|
>) Fixed an issue where the
|
|
<span class="ph systemoutput">brdagent</span> process became
|
|
unresponsive during data port initialization, which resulted in system
|
|
instability, interface outages, HA split-brain conditions, and
|
|
unexpected reboots during failover.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-317177</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on firewalls in DHCP Client mode where, after upgrading
|
|
to an affected release, the SNMP process unexpectedly restarted after
|
|
a commit, which led to false interface flap notifications on SNMP
|
|
managers.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-317133</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where you were unable to generate a ticket for the
|
|
GlobalProtect portal.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-317068</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on the Panorama web interface where you were able to
|
|
enable IPv6 for IKE gateways and IPSec tunnels even when IPv6 WAN was
|
|
disabled, which resulted in an invalid configuration. To utilize this
|
|
fix, upgrade to the latest Panorama plugin.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-316978</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where system log error messages were displayed after
|
|
every firewall reboot, even when the firewall functioned correctly
|
|
after the reboot.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-316937</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where GlobalProtect users intermittently received
|
|
incorrect private IP addresses after connecting to a gateway behind a
|
|
Network Load Balancer (NLB).
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-316911</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt"
|
|
>VM-Series firewalls on Amazon Web Services (AWS) environments
|
|
only</tt
|
|
>) Fixed an issue where a newly bootstrapped firewall required a
|
|
management server restart, relicensing, or license push from Panorama
|
|
to invoke the device certificate.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-316856</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where an error message displayed when attempting to
|
|
delete the Logging Service certificate or view the Logging Service
|
|
customer information.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-316761</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>reportd</a
|
|
>
|
|
process timeout errors occurred during a manual management server
|
|
restart.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-316740</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where, after upgrading to an affected release, HCE
|
|
profiles exceeded the maximum character length when generated
|
|
automatically, which caused subsequent commit operations to fail with
|
|
a validation error. This occurred when HIP objects were associated
|
|
with HIP profiles prior to the upgrade.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-316718</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall stopped forwarding logs or
|
|
generating system and configuration logs to Panorama after restarting
|
|
the
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>mgmtsrvr</a
|
|
>
|
|
process.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-316631</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue BGP sessions experienced short disruptions across all
|
|
peers, interfaces, and slots when a multicast event persisted longer
|
|
than the NGP negotiated hold timers.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-316605</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where HIP redistribution to remote network nodes from
|
|
external gateways resulted in a large amount of error messages in
|
|
User-ID logs.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-316556</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where a race condition between the session ager and
|
|
packet processing resulted in memory corruption and caused the
|
|
pan_task process to stop responding, which resulted in the firewall
|
|
becoming unresponsive
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-316435</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall restarted unexpectedly due to an OOM
|
|
condition after upgrading to an affected release.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-316433</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on the web interface where the last digit of entries in
|
|
policy rule descriptions were truncated.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-316263</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where an incorrect validation error was displayed,
|
|
falsely indicating that IKE Gateway and IPSec tunnel names can begin
|
|
with a numeral
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-316120</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where, after Advanced Routing was enabled, the firewall
|
|
advertised routes to internal BGP neighbors with the original external
|
|
BGP next-hop address.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-316106</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt">Panorama appliances in Log Collector mode only</tt
|
|
>) Fixed an issue where commit validation failed after an upgrade when
|
|
the previous configuration included a
|
|
<span class="ph systemoutput">shared-optimization</span> setting.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-316070</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where a BGP peer automatically established a BGP
|
|
connection after manually adding it via the CLI when Advanced Routing
|
|
was enabled.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-315965</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue to address TCP proxy fast recovery behavior to follow
|
|
RFC 5681.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-315964</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on the web interface where you were unable to sort an
|
|
AS path list by its sequencing number (**Network > Routing >
|
|
Routing Profiles > Filters > Filters AS Path Access List*).
