---
type: Addressed
product: PAN-OS
version: 11.0.4
---

## PAN-250686

Fixed an issue where selective push operations did not work when more than one admin user simultaneously performed changes and partial commits on Panorama.

## PAN-249808

Fixed an issue where the configd process stopped responding when performing
multidevice group pushes via XML API.

## PAN-246707

Fixed an issue where failover was not triggered when multiple processes stopped responding.

## PAN-245701

Fixed an issue where the returned values to SNMP requests for data port statistics were incorrect.

## PAN-245690

Fixed an issue where the managed collectors health status on Panorama displayed as empty.

## PAN-244493

Fixed a memory limitation with mapping subinterfaces to VPCE endpoints for GCP IPS, Amazon Web Services (AWS) integration with GWLB, and NSX service chain mapping.

## PAN-243951

Fixed an issue on Panorama appliances in active/passive HA configurations where managed devices displayed as out-of-sync on the passive appliance when peer configuration changes were made to the SD-WAN configuration on the active peer.

## PAN-242910

Fixed an issue where a custom based non-Superuser was unable to push to firewalls.

## PAN-242627

Fixed an issue where selective push did not work.

## PAN-242519

Fixed an issue where scheduled email reports failed if the @ symbol before the mail client was missing.

## PAN-242027

Fixed an issue where the all-task process repeatedly restarted during memory allocation failures.

## PAN-241164

```caveat
PA-410 firewalls only
```

Fixed an issue where system and configuration logs sent from the firewall to Panorama contained the serial number field instead of the firewall device name.

## PAN-241141

Fixed an issue where creating more than one address object in the same XML API request resulted in a commit error.

## PAN-240618

Fixed an issue where configuration commits were successful even when dynamic peer IKE gateways
configured on the same interface and IP address that did not have
the same IKE Crypto profile.

## PAN-240612

Fixed a kernel panic caused by a third-party issue

## PAN-240487

Fixed an issue where fan speed increased significantly after upgrading the firewall.

## PAN-240251

Fixed an issue where the vldmgr process incorrectly restarted during an Elasticsearch restart.

## PAN-240225

Fixed an issue where authentication failed on web-based GlobalProtect portal.

## PAN-240197

Fixed an issue where configuration changes made in Panorama and pushed to the firewall were not reflected on the firewall.

## PAN-240166

Fixed an issue where, when explicit proxy was configured on the firewall, websites loaded more slowly than expected or did not load due to DNS using TCP.

## PAN-239776

Fixed an issue where Panorama went into maintenance mode due to a GlobalProtect quota configuration that was under the minimum required quota.

## PAN-239722

Fixed an issue where SNMP scans to the firewall took longer than expected and intermittently timed out.

## PAN-239279

Fixed an issue where the SWG proxy did not accept new connections.

## PAN-239256

Fixed an issue where ARP entries were unable to be completed for subinterfaces with SNAT configured.

## PAN-239241

Extended the root certificate for WildFire appliances to December 31, 2032.

## PAN-239200

Fixed an issue where the following Prisma Access SWG proxy upstream error was displayed when you attempted to access the proxy: disconnect / reset before headers: reset reason: overflow.

## PAN-239144

Fixed an issue where the web interface was slower than expected when logging in, committing, and pushing changes after upgrading to PAN-OS 10.2.7.

## PAN-238949

Fixed a memory corruption issue where multiple processes stopped responding.

## PAN-238643

Fixed an issue where a memory leak caused multiple processes to stop responding when VM Information Sources was configured.

## PAN-238621

Fixed an issue where the HA3 link status remained down when updating the HA3 interface configuration when the AE interface was up.

## PAN-238586

Fixed an issue where DNS resolution failure from the LFC resulted in WildFire public cloud connectivity failure.

## PAN-238562

Fixed an issue where log collectors stopped responding when gathering reports from Panorama.

## PAN-238508

Fixed an issue where the routed process created excessive logs in the log file.

## PAN-237993

Fixed an issue where Config Push Scheduler > Admin scope changed to an admin ID instead of a 0 value, which caused a scheduled configuration push to work as a Selective push instead of a Full push.

## PAN-237876

Extended the firewall Panorama root CA certificate which was previously set to expire on April 7th, 2024.

## PAN-237678

Fixed an issue with firewalls in active/passive HA configurations where the passive firewall displayed the error message Unable to read QSFP Module ID when the passive link state was set to shutdown.

## PAN-237562

Fixed an issue where firewalls generated link-change system logs for SFP ports even when no cable was connected to the ports.

## PAN-237537

Fixed an issue where, when deleting CTD entries, the all_pktproc process stopped responding which resulted in dataplane failure.

## PAN-237478

Fixed an issue where the Traffic log displayed 0 bytes for denied sessions.

