---
type: Addressed
product: PAN-OS
version: 11.2.7
---

## PAN-290803

```caveat
VM-Series firewalls on Microsoft Azure environments only
```

Fixed an issue where firewall failed to bootstrap with a custom image, and VM-Series plugin information was not displayed in the system information.

## PAN-290542

Fixed an issue where the all_task process stopped responding when an additional header logging HTTP header was split across 2 packets.

## PAN-290239

```caveat
PA-455 firewalls in active/passive high availability (HA) configurations only
```

Fixed an issue where, after an upgrade, the TCP session for syslog forwarding did not resume after the syslog server service was disabled and then re-enabled, which caused logs to be dropped. This occurred when the syslog server was down for more than 16 minutes.

## PAN-289102

```caveat
PA-7500 Series, PA-5410, PA-5420, PA-5430, PA-5440, PA-5445, PA-3400 Series, PA-1400 Series, PA-400 Series, VM-Series, and CN-Series firewalls only
```

Fixed a race condition issue related to predict processing, which resulted in a dataplane restart and traffic loss.

## PAN-288930

Fixed an issue where traffic from cloud applications intermittently matched an incorrect **cloud-apps** policy rule when ACE (App-ID Cloud Engine) was enabled.

## PAN-287818

Fixed an issue where sessions timed out sooner than expected due to the pan_proxy_accumulation_restore_timeout not initiating when the accumulation session_init failed.

## PAN-286897

Fixed an issue where the pan_task process stopped responding when the firewall attempted to forward files to the WildFire public cloud, which caused the dataplane to experience heartbeat failures.

## PAN-286857

Fixed an issue where only failed Kerberos authentication events were logged in auth.log, and successful authentication events were not logged.

## PAN-286848

Fixed an issue where ECMP incorrectly balanced sessions across links based on the configured metric, which led to an imbalance in traffic distribution and resulted in traffic assignment shifting disproportionately to routes with lower metrics.

## PAN-286825

Fixed an issue where GlobalProtect User-ID mappings were lost after 5 minutes, which caused users to not match User-ID source-based policy rules. This occurred due to a mismatch between the GlobalProtect gateway connection settings and the device behavior and when the **inactivity-logout** setting was deleted and set to a different value.

## PAN-285894

Fixed an issue where the all_task process stopped responding, which caused the firewall to reboot unexpectedly, and traffic failures occurred.

## PAN-285651

```caveat
Panorama appliances in active/passive HA configurations on Microsoft Azure environments only
```

Fixed an issue on Panorama that caused firewalls to disconnect unexpectedly.

## PAN-285597

Fixed an issue where a routed process memory leak occurred when advanced routing was enabled.

## PAN-285590

```caveat
VM-Series firewalls on Amazon Web Services (AWS) GWLB environments only
```

Fixed an issue where the firewall CPU usage reached 100% after upgrading to PAN-OS 11.1.6-h1.

## PAN-284117

```caveat
Panorama appliances in Log Collector mode only
```

Fixed an issue where the vm_agent process restarted after an upgrade.

## PAN-284066

Fixed an issue where, after an upgrade, the SNMP polled values for IF-MIB::ifInErrors displayed a high number of errors that did not match the values in the CLI show interface command.

## PAN-283813

Fixed an issue on Panorama where the web interface performance was slower than usual when retrieving read-only configurations from Panorama.

## PAN-283789

```caveat
Firewalls in HA configurations only
```

Fixed an issue where, after an upgrade, the **mac receive error** counter in **receive incoming errors** increased, which resulted in SNMP alerts.

## PAN-283644

```caveat
Prisma Access only
```

Fixed an issue where URL log ingestion decreased after an upgrade, and secondary connections were lost.

## PAN-283331

Fixed an issue where selective pushes to managed devices failed when the **User ID Master Device** was configured.

## PAN-282697

Fixed an issue where traffic was delayed significantly when it used **No Authentication Explicit Proxy** and matched a decryption policy rule.

## PAN-282640

Fixed an issue where custom reports showed incomplete data when exported in CSV format from Panorama.

## PAN-282394

Fixed an issue where a firewall was only able to display a maximum of 14 permitted IP addresses from a Panorama Template Variable.

## PAN-282391

```caveat
Panorama appliances and Log Collectors only
```

Fixed an issue where a VLD memory leak caused increased memory use, which resulted in OOM errors.

## PAN-282359

Fixed an issue where the Panorama web interface was slower than expected.