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-315958</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt">PA-1410 firewalls only</tt>) Fixed an issue where
|
|
the SaaS Quality Profile HTTP/HTTPS monitoring feature failed to send
|
|
probes due to the firewall being unable to determine the correct
|
|
egress interface and source IP address for the monitoring probes.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-315913</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where, after a User-ID restart on a redistribution
|
|
firewall, some expiring IP tag entries became permanent instead of
|
|
aging out as intended, which affected Dynamic Address Group policy
|
|
rule enforcement.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-315912</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the Maximum Segment Size (MSS) rewrite
|
|
functionality for packets ingressing through SD-WAN interfaces on
|
|
firewalls was not optimized.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-315424</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the BGP peer filter match condition incorrectly
|
|
identified neighbors in the Advanced routing Engine, which led to
|
|
incorrect Logical Preference assignments and illogical path
|
|
selections. This occurred when a BGP Inbound Route Map was configured
|
|
to prioritize a path from a specific peer by setting its
|
|
<span class="ph uicontrol">Local Reference</span>.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-315337</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where GlobalProtect throughput was reduced after an
|
|
upgrade.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-315326</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt">PA-7500 firewalls only</tt>) Fixed an issue where
|
|
zone protection threshold values per dataplane were unexpectedly low.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-315314</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where, when a push operation from Panorama to the
|
|
firewall failed, accounting logs stopped forwarding.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-315176</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Added an enable and disable CLI command to address an issue where the
|
|
firewall experienced increased packet drops and slower performance
|
|
after an upgrade due to high burst traffic.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-315160</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt">PA-7500 firewalls only</tt>) Fixed an issue where
|
|
internal path monitoring logs incorrectly reported internal path
|
|
monitoring failures when they did not occur.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-315134</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where, after an upgrade,
|
|
<span class="ph uicontrol">IoT Devices > Asset Inventory</span> did
|
|
not display device data even though the system reported a total count
|
|
of devices.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-315005</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where configured RIPv2 timer parameters were not
|
|
applied when the profile was configured with custom update, expire,
|
|
and delete values, and the system continued to use the default timer
|
|
settings, which caused unexpected route removal and network
|
|
disconnections.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-314873</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall intermittently stopped forwarding
|
|
traffic to the internet.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-314823</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the management interface became unresponsive when
|
|
attempting to untag an IP address via the web interface.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-314818</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall dropped IPv6 packets after enabling
|
|
<span class="ph uicontrol">Strict IP Check</span> under
|
|
<span class="ph uicontrol">Zone Protection</span> in an SD-WAN
|
|
configuration.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-314764</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where a shared object appeared in the push scope during
|
|
every push to devices even when it was not applicable to the committed
|
|
changes.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-314752</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on Panorama where, after removing a scheduled
|
|
configuration push, Panorama still initiated the push at its
|
|
previously scheduled time.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-314724</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the OpenConfig plugin was unavailable for
|
|
installation after installing PAN-OS due to the plugin package not
|
|
being included in the PAN-OS software bundle.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-314712</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt">PA-7500 Series firewalls only</tt>) Fixed an issue
|
|
where the source IP Dynamic Address Group mappings were intermittently
|
|
not displayed under
|
|
<span class="ph uicontrol">Monitor > Traffic logs</span>. This
|
|
occurred even when dynamic address groups were updated via XML API
|
|
without an expiry time and no unregister requests were observed.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-314630</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall repeatedly rebooted and entered
|
|
maintenance mode, and a factory reset was required.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-314623</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt"
|
|
>Firewalls in active/passive HA configurations only</tt
|
|
>) Fixed an issue where, after a failover, routing information within
|
|
OSPF protocol was not correctly translated or propagated, which
|
|
affected network path convergence and FRR capabilities.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-314512</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the GlobalProtect portal became inaccessible when
|
|
the dataplane was configured with a DHCP assigned IP address.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-314477</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where committing configuration changes failed due to
|
|
the
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>routed</a
|
|
>
|
|
process not responding.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-314435</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on the Panorama web interface where custom application
|
|
tags for cloud applications were not consistently displayed in the
|
|
Application Filter or application details even though the tags were
|
|
configured via CLI and successfully enforced traffic blocking policy
|
|
rules.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-314398</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt"
|
|
>PA-7500 firewalls in a cluster configuration only</tt
|
|
>) Fixed an issue where the firewall was unable to establish a TCP
|
|
connection to CDL endpoints, which prevented forwarding of traffic,
|
|
system, configuration, and threat logs to the CDL.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-314385</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt">Firewalls in active/passive HA clusters only</tt>)
|
|
Fixed an issue where high dataplane CPU usage occurred and traffic
|
|