## PAN-237454

Fixed an issue where Panorama stopped redistributing IP address-to-username mappings when packet loss occurred between the distributor and the client.

## PAN-237369

```caveat
PA-1420 firewalls only
```

Fixed an issue where the all_task process stopped responding, which caused the firewall to become unresponsive.

## PAN-236802

Fixed an issue on firewalls in HA configurations where unexpected failovers occurred.

## PAN-236605

Fixed an issue where the configd process stopped responding due to a deadlock related to rule-hit-count.

## PAN-235840

Fixed an issue where, after a configuration push from Panorama to managed firewalls, the status displayed as None and the push took longer than expected.

## PAN-235737

Fixed an issue where the brdagent process stopped responding due to a sudden increase in logging to the bcm.log.

## PAN-235628

Fixed an issue where you were not prompted for login credentials when you disconnected and
connected back to the GlobalProtect portal when SAML authentication
was selected along with single sign-on (SSO) and Single Log Out
(SLO).

## PAN-235557

Fixed an issue where uploads from tunnels, including GlobalProtect, were slower than expected when the inner and outer sessions were on different dataplanes.

## PAN-235476

Fixed an issue where Threat logs from different Security zones were aggregated into one log.

## PAN-235385

Enhanced wifclient cloud connectivity redundancy.

## PAN-235168

Fixed an issue where disk space became full even after clearing old logs and content images.

## PAN-235081

```caveat
VM-Series firewalls only
```

Fixed an issue where the firewall sent packets to its own interface after configuring NAT64.

## PAN-234977

Fixed an issue where, when a Layer 2 interface that was a member of a VLAN was down, all traffic transmitted over the VLAN was dropped.

## PAN-234459

Fixed an issue with the firewall web interface where local SSL decryption exclusion cache entries were not visible.

## PAN-234290

Fixed an issue where the firewall displayed incorrect interface transfer rates when running the CLI command show system state filter-pretty sys.s1.px with a filter.

## PAN-234279

Fixed an issue where the ikemgr process crashed due to an IKEv1 timing issue, which caused commits to fail with the following error message: Client ikemgr requesting last config in the middle of a commit/validate, aborting current commit.

## PAN-234238

Fixed an issue where a Security policy that referenced more than 30 HIP Profiles caused buffer
overflow, which caused other Security policies with HIP Profiles to
misidentified users and traffic was denied.

## PAN-234190

Fixed an issue where the firewall incorrectly blocked URLs even when they matched the custom category.

## PAN-234031

Fixed an issue on multi-core firewalls where the firewall displayed packets out of order when capturing packets on the transmit stage.

## PAN-233957

```caveat
PA-5450 firewalls only
```

Fixed an issue where the NAT private pool was not used properly when enabling slot 6 DPC.

## PAN-233833

Fixed an issue where enabling Jumbo frames resulted in software packet buffer depletion.

## PAN-233789

Fixed an issue with push and commit and push operations where the user was not correctly bound to the scope, which caused all device groups to be selected for a selective push.

## PAN-233780

```caveat
VM-100 firewalls only
```

Fixed an issue where commits failed due to the configuration memory limit.

## PAN-233764

Fixed an issue where commits failed due to large inbound inspection certificates that exceeded
the buffer size of 4,096 bytes.

## PAN-233541

Fixed an issue where device group and template administrators with access to a specific virtual system were able to see logs for all virtual systems via Context Switch.

## PAN-233517

Fixed an issue on Panorama where managed device templates and device groups took longer than expected to display in the Push to Devices window.

## PAN-233463

Fixed an issue where the X-Forwarded-For (XFF) IP address value was not displayed in Traffic
logs.

## PAN-233390

Fixed an issue where the exclude-cache reason was incorrectly presented as TLS13_UNSUPPORTED instead of SSL_CLIENT_CERT.

## PAN-233191

```caveat
PA-5450 firewalls only
```

Fixed an issue where the Data Processing Card (DPC) restarted due to path monitor failure after QSFP28 disconnected from the Network Processing Card (NPC).

## PAN-233039

Fixed an issue where GENEVE encapsulated packets coming from a GFE Proxy mapped to an incorrect Security policy rule.

## PAN-232953

Fixed an issue where you were able to cancel the same commit repeatedly, which displayed the error message Cannot stop job &lt;job&gt; at this time.

## PAN-232924

Fixed an issue on firewalls in active/passive HA configurations where the passive firewall was unable to retrieve SDB data for locally inserted SFP transceivers.

## PAN-232800

Fixed an issue where critical disk usage for /opt/pancfg increased continuously and the system logs displayed the following message: Disk usage for /opt/pancfg exceeds limit, &lt;value&gt; percent in use.

## PAN-232377

Fixed an issue where the AddrObjRefresh job failed when the useridd process restarted.

