---
type: Addressed
product: PAN-OS
version: 11.1.7-h2
---

## PAN-290996

Fixed an issue where SNMP walks returned a value of 0 for the CPS (Connections Per Second) per vsys on firewalls after upgrading to PAN-OS 11.1.6-h3, even when active connections were present.

## PAN-289304

```caveat
PA-7500 firewalls only
```

Fixed an issue where SNMP polling failed due to the snmpd process becoming unresponsive to incoming requests, which resulted in high CPU usage.

## PAN-289102

```caveat
PA-7500 Series, PA-5410, PA-5420, PA-5430, PA-5440, PA-5445, PA-3400 Series, PA-1400 Series, PA-400 Series, VM-Series, and CN-Series firewalls only
```

Fixed a race condition issue related to predict processing, which resulted in a dataplane restart and traffic loss.

## PAN-286897

Fixed an issue where the pan_task process stopped responding when the firewall attempted to forward files to the WildFire public cloud, which caused the dataplane to experience heartbeat failures.

## PAN-286306

Fixed an issue where, when getting transceiver information from ESCC for SFP 25G modules, the transceiver code was incorrectly updated with Unknown instead of 25GBase-SR.

## PAN-286255

Fixed an issue where, when the firewall received an unexpected termination request for SSL sessions, the dataplane experienced a slow buffer resource leak.

## PAN-285941

Fixed an issue where high memory consumption occurred on the logrcvr process.

## PAN-285651

```caveat
Panorama appliances in active/passive HA configurations on Microsoft Azure environments only
```

Fixed an issue on Panorama that caused firewalls to disconnect unexpectedly.

## PAN-285597

Fixed an issue where a routed process memory leak occurred when advanced routing was enabled.

## PAN-285590

```caveat
VM-Series firewalls on Amazon Web Services (AWS) GWLB environments only
```

Fixed an issue where the firewall CPU usage reached 100% after upgrading to PAN-OS 11.1.6-h1.

## PAN-284116

Fixed an issue where mTLS decryption bypass did not work when the decryption profile was configured with the maximum TLS version as TLS 1.3.

## PAN-284066

Fixed an issue where, after an upgrade, the SNMP polled values for IF-MIB::ifInErrors displayed a high number of errors that did not match the values in the CLI show interface command.

## PAN-283789

```caveat
Firewalls in HA configurations only
```

Fixed an issue where, after an upgrade, the mac receive error counter in receive incoming errors increased, which resulted in SNMP alerts.

## PAN-283467

```caveat
PA-3400 Series firewalls only
```

Fixed an issue where the firewall unexpectedly rebooted and entered maintenance mode due to a ctd-agent out-of-memory (OOM) condition. This occurred during advanced services load testing and a high volume of IoT EAL log forwarding.

## PAN-282391

```caveat
Panorama appliances and Log Collectors only
```

Fixed an issue where a VLD memory leak caused increased memory use, which resulted in OOM errors.

## PAN-282236

Fixed an issue where large IPv6 packets were reassembled incorrectly on the firewall when the packets arrived fragmented over an IPv4 tunnel.

## PAN-282206

Fixed an issue where configuring Secure Web Gateway (SWG) in no-auth mode led to latency when no decryption policy rules or No-decrypt policy rules were present.

## PAN-282069

Fixed an issue on Panorama where Security policy rules were removed from device groups when you cloned or edited Security policy rules that used more than 63 characters.

## PAN-282022

Fixed the support limitation for the Panorama M-600 and M-700 appliances.

## PAN-281885

Fixed an issue where, when exporting and importing CSV files, the hash values of pre-shared key variables set at template and template stack levels changed inconsistently, which resulted in both variables displaying the same hash value.

## PAN-281649

Fixed an issue where the index size limit was incorrectly calculated and indices rolled over earlier than expected, which resulted in high memory and OOM errors.

## PAN-281269

```caveat
$$PA-5420 firewalls$$
```

Fixed an issue where the firewall management server memory usage continuously increased.

## PAN-281264

Fixed an issue where the routed process memory usage continuously increased when Advanced Routing was enabled.

## PAN-280942

Fixed an issue where the logrcvr process stopped responding.

## PAN-280698

Fixed an issue where the firewall removed the TCP timestamp from client hello messages that did not fit in a single packet, which resulted in connection issues.

## PAN-280505

Fixed an issue where the web interface did not display a message to commit prior changes before attempting a partial configuration load.

## PAN-280477

Fixed an issue on the web interface were you were unable to scroll up or down to view source zones in a NAT policy rule.

## PAN-280471

Fixed an issue where navigating Panorama > Monitor > Logs was slower than expected.

## PAN-280243

Fixed an issue where the firewall lost the pre-shared key configuration assigned from a PSK variable when an unrelated device group configuration was loaded.

## PAN-279983

```caveat
PA-1400 Series firewalls only
```

Fixed an issue on the web interface where Enable Bonjour Reflector was not displayed (Network > Interfaces > Ethernet Interface).