offloading decreased when a failover occurred from the active firewall
|
|
to the passive firewall, and then back to the active firewall.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-314372</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where, when SSL Inbound Decryption was enabled, the
|
|
inbound SMTP email delivery to an internal mail server failed due to
|
|
the firewall silently dropping application packets containing SMTP
|
|
commands after successful decryption.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-314365</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>logrcvr</a
|
|
>
|
|
process stopped responding for traffic containing multiple XFF headers
|
|
when URL XFF header logging was enabled along with additional XFF
|
|
header logging, which caused subsequent commits to fail.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-314319</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Added a CLI command to enable and disable AHO software offload
|
|
optimization.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-314300</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall continued to send LLDP learned
|
|
information via SNMP for an interface even after disabling LLDP on
|
|
that interface. This occurred when a third-party tool polled SNMP and
|
|
it received outdated topology information.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-314223</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the Panorama web interface did not display all
|
|
Security policy rules when using a Chromium-based browser, and you
|
|
were unable to scroll to the bottom of the page to view the complete
|
|
list.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-314201</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on PAN-OS 12.1 releases where intermittent traffic
|
|
drops occurred over IPSec VPN tunnels to third-party firewalls during
|
|
the IPSec rekey due to the firewall failing to inform the peer to
|
|
delete the old SA after moving to the new one.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-314147</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where SSL traffic was dropped on SD-WAN DIA interfaces
|
|
with member having different MTU.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-314142</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where establishing log forwarding connections to the
|
|
Strata Logging Service (SLS) took longer than expected, which resulted
|
|
in delayed log visibility on SLS.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-314126</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where session rematch did not properly apply updated
|
|
Security policy rules to existing traffic flows after committing
|
|
changes, which caused traffic to still be allowed when a new Security
|
|
policy was set to <span class="ph uicontrol">Deny</span>.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-314020</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall did not decapsulate GENEVE packets
|
|
when DNS Security retransmitted a DNS query after receiving a verdict
|
|
from the cloud.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-314018</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt">VM-Series firewalls in AWS environments only</tt>)
|
|
Fixed an issue where the decrypt mirror port did not function
|
|
expected, which prevented decrypted traffic from reaching the intended
|
|
destination collector.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-313976</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on Panorama where traffic, URL, and unified log entries
|
|
were duplicated, which led to inaccurate Security logging after
|
|
applying a time filter for the previous 6 hours.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-313828</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall did not forward traffic due to
|
|
memory issues on a forwarding component.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-313827</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where a memory leak occurred related to the
|
|
<span class="ph systemoutput">reportd</span> process when custom
|
|
reports were run via API.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-313787</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where some system log filters with the
|
|
<span class="ph systemoutput">eventid</span> operator for a BGP event
|
|
did not work.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-313779</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt">PA-7500 Series only</tt>) Fixed an issue where the
|
|
<span class="ph systemoutput"
|
|
>request high-availability session-reestablish</span
|
|
>
|
|
CLI command did not work due to encryption not being supported on HA1
|
|
and HA1-backup interfaces.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-313700</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where an unexpected reboot occurred when Inline Cloud
|
|
Analysis was enabled in an Anti-Spyware and Vulnerability profile.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-313623</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the
|
|
<span class="ph systemoutput">/opt/pancfg/mgmt/ssl/private/</span>
|
|
directory on Palo Alto Networks devices with TPM support became 100%
|
|
utilized due to an accumulation of undeleted
|
|
<span class="ph systemoutput">.pub_pem</span> files. This occurred
|
|
because executing the
|
|
<span class="ph systemoutput">show device-certificate status</span>
|
|
CLI command initiated a process that generated these files but failed
|
|
to remove them, which prevented the fetching of new device
|
|
certificates.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-313606</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where Panorama pushed commits took longer than expected
|
|
to complete without displaying an error message when committing due to
|
|
slow cloud-app compilation.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-313575</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where 10G connections on built-in RJ45 interfaces
|
|
(ethernet1/1 through ethernet1/5) intermittently experienced interface
|
|
flapping when connected to Cisco switchports.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-313572</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
<tt class="ph tt">VM-Series firewalls only</tt>) Fixed an issue where
|
|
the dataplane restarted due to a segmentation fault.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-313523</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where generating a tech support file caused
|
|
GlobalProtect users to be forcibly logged out.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-313494</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where ARP entries remained in a
|
|
<span class="ph uicontrol">complete</span> state with a TTL of 0 on
|
|
the active-secondary node, which prevented affected devices from
|
|
reliably communicating when traffic routes routed through that node.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-313443</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where firewalls acting as an accumulation proxy sent a
|
|
server hello with an earlier TCP timestamp value than a preceding ACK
|
|
packet, which prevented successful session establishment. This
|
|
occurred when the client hello messages were split across multiple
|
|
network segments.