## PAN-232358

```caveat
PA-5450 firewalls only
```

Fixed an issue where the interface on QSFP28 ports did not go down when the Tx cable was removed from the QSFP28 module.

## PAN-232290

```caveat
PA-5200 Series firewalls only
```

Fixed an issue where the First Packet Processor (FPP) did not acknowledge a query to find the owner for fragmented packets, tunnel packets, and other scenarios when the packet slot and dataplane owner was unknown.

## PAN-232250

Fixed an issue where, when SSH service profiles for management access were set to None, the reported output was incorrect.

## PAN-232132

Fixed an issue where DNS response packets were malformed when an antispyware Security Profile was
enabled.

## PAN-231698

Fixed an issue where you were unable to set the Dynamic Updates schedule threshold to an empty
value.

## PAN-231552

Fixed an issue where traffic returning from a third-party Security chain was dropped.

## PAN-231507

```caveat
PA-1400 Series firewalls only
```

Fixed an issue where, when an HSCI interface was used as an HA2 interface, HA2 packets were intermittently dropped on the passive firewall, which caused the HA2 connection to flap due to missing HA2 keepalive messages.

## PAN-231480

Fixed an issue where the firewall CLI output for GlobalProtect log quota settings did not match the settings configured on the Panorama web interface.

## PAN-231459

```caveat
PA-5450 firewalls only
```

Fixed an issue where a large number of invalid source MAC addresses were shown in drop-stage packet captures.

## PAN-231395

Fixed an intermittent issue where the OCSP query failed.

## PAN-231329

Fixed an issue where the logrcvr process stopped responding due to a corrupt log in the forwarding pipeline.

## PAN-231295

Fixed an issue where the logrcvr process stopped when running the hints-max CLI command.

## PAN-231169

```caveat
PA-220 firewalls only
```

Fixed an issue where an unused plugin incorrectly used memory.

## PAN-231148

Fixed an issue where no DHCP option list was defined when using GlobalProtect.

## PAN-230813

Fixed an issue where flex memory leak caused decryption failure and commit failure with the error message Error preparing global objects failed to handle CONFIG_UPDATE_START.

## PAN-230746

Fixed an issue on the web interface where device groups with a large number of managed firewalls displayed the Policy page more slowly than expected.

## PAN-230656

```caveat
Firewalls in HA configurations only
```

Fixed an issue where a split brain condition occurred on both firewalls after booting up any firewall, and an HA switchover occurred after booting up a firewall with a higher HA priority even when no preemptive option was enabled on the firewall.

## PAN-230377

Fixed an issue where FEC support was not enabled by default for PAN-25G-SFP28-LR modules.

## PAN-230363

```caveat
PA-7050 firewalls with SMC-B only
```

Fixed an issue where the management interface was reported as up even when MGT-A and MGT-B were both down.

## PAN-230362

Fixed an issue where the firewall truncated the payload of a TCP Out of Order segment with a FIN flag.

## PAN-230359

Fixed an issue where SAML authentication failed with the error message Failed to verify signature against certificate when ds:KeyName was in the IdP metadata.

## PAN-230198

Fixed an issue where URL logs were duplicated on Cortex Data Lake.

## PAN-230106

Fixed an issue where the firewall was unable to retrieve the most current external dynamic list information from the server due to hostname resolution failure.

## PAN-230092

Fixed an issue where the routed process stopped responding when committing routing-related changes if Advanced routing was enabled.

## PAN-230039

Fixed an issue where migrating from an Enterprise License Agreement (ELA) to a Flexible VM-Series License failed with a deactivation error message.

## PAN-229952

Fixed an issue where the print PDF option did not work (Panorama > Managed Devices > Health).

## PAN-229950

Fixed an issue where custom response pages for the GlobalProtect login page did not load and displayed a 404 Not Found error.

## PAN-229874

Fixed an issue where the firewall was unable to form OSPFv3 adjacency when using an ESP authentication profile.

## PAN-229873

```caveat
PA-7050 firewalls only
```

Fixed an issue related to brdagent process errors.

## PAN-229866

Fixed an issue where the reportd process stopped responding.

## PAN-229824

Fixed an issue where Device History was not visible under Managed Devices Summary.

## PAN-229606

Fixed an issue where the brdagent process stopped responding after an upgrade due to initialization failure.

## PAN-229398

Fixed an issue where the Management Processor Card (MPC) stopped responding.

## PAN-229315

Fixed an issue where Octets in NetFlow records were always reported to be 0 despite having a
nonzero packet count.

## PAN-229307

Fixed an issue where half closed SSL decryption sessions stayed active, which caused software packet buffer depletion.

## PAN-229115

Fixed an issue on the web interface where the screen was blank after logging in to Panorama.

