Issue ID	Description
PAN-309392	Fixed an issue where the scroll bar did not appear when editing Destination Addresses for Policy Based forwarding policy rules.
PAN-309379	Fixed an issue where the logrcvr process stopped responding on DPCs, which prevented logs from being forwarded.
PAN-308085	(`VM-Series firewalls in Microsoft Azure environments only`) Fixed an issue where, after resizing the VM, the HA2 link became unstable. Frequent keep-alive failures occurred, and HA2 keep-alive packets were simultaneously transmitted to multiple destination MAC addresses and the peer firewall's interface MAC). This issue occurred on firewalls with Accelerated Networking enabled.
PAN-308060	(`Firewalls in active/active HA configurations only`) Fixed an issue where the BFD session went down and did not recover even though the BGP remained in an established state, which caused the firewall to cease route learning and advertisement with the peer, even though BGP keep-alives were exchanged correctly.
PAN-307795	Fixed an issue where Panorama incorrectly generated system logs indicating a lost connection to its peer after an upgrade even when High Availability was not configured.
PAN-305835	Fixed an issue where firewalls with Memory Integrity Checking Architecture enabled rebooted unexpectedly due to accessing an invalid memory address. This occurred because the forwarding data structure index exceeded its designed limit.
PAN-305412	Fixed an issue where the Logging Service License Status displays a license failure when the license status transitions from valid to expired and then back to valid even when the connection to the Security Logging Service (SLS) was working.
PAN-305301	Fixed an issue where the timing of GlobalProtect lifetime expiry or inactivity logout notifications used for GlobalProtect SSL tunnels could cause the pan_task process to stop responding and the dataplane to restart.
PAN-304636	Fixed an issue where BGP aggregate routes were not created and discard routes were not installed in the routing table.
PAN-303959	Fixed an issue where traffic is incorrectly identified as unknown-tcp/unknown-udp due to App-ID resource leak and eventually dropped.
PAN-303627	Fixed an issue where, after committing a configuration change, the firewall experienced traffic issues, pan_task crashes, and LACP interface failures.
PAN-303559	Fixed an issue where, after manuallly creating a device telemetry bundle, the hour_cli_output.txt file within the bundle had a file size of 0 bytes. This occurred when checking the bundle content after enabling device telemetry and setting the device telemetry upload endpoint.
PAN-302551	Fixed an issue where the firewall displayed as disconnected in the SLS due to the serial number not being retrieved
PAN-301975	(`Firewalls in HA configurations only`) Fixed an issue where the passive firewall incorrectly triggered PBP alerts even with low packet rates.
PAN-301937	Fixed an issue where Microsoft Defender for Cloud detected cleartext SSH private keys in the /var/appweb and /etc/appweb directories on PA-VM firewalls deployed in Azure.
PAN-301912	Fixed an issue where Panorama stopped responding when deploying dynamic updates to managed devices.
PAN-301600	Fixed an issue on the firewall where, after upgrading Panorama, OSPF adjacencies remained in the exchange start state, which resulted in an incomplete routing table.
PAN-301456	Fixed an issue on Panorama where the debug system reset-ztp CLI command was unavailable.
PAN-301409	Fixed an issue where Panorama failed to perform a selective push to a managed device when device tags were added or modified on the policy rules. The selective push failed with the error message Failed to generate selective push configuration. Schema validation failed. Please try a full push.
PAN-300837	Fixed an issue where firewalls experienced multiple reboots due to the pan_task process restarting with a SIGSEGV signal. This occurred because the client-to-firewall side assumed TLS 1.3 for the firewall-server side.
PAN-299751	Fixed an issue where the firewall was unable to connect to the Subscription License Service (SLS) due to a public and private key pair mismatch with the device certificate.
PAN-299622	Fixed an issue where the MFA timestamp was not redistributed between standalone firewalls behind an Azure load balancer after upgrading, which resulted in users being prompted to reauthenticate multiple times.