|
|
</div>
|
|
<div class="p">
|
|
To use this fix, run the CLI command
|
|
<span class="ph systemoutput"
|
|
>debug dataplane set ssl-decrypt accumulate-client-hello ts-relay
|
|
yes</span
|
|
>.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-313258</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where PIM multicast routing failed on appliances with
|
|
advanced routing enabled.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-313216</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where firewalls with Prisma Access incorrectly
|
|
displayed some traffic as unsanctioned in traffic logs for cloud
|
|
applications that were tagged as
|
|
<span class="ph systemoutput">sanctioned</span>.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-313193</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
<tt class="ph tt">Firewalls in Layer 2 mode only</tt>) Fixed an issue
|
|
where the new sessions were not able to be established due to the
|
|
firewall intermittently dropping valid MAC address entries for
|
|
specific VLANs when a manual switchover sent a high volume of traffic
|
|
to the firewall.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-313048</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the BGP default route was lost from the
|
|
forwarding table during a failover, which caused a temporary service
|
|
interruption.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-313036</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall dataplane continuously accumulated
|
|
packets in the <span class="ph systemoutput">ctd_pkt_queue</span> and
|
|
packet buffers, which caused resource exhaustion and prematurely
|
|
terminated sessions.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-312706</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewalls restarted due to a function lacking
|
|
a NULL-pointer sanity check.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-312697</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where firewalls intermittently failed to send all logs
|
|
to the SLS.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-312618</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall was unable to activate GlobalProtect
|
|
client software and displayed
|
|
<span class="ph systemoutput">SW LIMIT</span> messages related to
|
|
max-profiles and unsupported major and minor versions in the downgrade
|
|
list, which prevented successful software installation.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-312514</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where correlation logs were not forwarded via syslog or
|
|
email.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-312354</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where Captive Portal authentication redirects failed
|
|
for HTTPS traffic when a user attempted to access internal HTTPS
|
|
websites via URL, which led to
|
|
<span class="ph uicontrol">ERR_CONNECTION_RESET</span> error messages
|
|
in the browser with SSL decryption and CTD handshake inspection
|
|
enabled.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-312277</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where, after manually restarting the
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>mgmtsrvr</a
|
|
>
|
|
process caused the firewall to stop generating or forwarding system
|
|
and configuration logs to Panorama, and a reboot was required to
|
|
restore logging functionality.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-312267</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall lost its MAC entry which caused IPv6
|
|
traffic sessions to become unresponsive or drop. This occurred when
|
|
PBF rules were configured with symmetric return and
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>no-pbf</a
|
|
>.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-312156</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where firewalls did not correctly apply SD-WAN policy
|
|
rules, which caused traffic to be incorrectly routed via local
|
|
breakout instead of VPN backhaul.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-311938</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where autocommits failed after an upgrade due to
|
|
configuration memory allocation issues and 100% policy rule cache
|
|
usage when both DNS Rewrite and URL Custom Category Match were
|
|
configured.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-311658</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>reportd</a
|
|
>
|
|
process stopped responding, which caused the firewall to reboot.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-311512</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where HIP (Host Information Profile) reports were
|
|
blocked on GlobalProtect when
|
|
<span class="ph uicontrol"
|
|
>Authentication Cookie Usage Restrictions</span
|
|
>
|
|
was enabled and the Prisma Access Agent protocol was in use. This
|
|
occurred because the system failed to correctly process HIP messages
|
|
that were relayed via IPSec tunnels with a Virtual IP as the source,
|
|
leading to their rejection.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-311456</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Enhanced the SCP-based export script by adding comprehensive logging
|
|
to identify and diagnose the root cause for failed or incomplete
|
|
traffic log exports.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-311449</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where global search did not return comprehensive
|
|
results after an upgrade and only displayed top-level objects.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-311419</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the recommended filter for identifying traffic
|
|
from unidentified users in traffic logs reported an incorrectly low
|
|
number of results.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-311412</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the
|
|
<span class="ph systemoutput">show advanced-routing resource</span>
|
|
CLI command failed to execute successfully when invoked through the
|
|
XML API and returned an error message.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-311352</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue in SD-WAN deployments where DIA traffic was disrupted
|
|
when DIA AnyPath was enabled during path transitions from the SD-WAN
|
|
VIF to the physical interface. With this fix, the
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>drop the packet even on zone change</a
|
|
>
|
|
configuration is not needed to prevent interrupted DIA traffic during
|
|
path switching.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-311285</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where a memory leak occurred related to the
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>ospfd</a
|
|
>
|
|
process, which caused RAM usage to continuously increase until the
|
|
device stopped responding.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-311261</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall generated duplicate URL Filtering
|
|
logs due to an error condition when the new XFF feature was
|
|
enabled.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-311250</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt">Panorama appliances and Log Collectors only</tt>)
|
|
Fixed an issue where logs from multiple devices were not visible on
|
|
Panorama even though the Elasticsearch health status on the dedicated
|
|
Log Collectors appeared green.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-311248</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the ABR failed to translate and advertise the
|
|
default route (0.0.0.0/0) from an OSPF NSSA area into the OSPF
|
|
backbone area as a Type-5 LSA.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-311218</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on Panorama where a system health check Security policy
|
|
rule was applied to <span class="ph uicontrol">any</span> zones
|
|
instead of <span class="ph uicontrol">Public</span> or
|
|
<span class="ph uicontrol">Private</span>.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-311205</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where XML queries failed when you attempted to compare