## PAN-229080

Fixed an issue where the new management IP address on the interface did not take effect.

## PAN-229072

Fixed an issue where GlobalProtect did not automatically connect to an internal gateway after an endpoint was woken.

## PAN-229069

Fixed an issue where clientless VPN portal users were unable to access clientless applications due to an SSL renegotiation being triggered.

## PAN-228998

Fixed an issue where multiple license status checks caused an internal process to stop responding.

## PAN-228775

Fixed an issue where the CLI command show bonjour interface did not display any output.

## PAN-228457

```caveat
PA-7000 firewalls only
```

Fixed an issue where the GTP logs forwarded from the firewall to the log collector did not include the pcap.

## PAN-228442

Fixed an issue on firewalls in active/passive HA configurations where sessions did not fail over from the active firewall to the passive firewall when upgrading PAN-OS.

## PAN-228342

Fixed an issue where objects in the running configuration appeared to be deleted under the push scope preview.

## PAN-228323

Fixed an issue where a large number of Panorama management server cookies were created in the Redis database when the Cloud-Service plugin sent an authentication request every second, and logging in to or using Panorama was slower than expected.

## PAN-228277

Fixed an issue where commits took longer than expected.

## PAN-227998

Fixed an issue where the zebra process stopped responding due to memory corruption.

## PAN-227939

Fixed an issue where the all_task process stopped responding due to high wifclient memory usage, which caused the firewall to reboot.

## PAN-227887

Fixed an issue where IP address checksums were calculated incorrectly.

## PAN-227804

Fixed an issue where memory corruption caused the comm process to stop responding.

## PAN-227774

Fixed an issue where commits failed with the error message Management server failed to send phase 1 to client logrcvr.

## PAN-227539

Fixed an issue where excess WIF process memory use caused processes to restart due to OOM conditions.

## PAN-227522

Fixed an issue where shared application filters that had application object overrides were overwritten by predefined applications.

## PAN-227517

Fixed an issue related to the IPv6 character limit for the source address in static route path monitoring.

## PAN-227510

Fixed an issue where the error message Failed to establish GRPC connection to UrlCat service: failed to start grpc connection was displayed in the system log when the Advanced URL Filtering license was applied but not configured.

## PAN-227397

Fixed an issue where selective pushes on Panorama removed a previously pushed configuration from the firewalls.

## PAN-227368

Fixed an issue where the GlobalProtect app was unable to connect to a portal or gateway and GlobalProtect Clientless VPN users were unable to access applications if authentication took more than 20 seconds.

## PAN-227344

Fixed an issue on Panorama where PDF Summary Reports (Monitor > PDF Reports > Manage PDF Summary) displayed no data and were blank when predefined widgets were included in the summary report.

## PAN-227305

Fixed an issue where SCEP certificate generation failed when a service route was used to reach the SCEP server.

## PAN-227064

Fixed an issue with high availability (HA) sync failure when performing a partial commit after creating a Security policy via REST API.

## PAN-227058

Fixed an issue where traffic did not match Security policy rules with the destination as FQDN and instead hit the default deny rule.

## PAN-226923

Fixed an issue where an excessive tab displayed *Device > Setup** when using Simplified Chinese.

## PAN-226860

Fixed an issue where macOS X-Auth clients disconnected prematurely from the GlobalProtect gateway
during a Phase 2 re-key event.

## PAN-226768

Fixed an issue where, when the GlobalProtect app was installed on iOS endpoints and the gateway was configured to accept cookies, the app remained in the Connecting stage after authentication, and the GlobalProtect log displayed the error message User is not in allow list. This occurred when the app was restarted or when the app attempted to reconnect after disconnection.

## PAN-226626

Fixed an issue where the firewall generated numerous logrcvr error messages related
to NetFlow.

## PAN-226470

Fixed an issue where previewing changes for selective admins took longer than expected or displayed the error message commands succeeded with no output.

## PAN-226128

Fixed an issue where selective push failed on Panorama after deleting shared objects that were
referenced in multi-device group environments with the error
message: Schema validation failed. Please try a full
push.

## PAN-226021

Fixed an issue where content push operations failed for a URL category Scanning Activity.

## PAN-225975

Fixed an issue where the CLI command show system disk details was not available.

## PAN-225394

Fixed an issue on the firewall where SNMP incorrectly reported high packet descriptor usage.

## PAN-225337

Fixed an issue on Panorama related to Shared configuration objects where configuration pushes to multi-vsys firewalls failed.

## PAN-225203

Fixed an issue where the Log Forwarding Card (LFC) did not honor the negotiated MSS on the logging connection.

## PAN-225110

Fixed an issue with firewalls in HA configurations where HA configuration syncs did not complete or logging data was missing until firewall processes were manually restarted or the firewalls were rebooted.