PAN-298907	Fixed an issue on PA-VM in AWS where, in a two-arm deployment integrated with Gateway Load Balancer (GWLB), the firewall did not preserve the GENEVE source port for internet traffic, resulting in increased latency. The fix ensures the firewall preserves the outer UDP source port of GENEVE encapsulation when sending traffic back to GWLB.
PAN-297263	(`PA-5220 firewalls only`) Fixed an issue where the ikemgr process crashed intermittently, causing IPSec tunnels to go down randomly. The fix ensures that the IKE security association data structures are accessed in a thread-safe manner. This prevents the ikemgr process from referencing an invalid memory pointer during teardown operations and provides stability.
PAN-296208	Fixed an issue where the firewall did not accept address groups in the filter condition of a Log Forwarding Match list.
PAN-295796	Fixed an issue where the firewall intermittently failed to forward VXLAN GARP packets, which led to connectivity issues for wireless clients in environments that used VXLAN tunnels for wireless access points.
PAN-292447	Fixed an issue where Panorama did not display data in the Feature Adoption tab in Strata Cloud Manager due to the system creating and deleting a CLI user for each interval instead of reusing a permanent CLI user for telemetry.
PAN-291067	Fixed an issue where the devsrvr process periodically exceeded its virtual memory limit and restarted, which led to intermittent outages.
PAN-290241	Fixed an issue where the useridd process became unresponsive, which caused User-ID CLI commands to time out.
PAN-290235	Fixed an issue where the dscd process crashed continuously on MIPS platforms (for example, PA-850 firewalls) due to a runtime error related to an invalid memory address or nil pointer dereference. This was caused by a golang library upgrade in CIE that is incompatible with the MIPS platform.
PAN-289652	Fixed an issue related to external URL lists where pushing configuration changes from Panorama failed.
PAN-288427	Fixed an issue on Panorama where commit jobs were not queued and the system reported that the useridd was not connected.
PAN-287921	(`VM-Series firewalls only`) Fixed an issue where the maximum registered IP address for was incorrectly set to 100,000 instead of the expected 500,000.
PAN-285208	Fixed an issue where the firewall did not automatically recover after a machine check exception (MCE) occurred.
PAN-283237	Fixed an issue where traffic logs incorrectly displayed the action as allow for traffic matching a Security policy rule configured with the action set to deny. This issue occurred due to the child session being used for policy rule lookup when a configuration update triggered a rematch if the FTP-data application was not in the rule.
PAN-281588	Fixed an issue where packet buffer depletion occurred due to the a high number of tcp_pkt_queued packets when Jumbo was enabled.
PAN-277464	Fixed an issue with intermittent access and slower than expected loading times when accessing websites. This occurred when Anti-Spyware inline cloud analysis was enabled and the SSL Command and Control action was not either allow or alert and server hello packets were out of order.
PAN-269535	Fixed an issue where the mib ID returned an incorrect value via SNMP.
PAN-263691	Fixed an issue where the firewall rebooted unexpectedly due to a memory leak in the all_task process.
PAN-262831	(`PA-5400f Series firewalls only`) Fixed an intermittent issue where the all_task process stopped responding, which caused the firewall to restart.
PAN-255654	Fixed an issue where, when QoS was enabled on aggregate interfaces, the maximum aggregate interface throughput was capped, which limited network traffic. This occurred even with default QoS settings and no configured egress max-bandwidth.
PAN-236794	Fixed an issue where SNMP walk reported incorrect interface speeds.
PAN-185731	Fixed an issue where the firewall was unable to parse the URL path and host when the host header was located in a different packet, which resulted in the firewall not logging the URL path in the first packet. The fix is disabled by default. The following CLI commands can be used to enable/disable the feature: set system setting ctd url-crosspkt-host-path-caching enable set system setting ctd url-crosspkt-host-path-caching disable set system setting ctd url-crosspkt-host-path-caching default