|
|
configuration versions.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-311166</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall rebooted unexpectedly to the
|
|
<span class="ph systemoutput">all_task_1</span> process repeatedly
|
|
restarting.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-311113</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall was unable to clear sessions using
|
|
the CLI command
|
|
<span class="ph systemoutput">clear session all filter rule</span>
|
|
when the specified rule name exceeded 32 characters, even though the
|
|
limit is 63 characters.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-311098</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where firewalls entered a nonfunctional state due to L7
|
|
running out of resources due to a high volume of traffic.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-311074</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where GRE tunnels took significantly longer to
|
|
establish when the hold timer was configured to a value of 10 or
|
|
higher, which resulted in a tunnel requiring more successful keepalive
|
|
packets than expected to transition to an
|
|
<span class="ph uicontrol">Up</span> state.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-311040</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>all_task</a
|
|
>
|
|
process stopped responding and caused the firewall to reboot
|
|
unexpectedly.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-310851</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where firewalls experienced
|
|
<span class="ph systemoutput">snmpd</span> log flooding with messages
|
|
such as
|
|
<span class="ph systemoutput"
|
|
>update_ifTable_utilization_rates(pan_interfacecache.c:1720): Last
|
|
time is 0 for dedicated-ha2.</span
|
|
>, which caused the <span class="ph systemoutput">snmpd</span> log to
|
|
overflow and be cleared every five minutes. This occurred because the
|
|
<span class="ph systemoutput">snmpd</span> process attempted to
|
|
calculate interface utilization rates without first verifying if the
|
|
interface had valid
|
|
<span class="ph systemoutput">sysd</span> configuration data, as the
|
|
code incorrectly assumed all interfaces in the MIB would possess valid
|
|
<span class="ph systemoutput">sysd</span> data.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-310743</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where you were unable to change an administrator's
|
|
authentication profile to <span class="ph uicontrol">None</span>.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-310526</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where you were unable to download cellular firmware
|
|
through Panorama.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-310473</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where committing configuration changes to an Advanced
|
|
Logical router caused a 20-30 second loss of management access in the
|
|
firewall when IPv4 and IPv6 default static routes were configured with
|
|
identical attributes including interface, next-hop, and metrics, which
|
|
triggered an unnecessary routing table refresh.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-310472</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on the web interface where checkboxes for
|
|
<span class="ph uicontrol">default information originate</span> and
|
|
ABR in OSPF NSSA configurations were automatically enabled which
|
|
resulted in unexpected configuration changes.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-310452</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where a configuration setting was not reset to its
|
|
default value after an upgrade, which caused pre-checks and
|
|
post-checks to fail.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-310362</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where IPv6 Routed HA did not function correctly when
|
|
the HA1 (control link) was configured with an IPv6 routed connection.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-310267</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where a process stopped responding during Go garbage
|
|
collection (GC).
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-310240</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where software packet buffers were completely utilized
|
|
when performing a Data Loss Prevention longevity test.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-309960</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where a memory leak related to the
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>useridd</a
|
|
>
|
|
process on the passive device led to an OOM condition.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-309944</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where an error message was incorrectly displayed
|
|
instead of a debug message.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-309927</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on Panorama where the
|
|
<span class="ph systemoutput">multi-clone</span> XML API operation
|
|
reported a successful configuration change even when the specific
|
|
device group did not exist.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-309828</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where, after a firewall serial number was updated via
|
|
Panorama, a subsequent policy rule push from Panorama incorrectly
|
|
deleted target policy rules from managed firewalls with the updated
|
|
serial numbers.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-309676</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on Panorama where a database component unexpectedly
|
|
stopped when Panorama was deployed using an .ova file or
|
|
upgraded/downgraded to an affected PAN-OS version. This occurred due
|
|
to a required directory not being created during the initial
|
|
provisioning workflow. With this fix, the necessary directory is
|
|
created automatically during deployment.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-309493</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the URL cloud connection was impacted, which
|
|
caused a traffic outage.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-309300</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where management plane system resources configuration
|
|
size exceeded 28 MB for over 4 hours, and the following error message
|
|
was displayed:
|
|
<span class="ph systemoutput"
|
|
>Configuration size reaching device capacity limit</span
|
|
>.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-308928</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where OSPF routes did not install correctly when you
|
|
performed a traffic switch between firewalls with the Advanced Routing
|
|
Engine enabled, which led to routing instability.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-308876</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where upgrades to managed firewalls from Panorama
|
|
failed.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-308775</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt">Firewalls in active/passive configurations only</tt
|
|
>) Fixed an issue where NTP status intermittently showed as rejected
|
|
on the active firewall, which prevented the firewalls from
|
|
synchronizing time.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-308732</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt">Multi-vsys firewalls only</tt>) Fixed an issue
|
|
where GlobalProtect clients were unable to use custom source region
|
|
objects for gateway selection criteria due to region objects defined
|
|
in Panorama not being correctly recognized or displayed in the
|
|
GlobalProtect Portal configuration.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-308711</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where superusers with read-only privileges on Panorama
|
|
were unable to execute
|
|
<span class="ph systemoutput">show device-certificate</span> CLI
|
|
commands.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-308651</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on the firewall web interface where the TLSv1.3_Default
|
|
certificate setting and SSL/TLS profile were not displayed."