## PAN-225094

Fixed an issue where performing a commit operation failed and the following error message was displayed: failed to handle CUSTOM_UPDATE.

## PAN-225090

Fixed an issue on Panorama where Commit and Push was grayed out when
making changes to a template or device group.

## PAN-225082

Fixed an issue where GlobalProtect quarantine-delete logs were incorrectly shown on passive firewalls.

## PAN-225013

```caveat
PA-5450 firewalls only
```

Fixed an issue where the firewall rebooted unexpectedly when a Network Card was on Slot 2 instead of a DPC.

## PAN-224955

Fixed an issue where the devsrvr process stopped responding when Zone Protection had more than 255 profiles.

## PAN-224954

Fixed an issue where, after upgrading and rebooting a Panorama appliance in Panorama or Log Collector mode, managed firewalls continuously disconnected.

## PAN-224938

Fixed an issue where the CLI command settings for set system setting logging max-log-rate did not persist after a mgmtsrvr process restart.

## PAN-224882

Fixed an issue where the session end reason was incorrectly logged as decrypt-cert-validation for allowed sessions when the decryption profile was configured for a no-decrypt policy.

## PAN-224788

Fixed an issue where the Power Supplies was not present in the show system environmentals CLI command output.

## PAN-224772

Fixed a high memory usage issue with the mongodb process that caused an OOM condition.

## PAN-224656

Fixed an issue where the devsrvr process caused delays when Dynamic Address Groups
with large entry lists were being processed during a commit, which
caused commits to take longer than expected.

## PAN-224500

Fixed an issue where IPv6 addresses in XFF were displayed in Traffic logs.

## PAN-224424

```caveat
PA-3440 firewalls only
```

Fixed an issue where you were unable to set the link speed as
25Gbps from the drop-down in the template for Ethernet ports 1/23
through 1/26.

## PAN-224405

Fixed an issue where the distributord process repeatedly stopped responding.

## PAN-224404

Fixed an issue where a memory leak caused decryption failures when SSL Forward Proxy was
configured.

## PAN-224365

Fixed an issue where excessive network path monitoring messages were generated in the system logs.

## PAN-224354

Fixed an issue where a memory leak related to the distributord process occurred when connections flapped for IP address-to-username mapping redistribution.

## PAN-224067

Fixed an issue where cookie authentication did not work for GlobalProtect when an authentication override domain was configured in the SAML authentication profile.

## PAN-223914

Fixed an issue on Panorama where the reportd process unexpectedly stopped responding.

## PAN-223856

```caveat
PA-800 Series firewalls only
```

( Fixed an issue where the GlobalProtect SSL tunnel failed.

## PAN-223855

Fixed an issue where the show running ippool CLI command output
displayed incorrect used and available NAT IP address pools on DIPP
NAT policy rules in multidataplane firewalls.

## PAN-223798

Fixed an issue on the firewall where, when Advanced Routing was enabled, PIM join messages were not sent to the RN due to a missing OIF.

## PAN-223559

Fixed an issue where unexpected characters appeared in the text of
GlobalProtect application authentication prompts when the
GlobalProtect portal or gateway had a RADIUS authentication
profile.

## PAN-223796

```caveat
PA-7000 Series firewalls with Log Forwarding Cards (LFC) only
```

Fixed an issue where multiple OOM conditions occurred which caused a system restart.

## PAN-223559

Fixed an issue where unexpected characters appeared in the text of
GlobalProtect application authentication prompts when the
GlobalProtect portal or gateway had a RADIUS authentication
profile.

## PAN-223481

```caveat
PA-5450 firewalls only
```

Fixed an issue where the all_pktproc process stopped responding when the firewall was on PAN-OS 10.1.9-h3 or a later release.

## PAN-223432

Fixed an issue where SSL decryption for HTTP/2 sessions failed when enabling Send handshake messages to CTD for inspection (Device > Setup > Session > Decryption Settings > SSL Decryption Settings).

## PAN-223365

Fixed an issue where Panorama was unbale to query any logs if the Elasticsearch health status for any log collector was degraded.

## PAN-223271

Fixed an issue where the file transfer of large zipped and compressed files had the App-ID unknown-tcp.

## PAN-223263

Fixed an issue on the web interface where the system clock for Mexico_city was displayed in CDT instead of CST on the management dashboard.

## PAN-223259

Fixed an issue where selective pushes failed with the error message Failed to generate selective push configuration. Unable to retrieve last in-sync configuration for the device, either a push was never done or version is too old. Please try a full push.

## PAN-223172

Fixed an issue on Panorama where host IDs manually added to the device quarantine list were unexpectedly removed.