## PAN-279746

Fixed an issue where SMTP packets were not sent out when the Client Hello arrived at the firewall in multiple out-of-order segments and the traffic was not subject to SSL decryption.

## PAN-279691

```caveat
Firewalls in active/passive HA configurations only
```

Fixed an issue where the firewall didn't synchronize IPSec SAs (security associations) to the passive firewall if the tunnel was not initially established by the active firewall.

## PAN-279621

Fixed an issue where processes stopped responding when HTTPS Forward traffic was run.

## PAN-279336

Fixed an issue where the CLI did not display a message to commit prior changes before loading a partial configuration.

## PAN-279191

Fixed an issue where a GlobalProtect gateway stopped responding when handling HTTP/1.1 traffic with web inspection enabled.

## PAN-279176

Fixed an issue where the configuration audit displayed inaccurate information after partially loading the configuration via the CLI, which caused the audit to flag the configuration as deleted or changed.

## PAN-279065

Fixed an issue where the firewall sent logs with connection succeeded to the syslog server every time a connection was established, which resulted in excessive logs.

## PAN-278296

Fixed an issue where the system MAC address of the aggregate interface was the same on the active firewall and the passive firewall after an upgrade.

## PAN-278088

Fixed an issue where the show system resources follow CLI command was not available.

## PAN-277762

```caveat
VM-Series firewalls only
```

Fixed an issue where unexpected failovers occurred on firewalls running PAN-OS 11.2.2-h2.

## PAN-277631

Fixed an issue where the logrcvr process discarded logs due to a full queue.

## PAN-277417

Fixed an memory leak issue related to TLS inbound decryption.

## PAN-276062

Fixed an issue where importing a firewall with a large number of address objects into Panorama did not work and remained at 99% completion.

## PAN-275905

Fixed an issue where the Panorama web interface was slower than expected and Elasticsearch CPU usage was high.

## PAN-275718

Fixed an issue where Panorama stopped forwarding logs to a Syslog server after upgrading to PAN-OS 11.1.5-h1.

## PAN-275713

Fixed an issue where the dscd process stopped responding when Endpoint Serial Number was enabled, which resulted in the Active Directory returning a list of serial numbers for a specific firewall from the Cloud Identity Engine.

## PAN-275077

Fixed an issue where DNS Security intermittently logs malicious domain URLs as Alert instead of taking a Sinkhole action, even when configured to Sinkhole malicious DNS domains.

## PAN-275032

```caveat
M-600 appliances only
```

Fixed an issue where the Elasticsearch cluster certificate (CC) status displayed with a past expiration date, which caused all shards to be unassigned.

## PAN-274791

Fixed an issue where the firewall might reboot when traffic matches with certain Advanced features (such as Advanced Threat Prevention and Advanced URL Filtering with properly configured URL Filtering/Anti-Spyware/Vulnerability security profiles) and Shared Pool Type 32 becomes depleted.

## PAN-274750

Fixed an issue where the detailed log view in Panorama did not display all packet details for traffic logs received from the cloud.

## PAN-274671

Fixed an issue where empty traffic logdb folders were generated for each day even when traffic logs were not received by the logrcvr process.

## PAN-274592

```caveat
Firewalls in HA configurations only
```

Fixed an issue where the firewall did not fail over when the active firewall experienced data plane issues.

## PAN-274570

Fixed an issue where the devsrvr process restarted after a failed commit due to an invalid memory access.

## PAN-274314

```caveat
PA-1400 Series firewalls, PA-3400 Series firewalls, and PA-5400 Series firewalls only
```

Fixed an issue where, when the pan_task process restarted, control plane packets were dropped, which could impact LACP and pings to host interfaces.

## PAN-273949

Fixed an issue where the firewall generated the following error message in the snmpd logs: pan_get_keystr_from_cryptod(pan_snmpinterface.c:181): Key X2F1dGhfa2V5 import from cryptod failed.

## PAN-273694

Fixed an issue where the firewall rebooted due to an out-of-bounds memory access that occurred as a result of the SIP content length value being split across packets.

## PAN-273453

Fixed an issue where restarting the firewall did not initiate an autocommit job, which caused the firewall to stop responding and the HA interface to go down.

## PAN-273422

Fixed an issue where traffic failed when Inline cloud analysis (Advanced Threat Prevention) was enabled in the Anti-Spyware profile with the action set to anything other than allow or alert and the maximum latency condition was reached.

## PAN-273308

A fix was made to address CVE-2025-0130.

## PAN-273141

Fixed an issue where GlobalProtect clients experienced slow file transfer download throughput when passing through an IPSec tunnel.

## PAN-273129

Fixed an issue on the web interface where the negate option was visible when you clicked on the rule name, but not when you viewed the target options from the rulebase attribute.

## PAN-273026

Fixed an issue where traffic logs did not display correctly when filters were applied.

## PAN-273021

Fixed an issue where 25G port links did not come up due to a change in the handling of 25G DAC modules.

## PAN-273019

Fixed an intermittent issue where SSL decryption failed.