## PAN-282240

Fixed an issue where, when attempting to modify an Anti-Spyware profile via the web interface under a shared location, clicking the **OK** button displayed a console exception error.

## PAN-281885

Fixed an issue where, when exporting and importing CSV files, the hash values of pre-shared key variables set at template and template stack levels changed inconsistently, which resulted in both variables displaying the same hash value.

## PAN-281882

Fixed an issue where OSPF redistributed connected routes beyond the intended loopback IP address.

## PAN-281649

Fixed an issue where the index size limit was incorrectly calculated and indices rolled over earlier than expected, which resulted in high memory and OOM errors.

## PAN-281540

Fixed an issue where the logd process repeatedly restarted when the SD-WAN site name was over 31 characters and contained certain XML escape characters.

## PAN-281509

```caveat
Panorama appliances only
```

Fixed an issue where log exports were slower than expected or failed when filtering logs after an upgrade, which resulted in timeouts or delays in displaying logs on the web interface.

## PAN-281269

```caveat
PA-5420 firewalls
```

Fixed an issue where the firewall management server memory usage continuously increased.

## PAN-281264

Fixed an issue where the routed process memory usage continuously increased when Advanced Routing was enabled.

## PAN-280942

Fixed an issue where the logrcvr process stopped responding.

## PAN-280698

Fixed an issue where the firewall removed the TCP timestamp from client hello messages that did not fit in a single packet, which resulted in connection issues.

## PAN-280532

Fixed an issue where, after disabling and re-enabling the external syslog server, the TCP session was not resumed, which caused all logs that were forwarded to the syslog server to be dropped.

## PAN-280505

Fixed an issue where the web interface did not display a message to commit prior changes before attempting a partial configuration load.

## PAN-280477

Fixed an issue on the web interface were you were unable to scroll up or down to view source zones in a NAT policy rule.

## PAN-280335

Fixed an issue with an SNMPv3 EngineBoots value discrepancy that prevented to SNMP server from logging.

## PAN-280243

Fixed an issue where the firewall lost the pre-shared key configuration assigned from a PSK variable when an unrelated device group configuration was loaded.

## PAN-279691

```caveat
Firewalls in active/passive HA configurations only
```

Fixed an issue where the firewall didn't synchronize IPSec SAs (security associations) to the passive firewall if the tunnel was not initially established by the active firewall.

## PAN-279500

Fixed an issue where TLS connections failed to establish in asymmetric routing environments if the firewall did not see server-to-client (s2c) packets of the TLS handshake.

To use this fix, run the following CLI command: debug dataplane set ssl-decrypt accumulate-client-hello asym-disable yes.

## PAN-279495

Fixed an issue where accessing a URL from the browser returned the error message ERR_RESPONSE_HEADERS_TRUNCATED when the firewall was configured with TLS 1.3.

## PAN-279400

Fixed an issue where, when **Restrict Certificate Extensions** was enabled on decryption profiles, the basic constraints extension was overwritten incorrectly.

## PAN-279336

Fixed an issue where the CLI did not display a message to commit prior changes before loading a partial configuration.

## PAN-279176

Fixed an issue where the configuration audit displayed inaccurate information after partially loading the configuration via the CLI, which caused the audit to flag the configuration as deleted or changed.

## PAN-279065

Fixed an issue where the firewall sent logs with **connection succeeded** to the syslog server every time a connection was established, which resulted in excessive logs.

## PAN-278981

Fixed an issue where DNS domain resolutions experienced intermittent delays due to the firewall not connecting to the DNS Security cloud.

To use this fix, enable DNS monitoring on the dataplane via the CLI command debug dnsproxyd enable-rtsig-health-monitor yes.

To show the current setting, run the CLI command debug dnsproxyd enable-rtsig-health-monitor show. If the cfg.general.dns-rtsig-monitor-interval shows a non-zero value, DNS monitoring is enabled.

## PAN-278812

Fixed an issue where authentication to GlobalProtect failed with the error message User not in allowed list.

## PAN-278461

```caveat
Firewalls deployed in Amazon Web Services (AWS) environments only
```

Fixed an issue where DNS Security retransmit packets were not re-encapsulated into Geneve, which caused DNS requests that were initiated from the firewall to be returned to AWS GWLB.

## PAN-278190

Fixed an issue on Panorama where a scheduled report with SLS data had an invalid translated-query.