## PAN-223094

Fixed an issue where fragmented TCP traffic was dropped due to an IP address ID conflict over the SD-WAN tunnel.

## PAN-222662

Fixed an issue where the CLI command debug log-card-interface pint slot <x> host
<host> did not return any information when
attempting to ping the Log Forwarding Card (LFC).

## PAN-222586

```caveat
PA-5410, PA-5420, and PA-5430 firewalls only
```

Fixed an issue where
Filter drop-downs, Forward
Method, and Correlation log
settings (Device > Log Settings >
Correlation) were not displayed.

## PAN-222188

A CLI command was introduced to address an issue where SNMP monitoring performance was slower
than expected, which resulted in
snmpwalk timeouts.

## PAN-222089

Fixed an issue where you were unable to context switch from Panorama to the managed device.

## PAN-221973

Fixed an issue where the same user connected to multiple SSL VPN connections and one of the sessions stopped working.

## PAN-221938

Fixed an issue with network packet broker sessions where the broker session and primary session
timeouts were out of sync, which caused traffic drops if the broker
session timed out when the primary session was still active.

## PAN-221897

Fixed an issue where duplicate entries were not detected during commits, which caused routing engine failure.

## PAN-221881

Fixed an issue where log ingestion to Panorama failed, which resulted in missing logs under the Monitor tab.

## PAN-221857

Fixed an issue where users were unable to log in to the GlobalProtect app using SAML authentication after upgrading to PAN-OS 10.2.3-h4, and the GlobalProtect logs displayed the following error message: Username from SAML SSO response is different from the input.

## PAN-221728

Fixed an issue where selective pushes did not work after upgrading to PAN-OS 10.2.4.

## PAN-221428

Fixed a memory leak issue where the packet buffer count continuously increased and the firewall required a restart to clear the buffers.

## PAN-221190

```caveat
PA-800 Series firewalls only
```

Fixed an issue where the firewall rebooted due to I2C errors when unsupported optics were inserted in ports 5-8.

## PAN-221186

Fixed an issue where BGP aggregate routes were not created and discard routes were not installed in the routing table.

## PAN-221162

Fixed an issue where previewing changes before pushing to devices displayed a pop-up with the
message: Command succeeded with no
output.

## PAN-221015

```caveat
M-600 Appliances only
```

Fixed an issue where ElasticSearch processes did not restart
when the appliance was rebooted, which caused the managed collector
ES health status to be downgraded.

## PAN-220931

```caveat
Panorama appliances in FIPS-CC mode only
```

Fixed an issue where scheduled email reports did not contain PDF attachments.

## PAN-220907

```caveat
VM-Series firewalls only
```

Fixed an issue where large packets were dropped from the dataplane to the management plane, which caused OSPF neighborship to fail.

## PAN-220881

Fixed an issue where the CLI command show logging-status did not correctly display the last log created and forwarded timestamps.

## PAN-220659

Fixed an issue on the firewall where scheduled antivirus updates failed when external dynamic
lists were configured on the firewall.

## PAN-220619

Fixed an issue where the correct device filter did not apply when filtering Targets and Target/Tags (Device Group > Policies).

## PAN-220553

Fixed an issue where, after enabling Advanced Routing Engine, the backup default route was not installed in the FIB table if static path monitoring went down.

## PAN-220500

```caveat
PA-5450 and PA-400 firewalls only
```

Fixed an issue where the request shutdown system CLI command did not completely shut down the system.

## PAN-220239

Fixed an issue where certificate-based logins to Panorama via the web interface failed.

## PAN-219851

Fixed an issue where you were unable to export SAML metadata when configuring SAML authentication.

## PAN-219768

Fixed an issue where you were unable to filter data filtering logs with Threat
ID/NAME for custom data patterns created over
Panorama.

## PAN-219585

Fixed an issue where enabling syslog-ng debugs from the root caused 100% disk utilization.

## PAN-219494

Fixed an issue with the firewall where adding Parent-App under Application Filter for Security policy rules did not add dependent applications.

## PAN-219415

Fixed an issue where BGP routes were installed in the routing table even when the option to install routes was disabled in the configuration.

## PAN-219351

Fixed an issue where the all_pktproc process stopped responding during Layer 7
processing.

## PAN-219260

```caveat
M-Series appliances only
```

Fixed an issue where the management interface flapped due to low memory reserved for kernel space.

## PAN-219251

Fixed an issue where the ctd_dns_wait_pkt_drop counter increase was greater than expected.

## PAN-219222

Fixed an issue where spaces in a certificate name caused imports to fail.

## PAN-219113

Fixed an issue where, when a port on the NPC was configured for log forwarding, the ingress traffic on the card was sent for processing to the LPC, and the LPC card was reloaded when the ingress volume of traffic was high.