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-308563</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where multiple
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>pan_task</a
|
|
>
|
|
processes attempted to clear the packet queue of the same session.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-308507</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt">Panorama managed firewalls only</tt>) Fixed an
|
|
issue where the firewall intermittently failed to maintain active log
|
|
forwarding streams to Strata Logging Service (SLS) even when duplicate
|
|
logging and enhanced application logging were enabled.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-308461</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the CLI command
|
|
<span class="ph systemoutput"
|
|
>request system software download to-version <version></span
|
|
>
|
|
failed to download multiple software images due with a
|
|
<span class="ph systemoutput"
|
|
>Download terminated due to timeout</span
|
|
>
|
|
error message.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-308444</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where pushing multiple policy rules failed when the
|
|
policy rules contained a large number of dynamic address object groups
|
|
or user groups.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-308418</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where, when Advanced DNS Security was enabled and
|
|
experienced unusually high loads, DNS resolution failures occurred
|
|
with the error
|
|
<span class="ph uicontrol">resources-unavailable</span>.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-308377</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt"
|
|
>PA-7000 Series firewalls with an LFC in HA configurations only</tt
|
|
>) Fixed an issue where the firewall reached 100% disk utilization due
|
|
to the
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>logrcvr</a
|
|
>
|
|
process repeatedly restarting and dumping core files due to a blocked
|
|
hints processing thread, which caused a failover.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-308261</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall failed to send SNMPv3 traps when the
|
|
SNMP destination was configured with an FQDN that resolved to multiple
|
|
IP address through DNS load balancing.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-307937</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on the web interface where the global filter set in
|
|
<span class="ph uicontrol">ACC > Threat Activity</span> did not
|
|
apply when you navigated to the
|
|
<span class="ph uicontrol">Network Activity</span> tab.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-307773</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on Panorama where enabling Post-Quantum Pre-Shared Key
|
|
(PPK) within an IKE Gateway profile that was configured as a part of a
|
|
template stack failed or was inconsistent when attempted via the web
|
|
interface, even when the keys were properly configured.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-307717</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on Panorama where administrators were unable to
|
|
override SNMP setup configurations within device groups due to the
|
|
configured override not being retained.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-307618</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Added a debug CLI command to address where remote networks for Prisma
|
|
Access tenants randomly dropped monitoring packets from peer devices,
|
|
which caused tunnels to be marked as down. This occurred when a CPU
|
|
core suddenly experienced high utilization.