## PAN-278150

Fixed an issue where the firewall removed the Authentication Key Identifier (AKID) from the certificate during SSL decryption, which caused Python 3.13 to fail with a certificate verification error.

## PAN-277808

Fixed an issue where the eproxy. process stopped responding when running a long duration test using IXload with hybrid SWG SAML authentication bypass for HTTPS payloads, which caused the proxy to become unreachable.

## PAN-277631

Fixed an issue where the logrcvr process discarded logs due to a full queue.

## PAN-277464

Fixed an issue with intermittent access and slower than expected loading times when accessing websites. This occurred when Anti-Spyware inline cloud analysis was enabled and the **SSL Command and Control** action was not either **allow** or **alert** and server hello packets were out of order.

## PAN-277234

Fixed an issue where a device group import resulted in a Security policy rule being created with **Application** set to **none**.

## PAN-277147

Fixed an issue where daily scheduled reports were not generated and emailed.

## PAN-276920

Fixed an issue where web-advertisement traffic was not immediately blocked which resulted in pages loading indefinitely.

## PAN-276678

Fixed an issue where Panorama became unresponsive while performing a dynamic address update without a lock.

## PAN-276276

```caveat
PA-450 firewalls only
```

Fixed an issue where, after an upgrade, data that was excluded using the query builder in a custom report was still visible in the report, and the logs displayed errors related to invalid threat names being queried.

## PAN-276062

Fixed an issue where importing a firewall with a large number of address objects into Panorama did not work and remained at 99% completion.

## PAN-275754

Added support for bootstrapping Panorama virtual appliances on ESXi.

## PAN-275718

Fixed an issue where Panorama stopped forwarding logs to a syslog server after upgrading to PAN-OS 11.1.5-h1.

## PAN-275713

Fixed an issue where the dscd process stopped responding when **Endpoint Serial Number** was enabled, which resulted in the **Active Directory* returning a list of serial numbers for a specific firewall from the Cloud Identity Engine.

## PAN-275133

Fixed an issue where HTTP 503 server errors occurred while browsing websites due to slow Secure Web Gateway (SWG) bypass rule lookup.

## PAN-275077

Fixed an issue where DNS Security intermittently logs malicious domain URLs as Alert instead of taking a Sinkhole action, even when configured to Sinkhole malicious DNS domains.

## PAN-275047

```caveat
VM-Series firewalls only
```

Fixed an issue where, after an upgrade, the firewall was unable to send logs to the Strata Logging Service (SLS) when using a specific proxy server, and the SSL connection status displayed as failed when attempting to forward logs through the web proxy.

## PAN-274806

```caveat
PA-5250 firewalls only
```

Fixed an issue where IPv6 pings experienced a high number of dropped packets when forwarded to another dataplane, which resulted in ping failures. This occurred when initiating a ping to the link local address of the firewall and the packet drop percentage depended on the number of dataplanes.

## PAN-274797

Fixed an issue where a DPC on slot 3 failed intermittently due to the pktlog_forwarding process restarting, which resulted in an unexpected HA failover.

## PAN-274750

Fixed an issue where the detailed log view in Panorama did not display all packet details for traffic logs received from the cloud.

## PAN-274726

Fixed an issue where Wildfire signature generation was enabled on all nodes in a cluster instead of only the active node.

## PAN-274697

Fixed an issue where push operations from Panorama failed on passive firewalls when an application was removed from a Security policy rule and the policy rule was referenced in a device group.

## PAN-274671

Fixed an issue where empty traffic logdb folders were generated for each day even when trafcfic logs were not received by the logrcvr process.

## PAN-274569

Fixed an issue where the QSPF transceiver interface displayed an incorrect range figure on the temperature alarm.

## PAN-274496

Fixed an issue where the root partition reached 100% which caused the system to become non-functional and failover even when aggressive cleaning was enabled.

## PAN-274146

Fixed an issue where the firewall rebooted continuously after upgrading to PAN-OS 11.1.5-h1 when a tunnel session was established in a Gateway Load Balancing (GWLB) scenario and no data packet was associated with the packet.

## PAN-273964

Fixed an issue where SNMP scans to a firewall timed out after upgrading to a PAN-OS 10.2 release.

## PAN-273694

Fixed an issue where the firewall rebooted due to an out-of-bounds memory access that occurred as a result of the SIP content length value being split across packets.

## PAN-273614

Fixed an issue where packets were dropped initially when a SYN cookie with activation threshold 0 was enabled.