## PAN-218873

Fixed an issue where a HIP mask was reused when an existing IP address user mapping was updated by a new IP address user mapping that had a different username but the same IP address.

## PAN-218694

Fixed an issue where SaaS PR was reimported to the shared location and policy objects were not
updated with new updates coming from the SaaS cloud.

## PAN-218659

Fixed an issue where Security zones under Interfaces displayed as none for dynamic group and template admin users in a read-only admin role.

## PAN-218652

Fixed an issue on Panorama where the HA virtual address was not created for firewalls in active/active HA configurations.

## PAN-218620

Fixed an issue where scheduled configuration exports and SCP server connection testing failed.

## PAN-218611

Fixed an issue where the device telemetry region was not updated on the firewall when pushed from the Panorama template stack.

## PAN-218555

Fixed an issue where the firewall did not receive dynamic address updates pushed from Panorama during initial registration to Panorama.

## PAN-218352

Fixed an issue where Panorama was slower than expected when WildFire deployment was scheduled every minute to a large number of devices.

## PAN-218119

Fixed an issue where the firewall transmitted packets with an incorrect source MAC address during commit operations.

## PAN-218057

```caveat
PA-7000 Series firewalls only
```

Fixed an issue where internal path monitoring failed due to a heartbeat miss.

## PAN-217728

Fixed an issue where uploading a certificate in a manual configuration option for SafenetHSM failed.

## PAN-217652

Fixed an issue on Panorama where certificates created on Panorama were not pushed to the firewall with a selective push.

## PAN-217619

Fixed an issue where supported Bi-DI transceivers were not recognized which caused ports to not
come up.

## PAN-217541

Fixed an issue where the useridd process stopped responding after a restart when HIP redistribution was enabled.

## PAN-217510

Fixed an issue where inbound DHCP packets received by a DHCP client interface that were not addressed to itself were silently dropped instead of forwarded.

## PAN-217293

Fixed a rare issue where URLs were not accessible when the header length was greater than 16,000 over HTTP/2.

## PAN-217289

Fixed an intermittent issue where HTTP/2 traffic caused buffer depletion.

## PAN-217272

Fixed an issue where the DNS proxy log included an excessive number of the following error
message: Warning: pan_dnsproxy_log_resolve_fail:
Failed to resolve domain name ** AAAA after trying all attempts
to name servers

## PAN-217241

Fixed an issue where predict session conversion failed for RTP and RTCP traffic.

## PAN-217205

Fixed an issue where the firewall did not clear port reused sessions for GlobalProtect traffic with proxy fast-session-delete enabled.

## PAN-217155

Fixed an issue where syncs between Panorama and the Cloud Identity Engine (CIE) caused intermittent slowness when using the web interface due to a large number of groups in the CIE directory.

## PAN-217123

Fixed an issue where, when log queries in the yyyy/mm/dd format displayed extra digits for the day and an error was not generated.

## PAN-217064

Fixed an issue where commits took longer than expected when the DLP plugin was configured.

## PAN-217024

Fixed an issue where fetching device certificates failed for internal DNS servers with the error message ERROR Error: Could not resolve host: certificate.paloaltonetworks.com.

## PAN-216647

Fixed an issue where the sysd node was updated at incorrect times.

## PAN-216230

Fixed an issue where the shard count reached up to 10% over the limit rather than staying under the limit.

## PAN-216077

A CLI command was added to configure the FEC for PA-5450 breakout ports.

## PAN-215583

Fixed an issue on firewalls in HA configurations where the primary firewall went into a
nonfunctional state due to a timeout in the
pan_comm logs during the
policy-based forwarding (PBF) parse, which caused an HA
failover.

## PAN-215576

Fixed an issue where the userID-Agent and TS-Agent certificates were set to expire on November 18, 2024. With this fix, the expiration date has been extended to January 2032.

## PAN-215436

Fixed an issue with the web interface where the latest logs took longer than expected to display under Monitor.

## PAN-214773

Fixed an issue where RTP packets traversing intervsys were dropped on the outgoing vsys.

## PAN-214760

Fixed an issue where, when a firewall had more than 1,200 logical interfaces, commits failed with the error message: Error pre-installing config failed to handle CONFIG_COMMIT.

## PAN-214311

Fixed an issue where users were able to add configurations via XML API even when a config lock was in place.

## PAN-214177

Fixed an issue where template configurations were not properly pushed to the firewall during an export or push of the device configuration bundle.

## PAN-213949

Fixed an issue where the VPN responder stopped responding when it received a CREATE_CHILD message with no security association (SA) payload.

## PAN-213918

Fixed an issue where mlav-test-pe-file.exe was not detected by WildFire Inline ML.

## PAN-213591

Fixed an issue where Request Categorization Change was not displayed under URL filtering logs when the Advanced URL Filtering license was applied.