Issue ID

Description

PAN-309392

Fixed an issue where the scroll bar did not appear when editing Destination Addresses for Policy Based forwarding policy rules.

PAN-309379

Fixed an issue where the logrcvr process stopped responding on DPCs, which prevented logs from being forwarded.

PAN-308085

(VM-Series firewalls in Microsoft Azure environments only) Fixed an issue where, after resizing the VM, the HA2 link became unstable. Frequent keep-alive failures occurred, and HA2 keep-alive packets were simultaneously transmitted to multiple destination MAC addresses and the peer firewall's interface MAC). This issue occurred on firewalls with Accelerated Networking enabled.

PAN-308060

(Firewalls in active/active HA configurations only) Fixed an issue where the BFD session went down and did not recover even though the BGP remained in an established state, which caused the firewall to cease route learning and advertisement with the peer, even though BGP keep-alives were exchanged correctly.

PAN-307795

Fixed an issue where Panorama incorrectly generated system logs indicating a lost connection to its peer after an upgrade even when High Availability was not configured.

PAN-305835

Fixed an issue where firewalls with Memory Integrity Checking Architecture enabled rebooted unexpectedly due to accessing an invalid memory address. This occurred because the forwarding data structure index exceeded its designed limit.

PAN-305412

Fixed an issue where the Logging Service License Status displays a license failure when the license status transitions from valid to expired and then back to valid even when the connection to the Security Logging Service (SLS) was working.

PAN-305301

Fixed an issue where the timing of GlobalProtect lifetime expiry or inactivity logout notifications used for GlobalProtect SSL tunnels could cause the pan_task process to stop responding and the dataplane to restart.

PAN-304636

Fixed an issue where BGP aggregate routes were not created and discard routes were not installed in the routing table.

PAN-303959

Fixed an issue where traffic is incorrectly identified as unknown-tcp/unknown-udp due to App-ID resource leak and eventually dropped.

PAN-303627

Fixed an issue where, after committing a configuration change, the firewall experienced traffic issues, pan_task crashes, and LACP interface failures.

PAN-303559

Fixed an issue where, after manuallly creating a device telemetry bundle, the hour_cli_output.txt file within the bundle had a file size of 0 bytes. This occurred when checking the bundle content after enabling device telemetry and setting the device telemetry upload endpoint.

PAN-302551

Fixed an issue where the firewall displayed as disconnected in the SLS due to the serial number not being retrieved

PAN-301975

(Firewalls in HA configurations only) Fixed an issue where the passive firewall incorrectly triggered PBP alerts even with low packet rates.

PAN-301937

Fixed an issue where Microsoft Defender for Cloud detected cleartext SSH private keys in the /var/appweb and /etc/appweb directories on PA-VM firewalls deployed in Azure.

PAN-301912

Fixed an issue where Panorama stopped responding when deploying dynamic updates to managed devices.

PAN-301600

Fixed an issue on the firewall where, after upgrading Panorama, OSPF adjacencies remained in the exchange start state, which resulted in an incomplete routing table.

PAN-301456

Fixed an issue on Panorama where the debug system reset-ztp CLI command was unavailable.

PAN-301409

Fixed an issue where Panorama failed to perform a selective push to a managed device when device tags were added or modified on the policy rules. The selective push failed with the error message Failed to generate selective push configuration. Schema validation failed. Please try a full push.

PAN-300837

Fixed an issue where firewalls experienced multiple reboots due to the pan_task process restarting with a SIGSEGV signal. This occurred because the client-to-firewall side assumed TLS 1.3 for the firewall-server side.

PAN-299751

Fixed an issue where the firewall was unable to connect to the Subscription License Service (SLS) due to a public and private key pair mismatch with the device certificate.

PAN-299622

Fixed an issue where the MFA timestamp was not redistributed between standalone firewalls behind an Azure load balancer after upgrading, which resulted in users being prompted to reauthenticate multiple times.

