A race condition may cause the dataplane to restart unexpectedly when a zip decompression offload result is returned for a session that has already closed. The session state is not validated before processing the result because the offload result does not follow the fastpath where these checks are normally performed.

Workaround: Disable zip hardware offloading (may cause higher CPU usage).

After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push may result in incomplete or inconsistent configurations across virtual systems.

A firewall may become unresponsive after an upgrade due to the fsck command scanning drive partitions in parallel with the root partition, causing the process to take an extended amount of time.

(VM-Series firewalls in Microsoft Azure environments only) After upgrading to an affected release, the firewall restarts continuously because the brdagent process restarts multiple times and exhausts its restart limit, resulting in a segfault error. This issue occurs when a high burst of traffic is sent to the Azure PA-VM (Palo Alto Networks Virtual Machine), and impacts production environments due to the regular reboots.

Workaround: Migrate the VM instance to Dv5 instance type. On these instance types, SYN packets are not routed to the synthetic path, avoiding this condition. Suggested direct resizing paths are:

• D3_v2/DS3_v2 to D8ds_v5
• D4_v2/DS4_v2 to D8ds_v5
• D5_v2/DS5_v2 to D16ds_v5

A configd memory leak occurs post commit (during Panorama connectivity check), potentially leading to OOM (out of memory condition) and device reboot.

Palo Alto Networks next-generation firewalls may experience service disruptions due to all_task process crashes when deployed in environments having non-uniform MTU and are terminating IPSec tunnels.

During a commit, the firewall experiences an out-of-memory (OOM) condition due to a memory leak and displays an error message. This issue causes the device to crash and reboot unexpectedly.

A memory leak in the configd process might lead to an active firewall to reboot due to an Out-of-Memory (OOM) condition. This issue is observed when specific status commands, such as request log-collector forwarding status are executed at high frequencies.

When performing an SNMP walk, the Connections Per Second (CPS) counters incorrectly return a value of 0 for each virtual system (VSYS), despite the firewall actively processing connections.

(Firewalls in HA configurations only) Routed process may stop responding after changing MTU or any link parameters when OSPF and PIM are enabled on the same interface.

When SSL Inbound Inspection is enabled and the firewall receives fragmented Client Hello packets that include the TCP timestamp option, the Client Hello message is forwarded to the destination server without the timestamp option.

When performing a partial Commit and Push on Panorama, there is a risk that unintended configuration changes might be pushed to a firewall.

This issue is more likely to occur in the following scenarios:

• When you run Commit and Push operations as a single action.
• When you trigger multiple parallel commit-all jobs at the same time.
• Device groups and templates have different configuration synchronization versions.

Workaround: Perform one of the following steps:

The firewall web interface becomes inaccessible and commits fail.

A cumulative memory leak in the devsrvr process gets progressively worse whenever the CLI command show running application statistics is issued. This memory leak will gradually consume system memory and produce an out-of-memory (OOM) condition, leading to an eventual firewall reboot.

Workaround: Avoid using the CLI command: show running application statistics.

The Advanced WildFire Inline ML models OOXML and Mach-O erroneously display as being available from the CLI; however, they are only available on PAN-OS 11.1.3 and later releases.

(PA-7000 Series only) The web interface is unresponsive after upgrading to PAN-OS 10.2.7-h18. The following error is generated: PHP Fatal error: require(): Failed opening required

Workaround: Use the CLI to downgrade or upgrade to another version.

(PA-7000 Series firewalls only) Due to an incorrect configuration on the ASIC, receiving a mix of jumbo and non-jumbo packets may cause silent packet drops or application slowness.

(PA-3400 and PA-5400 Series firewalls) The links on the firewall's RJ-45 ports may go up and down additional times during a reboot, causing unexpected downtime.

GlobalProtect portal is not accessible via a web browser and the app displays the error ERR_EMPTY_RESPONSE.

Upgrading a flexible-vCPU VM-Series firewall HA deployment from 10.1.x directly to 10.2.3 or later causes the active HA peer to become unresponsive. In this scenario, the upgraded firewall then becomes the active peer.

Workaround: Upgrade the VM-Series firewalls to PAN-OS 10.2.2 before upgrading to the latest PAN-OS 10.2.x version.

LSVPN satellite certificates may be generated with serial numbers exceeding 40 hexadecimal characters. This causes certificate revocation and deletion operations to fail with the following error messages:

To resolve this issue, use the following CLI commands with the LSVPN satellite serial number to manually delete or revoke the affected certificates:

Delete certificate information:delete sslmgr-store certificate-info portal name <name> serialno <satellite_serial>

Revoke satellite certificates:delete sslmgr-store satellite-info-revoke-certificate portal <name> serialno <list_of_satellite_serials>

The X-Forwarded-For (XFF) value is not displayed in traffic logs.

Default login credentials and SSH fail after enabling FIPS-CC Mode on a firewall or Panorama after converting through the Maintenance Recovery Tool (MRT). The firewall or Panorama becomes stuck and requires a factory reset to recover.

On the PAN-OS 10.2.7-h3 version, GlobalProtect tunnel might disconnect shortly after being established when SSL is used as a transport protocol.

Workaround: Disable Internet Protocol version 6 (TCP/IPv6) on the PANGP Virtual Network Adapter.

FIPS-CC VM only. Upgrading to 10.1.10-h2 or 10.1.11 will change all locally created security Policy actions to Deny. Re-load the back-up config taken before upgrading or the last version to get the previous config back. Also, Unable to login to FIPSCC Mode devices with default credentials after converting the mode for 10.1.12 release , 10.2.7 release , 11.1.0 , 11.1.1, 11.0.3 versions.

When the GlobalProtect app is installed on iOS endpoints and the gateway is configured to accept cookies, the app stays in Connecting stage after authentication and the GlobalProtect log displays the error message, User is not in allow list. This happens when the app is restarted or when the app tries to reconnect after disconnection.

(PA-3410, PA-3420, PA-3430, PA-3440, PA-5410, PA-5420, and PA-5430 firewalls) By enabling Lockless QoS feature, a slight degradation in App-ID and Threat performance is expected.

If the number of group queries exceeds the Okta rate limit threshold, the firewall clears the cache for the groups. To avoid encountering this issue, disable the Okta rate limit.

The firewall intermittently records a reconnection message to the authentication server as a error, even if no disconnection occurs.

Users are unable to log in to the GlobalProtect app using SAML authentication after the app is upgraded to 10.2.3-h4 and the GlobalProtect logs display the following error message: Username from SAML SSO response is different from the input..

The firewall is responding to an ARP request for an IP address in the firewall's NAT address pool when that IP address isn't in the same subnet as the IP address of the ingress interface.

No results are displayed when you Show Application Filter for a Security policy rule (PoliciesSecurityApplicationValueShow Application Filter).