## PAN-273597

Fixed an issue where logs in the cloud database displayed in the **Not-Resolved** category but not in the local database.

## PAN-273453

Fixed an issue where restarting the firewall did not initiate an autocommit job, which caused the firewall to stop responding and the HA interface to go down.

## PAN-273277

Fixed an issue where GlobalProtect clients on macOS devices were prompted to enter their username and password for Kerberos SSO authentication.

## PAN-273153

Fixed an issue where the Panorama web interface was slower than expected due to excessive polling of the MonitorDirect.getTasks API by the Task Manager.

## PAN-273141

Fixed an issue where GlobalProtect clients experienced slow file transfer download throughput when passing through an IPSec tunnel.

## PAN-272812

Fixed an issue where SNMP monitoring of tunnel interfaces displayed zero values for received bytes and packets.

## PAN-272746

```caveat
PA-440 firewalls only
```

Fixed an issue where the firewall entered an unstable state after committing changes or onboarding to Panorama.

## PAN-272605

Fixed an issue where the firewall did not display VPC endpoints when there was a large amount of VPC endpoints to interface mappings.

## PAN-272539

```caveat
Panorama appliances on Microsoft Azure environments only
```

Fixed an issue where user to IP address mapping was missing for some users connected to specific Prisma Access gateways, which caused the collection layer Azure firewall to not form the mapping.

## PAN-272395

Fixed an issue where informational logs caused the distributord process log file to be frequently overwritten.

## PAN-272175

Fixed an issue where session rematch caused ACE cloud application traffic to match the wrong policy.

## PAN-271700

Fixed an issue where User-ID connections were lost after an HA failover.

## PAN-271560

Fixed an issue where DNS requests to malware sites were not blocked as expected, and the dns-security-categories log-level and action displayed default values instead of unavailable.

## PAN-271498

```caveat
PA-7000 Series firewalls, PA-5200 firewalls, and PA-5400f firewalls in FIPS mode only
```

Fixed an issue where decrypted traffic repeatedly failed and frequent reboots were required.

## PAN-271425

```caveat
Firewalls in active/active HA configurations only
```

Fixed an issue with SSL inbound decryption on firewalls on a vwire setup with asymmetric routing.

To use this fix, enter the CLI command set system setting ssl-decrypt ha-vwire-mac-learn global yes on both firewalls in an HA pair.

## PAN-271184

Fixed an issue where Device Telemetry failed due to an issue with the encoding of characters in the log file path.

## PAN-271175

Fixed an issue where the all_task process stopped responding with a SIGABRT.

## PAN-271151

Fixed an issue where the GlobalProtect client did not automatically initiate a Kerberos SSO connection after logging in to Windows.

## PAN-270849

Fixed a memory leak issue related to the configd process that occurred when running consecutive commits for multiple days.

## PAN-270744

Fixed an issue where API calls to Panorama failed with the error Server error : Timed out while getting config lock. Please try again.

## PAN-270379

Fixed an issue where socket files created in the /tmp directory were not cleared.

## PAN-270193

Fixed an issue where the Panorama management server changed its certificate authority (CA) unexpectedly, which caused managed firewalls to disconnect.

## PAN-270192

Fixed an issue where Panorama did not display the management IP address of devices onboarded via ZTP.

## PAN-269700

Fixed an issue where commits to service connection firewalls from Panorama failed.

## PAN-269677

Fixed an issue where Panorama did not check for a NULL pointer when querying logs, which caused logs to not display on the web interface.

## PAN-269624

Fixed an issue where GlobalProtect clients failed to connect with the error message The device or feature requires a GlobalProtect subscription license.

## PAN-269193

Fixed an issue where the firewall redirected the user to the first application instead of the portal page with a list of applications when multiple applications were configured for GlobalProtect clientless VPN along with any user match.

## PAN-269139

```caveat
Firewalls with DPDK enabled in Azure, GCP, AWS, and KVM environments only
```

Fixed an issue where, after an upgrade to PAN-OS 11.1.4, the **mac receive error** counter increased without an error even though traffic was not impacted.

## PAN-268708

Fixed an issue where PDF summary and email reports displayed IPv6 addresses instead of IPv4 addresses.

## PAN-268614

Fixed an issue on the web interface where, when all rules were highlighted when a read-only admin user clicked the **Highlight Unused Rules** checkbox.

## PAN-268489

Fixed a Threat log PCAP ID overwrapping issue.