PAN-298907

Fixed an issue on PA-VM in AWS where, in a two-arm deployment integrated with Gateway Load Balancer (GWLB), the firewall did not preserve the GENEVE source port for internet traffic, resulting in increased latency. The fix ensures the firewall preserves the outer UDP source port of GENEVE encapsulation when sending traffic back to GWLB.

PAN-297263

(PA-5220 firewalls only) Fixed an issue where the ikemgr process crashed intermittently, causing IPSec tunnels to go down randomly. The fix ensures that the IKE security association data structures are accessed in a thread-safe manner. This prevents the ikemgr process from referencing an invalid memory pointer during teardown operations and provides stability.

PAN-296208

Fixed an issue where the firewall did not accept address groups in the filter condition of a Log Forwarding Match list.

PAN-295796

Fixed an issue where the firewall intermittently failed to forward VXLAN GARP packets, which led to connectivity issues for wireless clients in environments that used VXLAN tunnels for wireless access points.

PAN-292447

Fixed an issue where Panorama did not display data in the Feature Adoption tab in Strata Cloud Manager due to the system creating and deleting a CLI user for each interval instead of reusing a permanent CLI user for telemetry.

PAN-291067

Fixed an issue where the devsrvr process periodically exceeded its virtual memory limit and restarted, which led to intermittent outages.

PAN-290241

Fixed an issue where the useridd process became unresponsive, which caused User-ID CLI commands to time out.

PAN-290235

Fixed an issue where the dscd process crashed continuously on MIPS platforms (for example, PA-850 firewalls) due to a runtime error related to an invalid memory address or nil pointer dereference. This was caused by a golang library upgrade in CIE that is incompatible with the MIPS platform.

PAN-289652

Fixed an issue related to external URL lists where pushing configuration changes from Panorama failed.

PAN-288427

Fixed an issue on Panorama where commit jobs were not queued and the system reported that the useridd was not connected.

PAN-287921

(VM-Series firewalls only) Fixed an issue where the maximum registered IP address for was incorrectly set to 100,000 instead of the expected 500,000.

PAN-285208

Fixed an issue where the firewall did not automatically recover after a machine check exception (MCE) occurred.

PAN-283237

Fixed an issue where traffic logs incorrectly displayed the action as allow for traffic matching a Security policy rule configured with the action set to deny. This issue occurred due to the child session being used for policy rule lookup when a configuration update triggered a rematch if the FTP-data application was not in the rule.

PAN-281588

Fixed an issue where packet buffer depletion occurred due to the a high number of tcp_pkt_queued packets when Jumbo was enabled.

PAN-277464

Fixed an issue with intermittent access and slower than expected loading times when accessing websites. This occurred when Anti-Spyware inline cloud analysis was enabled and the SSL Command and Control action was not either allow or alert and server hello packets were out of order.

PAN-269535

Fixed an issue where the mib ID returned an incorrect value via SNMP.

PAN-263691

Fixed an issue where the firewall rebooted unexpectedly due to a memory leak in the all_task process.

PAN-262831

(PA-5400f Series firewalls only) Fixed an intermittent issue where the all_task process stopped responding, which caused the firewall to restart.

PAN-255654

Fixed an issue where, when QoS was enabled on aggregate interfaces, the maximum aggregate interface throughput was capped, which limited network traffic. This occurred even with default QoS settings and no configured egress max-bandwidth.

PAN-236794

Fixed an issue where SNMP walk reported incorrect interface speeds.

PAN-185731

Fixed an issue where the firewall was unable to parse the URL path and host when the host header was located in a different packet, which resulted in the firewall not logging the URL path in the first packet. The fix is disabled by default. The following CLI commands can be used to enable/disable the feature:

set system setting ctd url-crosspkt-host-path-caching enable
set system setting ctd url-crosspkt-host-path-caching disable
set system setting ctd url-crosspkt-host-path-caching default