|
|
</div>
|
|
<div class="p">
|
|
To utilize this fix, run
|
|
<span class="ph systemoutput"
|
|
>debug dataplane set ssl-decrypt use-new-peek-window yes</span
|
|
>.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-307491</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall entered maintenance mode after a
|
|
reboot when ZTP was enabled.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-307470</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where an External Dynamic List (EDL) fetch with an
|
|
invalid certificate was skipped on newly provisioned GlobalProtect
|
|
gateway instances.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-306533</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where system logging for NTP events was delayed by
|
|
approximately 15 minutes.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-306356</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>logrcvr</a
|
|
>
|
|
process on a firewall stopped responding due to a document node being
|
|
unexpectedly freed.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-306217</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on Panorama where scheduled reports with specific
|
|
queries did not include any data.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-305950</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where, when attempting to install software upgrades on
|
|
managed firewalls via
|
|
<span class="ph uicontrol">Device Deployments</span>, Panorama
|
|
incorrectly reported that the firewalls did not have valid support
|
|
licenses.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-305619</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where HTTP management access appeared to fail and
|
|
incorrectly displayed the error message
|
|
<span class="ph uicontrol">Error 503: Service Unavailable</span> even
|
|
though it functioned correctly as allowed. This occurred when an
|
|
interface was configured with an address object.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-305369</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall dropped packets due to an invalid
|
|
interface when attempting to ping the next-hop gateway from a VLAN
|
|
interface due to the firewall incorrectly resolving the ARP for the
|
|
gateway on an unintended interface.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-305240</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where User-ID redistribution clients experienced delays
|
|
in establishing initial communication with the redistribution server,
|
|
which caused connection timeouts.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-304718</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where OSPF and BGP outages occurred due to an
|
|
<span class="ph systemoutput">all_task</span> process restart during
|
|
clientless VPN content rewrite processing.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-304360</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall did not redistribute its application
|
|
routes to BGP peers. This occurred in multi-mesh deployments with the
|
|
multi-cloud networking feature enabled.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-303662</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where PA-455 firewalls running PAN-OS 11.2.4-h7
|
|
intermittently failed to generate system logs and trigger an HA
|
|
failover when a link-monitored interface was unplugged, despite the
|
|
interface's status being reflected as down on the GUI.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-303173</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt">Firewalls in Advanced Routing mode only</tt>) Fixed
|
|
an issue where OSPF sessions using MD5 authentication experienced
|
|
intermittent flapping due to out-of-order packets.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-302855</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where multiple processes restarted which caused the
|
|
firewall to become unstable when processing traffic.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-302834</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where Panorama did not display decryption logs after a
|
|
certain date due to the decryption index being purged.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-302512</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt">Log Collectors in HA configurations only</tt>)
|
|
Fixed an issue where log collectors displayed a disconnected inter-log
|
|
collector status.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-302387</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where on PA-7500 firewalls, SNMP incorrectly reported
|
|
the administrative and operational status of High Speed Chassis
|
|
Interconnect (HSCI) interfaces as down, even when the interfaces were
|
|
physically up. Additionally, interface counters for these interfaces
|
|
displayed all zeroes.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-302150</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt">Panorama appliances only</tt>) Fixed an issue where
|
|
you were unable to successfully configure log collector groups due to
|
|
the master node settings not populating automatically.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-301513</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on Panorama managed multi-vsys firewalls where, when
|
|
the shared-to-shared feature was enabled, shared objects reverted to
|
|
an older configuration after a selective push to a vsys.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-300617</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the Elasticsearch cluster status displayed as red
|
|
due to unassigned shards, which prevented logs from updating.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-300615</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>pan_comm</a
|
|
>
|
|
process stopped after multiple content versions were installed and the
|
|
memory limits were reached.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-300445</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall downloaded an Antivirus package but
|
|
did not automatically install it.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-300423</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where Data Processing Cards (DPCs) installed in slots 5
|
|
and 6 remained stuck in a starting state with the error
|
|
<span class="ph uicontrol"
|
|
>Signal detected for port xeS5-DP0 but Link Down</span
|
|
>
|
|
alerts, which resulted in device instability.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-298960</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall continuously rebooted when the
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>useridd</a
|
|
>
|
|
process repeatedly restarted.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-298788</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the /pancfg partition on the Azure Cloud NGFW
|
|
reached 100% utilization, which caused commit failures.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-298252</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where Data Loss Prevention (DLP) inspection of chunked
|
|
transfer encoding over TLS resulted in incomplete file downloads on
|
|
Outlook Web App (OWA) due to the WIF page size limit, which led to
|
|
corrupted or incomplete PDF attachments.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-297819</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall was unable to send device telemetry
|
|
files to Cortex Data Lake due to the firewall receiving an invalid
|
|
upload token.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-296635</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>reportd</a
|
|
>
|
|
process on passive Panorama management servers leaked memory due to
|
|
scheduled report handling from the Strata Logging Service (SLS). This
|
|
memory leak occurred daily, consuming available memory until the