## PAN-213011

Fixed an issue where, when using multi-factor authentication (MFA) with RADIUS OTP, the challenge message Enter Your Microsoft verification code did not appear when accessing the GlobalProtect portal via browser.

## PAN-212932

Fixed an issue where the firewall went into a restart loop with the following error message: failed to get mgt settings candidate: configured traffic quota of 0 MB is less than the minimum 32 MB.

## PAN-212770

Fixed an issue on the firewall where the WildFire file size limit value did not match on the web interface and the CLI.

## PAN-212580

```caveat
PA-7050 firewalls only
```

Fixed an issue where disk space filled up due to files under /opt/var/s8/lp/log/pan/ not being properly deleted.

## PAN-212576

Fixed an issue where firewall HA clusters in active/active configurations with Advanced Routing enabled did not relay to ping requests sent to a virtual IP address.

## PAN-211945

Fixed an issue where URL Filtering system logs showed the error message CURL ERROR: bind failed with errno 124: Address family not supported by protocol even though the PAN-DB cloud was connected.

## PAN-211827

Fixed an issue where Dynamic Updates failed with the following error message:
CONFIG_UPDATE_INC: Incremental update to DP failed
please try to commit force the latest config.

## PAN-211821

Fixed an issue on firewalls in HA configurations where committing changes after disabling the QoS feature on multiple Aggregate Ethernet (AE) interfaces caused the dataplane to go down.

## PAN-211255

Fixed an issue third-party VPNC IPSec clients were disconnected after a few seconds for firewalls in active/active HA configurations.

## PAN-210354

Fixed an issue where the routedd process stopped responding when executing the show static-route path-monitoring CLI command or when accessing the path monitoring records from the web interface (Network > Virtual Router > More Runtime Stats > Static Routing).

## PAN-208085

Fixed an issue where the BFD peers were deleted during a commit from Panorama. This occurred because the pan_comm thread became deadlocked due to the same sysd object was handled during the commit.

## PAN-207616

Fixed an issue on Panorama where, after selecting managed firewalls
and creating a new tag, the managed firewalls were automatically
unselected and any new tag that was created was applied to the
managed firewalls for which you initially created the tag.

## PAN-207092

Fixed an issue where logging in using default credentials after changing to FIPS-CC for NSX-T firewalls did not work.

## PAN-207003

Fixed an issue where the logrcvr process NetFlow buffer was not reset which resulted
in duplicate NetFlow records.

## PAN-206639

Fixed an issue where the LFC and NPC remained stuck during bootup.

## PAN-206041

```caveat
PA-7050 firewalls only
```

Fixed an issue where the ikemgr process stopped responding.

## PAN-205041

Fixed an issue where DNS Security cloud service unavailable logs did not indicate the service name, status code, or error message in the DNS proxy log.

## PAN-202361

Fixed an issue where packets queued to the pan_task process were still transmitted when the process was not responding.

## PAN-202095

Fixed an issue on the web interface where the language setting is not retained.

## PAN-202008

Fixed an issue where Traffic logs exported to CSV files contained inaccuracies and were not
complete.

## PAN-198043

Fixed a rare issue where aBuildXmlCache job failed on the firewall.

## PAN-196954

Fixed a memory leak issue related to the distributord process.

## PAN-196840

Fixed an issue where exporting a Security policy rule that contained Korean language characters
to CSV format resulted in the policy description being in a
nonreadable format.

## PAN-196395

```caveat
PA-5450 firewalls only
```

Fixed an issue where the firewall accepted 12 Aggregate
Ethernet interfaces, but you were unable to configure interfaces
9-12 via the web interface.

## PAN-194912

Fixed an issue where the CLI command show applications list did not return any outputs.

## PAN-194006

Fixed an issue on Panorama where *Commit Push** and Validate Push operations during a Push to Devices did not handle the configuration for shared objects, which resulted in an invalid configuration being pushed.

## PAN-193004

Fixed an issue where /opt/pancfg partition utilization reached 100%, which caused access to the Panorama web interface to fail.

## PAN-192188

```caveat
PA-5450 firewalls only
```

Fixed an issue where the show running resource-monitor ingress-backlogs CLI command failed with the following error message: Server error : Failed to intepret the DP response.

## PAN-185249

Fixed an issue where Template Stack overrides (Dynamic Updates > App & Threats > Schedule) were not able to be reverted via the web interface.

## PAN-182960

Additional error logs were added for an issue where, when multiple Panorama web interface sessions were opened, active lock did not show up on the web interface for any session.

## PAN-172600

Fixed an issue where the CLI command show rule-hit-count did not provide all details of the rule from the device group.

## PAN-171569

Fixed an issue where HIP matches were not recognized in an SSL decryption policy rule.