## PAN-268465

Fixed an issue with firewalls in active/passive HA configurations where the total user count in the registered users was different between the active and passive firewall.

## PAN-268279

Fixed an issue where autocommits failed if the management IPv6 gateway was the same as the dataplane interface IP address.

## PAN-267759

Fixed an issue where Prisma Access gateway downloads were slower than expected.

## PAN-267518

Fixed an issue where WildFire submission logs incorrectly reported allowed malicious samples even when they were blocked by threat prevention profiles.

## PAN-266427

Fixed an issue on the firewall where, when a high number of SD-WAN branch sites or interfaces were not connected, SD-WAN processes and tund processes stopped responding due to a high probing rate.

## PAN-266116

Fixed an issue where URLs did not work due to certificate revocation list (CRL) requests failing.

## PAN-265900

Fixed an issue where the firewall stopped responding due to a tund process or SD-WAN process restart.

## PAN-265791

Fixed an issue where the all_task process stopped responding, which caused the dataplane to go down.

## PAN-264982

```caveat
VM-Series firewalls on Kernel-based Virtual Machine (KVM) only
```

Fixed an issue where the firewall entered maintenance mode after an auto-commit when sending an ARP packet through the loopback interface using an IPv6 address.

## PAN-264708

Fixed an issue where a selective push was blocked when a configuration load was done.

## PAN-262729

```caveat
Panorama appliances only
```

Fixed an issue where the configd process experienced continuous high CPU utilization and repeatedly restarted.

## PAN-262373

Fixed an issue where the error message Failed to reload config files displayed in the system logs even when device telemetry was not enabled.

## PAN-262372

Fixed an issue where the firewall generated the error message Successfully generating a new set of config files in the system logs even when device telemetry was not enabled.

## PAN-262063

Fixed an issue where the firewall did not display the converted configurations before a commit and reboot, and the commit failed when attempting to migrate from MS to FRR mode.

## PAN-261597

Fixed an issue where the all_pktproc process stopped responding, which caused the firewall to become unavailable.

## PAN-261312

Fixed an issue where a commit for a policy and configuration dump overlapped, which resulted in a null pointer exception.

## PAN-261074

Fixed an issue where the firewall delayed video file transfers over SMB when **Exclude Video Traffic** from the Tunnel feature was enabled and no applications were added to the list.

## PAN-260229

Fixed an issue where HA path monitoring using VWire did not work as expected after a reboot.

## PAN-259727

```caveat
Panorama appliances in HA configurations only
```

Fixed an issue where Panorama became unresponsive and displayed a 504 gateway timeout error when accessing the web interface or the CLI.

## PAN-259610

Fixed an issue where Wildfire content installation failed for WF-500B clusters when deployed from Panorama using the deployment schedule.

## PAN-258743

Fixed an issue where, when you attempted to select a redistribution profile when creating a BGP Redistribute policy rule, the firewall displayed an empty dropdown.

## PAN-258166

```caveat
PA-220 firewalls only
```

Fixed an issue where the root partition frequently reached 100%.

## PAN-258162

```caveat
Panorama appliances on AWS environments only
```

( Fixed an issue where IP addresses were not retrieved in Dynamic Address Groups when multiple AND operators were configured.

## PAN-257183

Fixed an issue where the firewall dropped DNS traffic when using DNS Security.

## PAN-256904

Fixed an issue where the firewall inconsistently blocked URLs due to intermittent URL category misidentification.

## PAN-256867

Fixed an issue where the logrcvr process stopped responding while processing session logs for forwarding to the LFC.

## PAN-255759

Fixed an issue where the firewall was unable to match HIP data with the correct anti-malware object for Windows Defender.

## PAN-254904

Fixed an issue on Panorama where a core file was generated by /usr/local/bin/logd during a restart.

## PAN-254524

Fixed an issue on Panorama where, when the **Commit and Push** button was clicked during a selective **Commit and Push** operation, the window stopped responding, which caused the operation to be delayed.

## PAN-253127

Fixed an issue where, after upgrading to PAN-OS 11.0.2-h3, the hardware pool DFLT became highly utilized, and the packet buffer gradually increased.

## PAN-251715

Fixed an issue where the firewall closed the SSL connection to the user ID agent.

## PAN-243235

Fixed an issue where Panorama stopped responding and rebooted repeatedly after an upgrade.

## PAN-193285

Fixed an issue where the policy optimizer feature did not add entries back to the mongodb database after removing them during an upgrade or downgrade.