|
|
process was restarted.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-296246</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where policy cache corruption led to unexpected policy
|
|
rule behavior or operational instability. This occurred when an
|
|
internal system process restarted while a commit was in progress or
|
|
when a commit operation failed.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-295806</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where memory leaks on the
|
|
<span class="ph systemoutput">configd</span> process occurred due to a
|
|
hash insert operation failing during connection management and SSL
|
|
connections.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-295082</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on the Panorama web interface where you were unable to
|
|
delete or change a logical router for tunnel, SD-WAN, VLAN, or
|
|
loopback interfaces under a template.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-295047</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>staticd</a
|
|
>
|
|
process stopped responding.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-294998</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the LogDB incorrectly reported that the database
|
|
quota for <span class="ph systemoutput">extpcap</span> logs was
|
|
reached.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-294434</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where memory leaks occurred. These leaks were caused by
|
|
two distinct scenarios: the failure to deallocate memory for a nodeset
|
|
when a new nodeset was assigned to the same variable, and the failure
|
|
to free a UUID hash table during error conditions.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-293586</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt">Panorama virtual appliances only</tt>) Introduced a
|
|
CLI command to increase the limit of user types from 1 million to 3.6
|
|
million.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-292447</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where Panorama did not display data in the
|
|
<span class="ph uicontrol">Feature Adoption</span> tab in Strata Cloud
|
|
Manager due to the system creating and deleting a CLI user for each
|
|
interval instead of reusing a permanent CLI user for telemetry.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-292220</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the Status LED on PA-7500 SFCs did not work.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-292191</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall dropped packets related to call
|
|
recording and voice calls, which resulted in communication failures,
|
|
retransmissions, and disconnected calls. This occurred when the
|
|
firewall was positioned between a Private Branch Exchange and an AES
|
|
server and users registered phones across different data centers.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-291785</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>all_task</a
|
|
>
|
|
process stopped responding.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-291284</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where single-session IPSec VPN traffic was distributed
|
|
across multiple member interfaces of a Link Aggregation Group
|
|
configured with LACP. This resulted in packet reordering and loss,
|
|
which impacted VPN performance.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-290712</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
(<tt class="ph tt">PA-7500 Firewalls in cluster mode only</tt>) Fixed
|
|
an issue where the firewall incorrectly advertised BGP routes back to
|
|
the external BGP peer, which resulted in routing inefficiency.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-289578</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on Panorama managed firewalls where the source user,
|
|
source device vendor, source MAC address, and OS version information
|
|
were not visible in traffic logs and SCM when the user and device
|
|
access control lists were empty.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-289460</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the timestamp value in SNMPv3 trap headers was
|
|
incorrect.
|
|
</div>
|
|
<div class="p">
|
|
To use this fix, run the CLI command
|
|
<span class="ph systemoutput"
|
|
>debug log-receiver enginetime-from-snmptime yes</span
|
|
>.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-287280</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where a
|
|
<span class="ph systemoutput">configd</span> crash occurred when the
|
|
<span class="ph uicontrol">Policies > Security</span> view was
|
|
updated or refreshed in the web interface.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-283704</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the PAN-OS DoS protection feature by default
|
|
blacklisted specific IP addresses, which caused outbound traffic
|
|
domain resolution to fail for clusters.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-282335</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where firewalls in a cluster experienced approximately
|
|
50% packet loss on IPSec NATT tunnels when tunnel acceleration was
|
|
enabled.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-280196</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue in Prisma Access environments where the firewall
|
|
matched a HIP object but not on the HIP profile that contained the
|
|
object.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-274622</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on the Panorama web interface where GlobalProtect
|
|
client images were not exported via SCP.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-273805</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where SAML authentication for GlobalProtect failed when
|
|
the GlobalProtect portal was accessed externally on a non-standard
|
|
port.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-273028</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where manual SCP exports from firewalls in FIPS mode
|
|
were successful to SCP servers that were not FIPS-compliant. This
|
|
occurred because the manual SCP process did not enforce FIPS security
|
|
checks.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-272175</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where session rematch caused ACE cloud application
|
|
traffic to match the wrong policy.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-266843</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue on airgapped firewalls where cloud connection errors
|
|
flooded the system logs.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-264762</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the firewall showed the status of SFP+ interfaces
|
|
as not up, or up but not configured, when a PAN-SFP-PLUS-SR cable was
|
|
connected.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-264349</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where the Management Processor Card (MPC) on modular
|
|
firewalls became unresponsive when a disk drive entered a low-power
|
|
state and failed to wake up.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-260661</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where daily email reports generated from the custom
|
|
report did not display the report details in PDF or CSV files.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr class="row rowsep">
|
|
<td class="entry"><div class="p">PAN-250445</div></td>
|
|
<td class="entry relcol">
|
|
<div class="p">
|
|
Fixed an issue where DLP logs accumulated in the
|
|
<a
|
|
class="term"
|
|
href="#"
|
|
title=""
|
|
data-scope=""
|
|
data-format="dita"
|
|
data-type=""
|
|
target="_self"
|
|
>logrcvr</a
|
|
>
|
|
cache when using DLP in mirror mode.
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|