## PAN-272812

Fixed an issue where SNMP monitoring of tunnel interfaces displayed zero values for received bytes and packets.

## PAN-272746

```caveat
PA-440 firewalls only
```

Fixed an issue where the firewall entered an unstable state after committing changes or onboarding to Panorama.

## PAN-272605

Fixed an issue where the firewall did not display VPC endpoints when there was a large amount of VPC endpoints to interface mappings.

## PAN-272171

Fixed an issue where the firewall dropped the AAAA DNS server response and caused delays in traffic from Ubuntu or Linux clients when DNS Security was enabled.

## PAN-272085

Fixed an issue where the firewall unexpectedly stopped responding and rebooted when DoH was enabled for DNS Security and multiple DoH transactions were sent in a single HTTP/1 connection.

## PAN-271915

Fixed an issue where the push scope did not populate when attempting to push a policy to a device group.

## PAN-271723

```caveat
Firewalls in HA configurations only
```

Fixed an issue where the all_task process stopped responding, which caused the passive firewall to repeatedly reboot.

## PAN-271701

Fixed an issue where Advanced Services, App-ID Cloud Engine (ACE), and Enhanced Application Log stopped working due to incorrect memory usage accounting, which caused memory usage to remain at 99% after an extended period of time.

## PAN-271700

Fixed an issue where User-ID connections were lost after an HA failover.

## PAN-271560

Fixed an issue where DNS requests to malware sites were not blocked as expected, and the dns-security-categories log-level and action displayed default values instead of unavailable.

## PAN-271498

```caveat
PA-7000 Series firewalls, PA-5200 firewalls, and PA-5400f firewalls in FIPS mode only
```

Fixed an issue where decrypted traffic repeatedly failed and frequent reboots were required.

## PAN-271351

A fix was made to address CVE-2025-0116.

## PAN-271273

Fixed an issue where the all_task process stopped responding with a SIGABRT.

## PAN-271151

Fixed an issue where the GlobalProtect client did not automatically initiate a Kerberos SSO connection after logging in to Windows.

## PAN-270849

Fixed a memory leak issue related to the configd process that occurred when running consecutive commits for multiple days.

## PAN-270744

Fixed an issue where API calls to Panorama failed with the error Server error : Timed out while getting config lock. Please try again.

## PAN-270379

Fixed an issue where socket files created in the /tmp directory were not cleared.

## PAN-270248

Fixed an issue where the firewall failed to forward logs to a SNMP trap server if the SNMP manager IP address was unable to be resolved.

## PAN-270193

Fixed an issue where the Panorama management server changed its certificate authority (CA) unexpectedly, which caused managed firewalls to disconnect.

## PAN-269737

Fixed an issue where the following critical error displayed repeatedly: /mnt/cdrom is mounted as Read-Only.

## PAN-269291

Fixed an issue where the scheduled report generation script did not return debug information.

## PAN-269193

Fixed an issue where the firewall redirected the user to the first application instead of the portal page with a list of applications when multiple applications were configured for GlobalProtect clientless VPN along with any user match.

## PAN-269139

```caveat
Firewalls with DPDK enabled in Azure, GCP, AWS, and KVM environments only
```

Fixed an issue where, after an upgrade to PAN-OS 11.1.4, the mac receive error counter increased without an error even though traffic was not impacted.

## PAN-269091

Fixed an issue where the varrcvr process stopped responding.

## PAN-269052

Fixed an issue where traffic was blocked by a URL filtering profile even though the Security policy rule did not have a URL filtering profile configured.

## PAN-269027

Fixed an issue related to external dynamic lists that caused commit times on the firewall to be higher than expected.

## PAN-268909

Fixed an issue where IP address tags were removed from firewalls after a management server or useridd process restart. This occurred when a Panorama serial-number based configuration was used for User-ID redistribution.

## PAN-268800

Fixed an issue where a large number of logs caused the logrcvr process to stop responding.

## PAN-268705

Fixed an intermittent issue where the firewall failed to process FTP traffic after upgrading to PAN-OS 10.1.14.

## PAN-268629

Fixed an issue where traffic did not match the correct security policy when using an application-filter that referenced a cloud application. This occurred when a high number of cloud applications were attached with a custom tag.

## PAN-268614

Fixed an issue on the web interface where, when all rules were highlighted when a read-only admin user clicked the Highlight Unused Rules checkbox.

## PAN-268279

Fixed an issue where autocommits failed if the management IPv6 gateway was the same as the dataplane interface IP address.

## PAN-268127

Fixed an issue where tagging devices in Panorama did not work as expected.

## PAN-268118

Fixed an issue on firewalls in active/passive HA configurations where, after a failover, irrelevant routing FIB entries were seen in the routing table on the newly active firewall.

## PAN-267995

Fixed an issue where after migrating to a new platform, DLP verdicts were not displayed in the Cloud Manager or logs.

## PAN-267671

Fixed an issue where the firewall rebooted unexpectedly due to the all_task process restarting with an OOM condition due to a memory leak on the reportd process.

## PAN-267518

Fixed an issue where WildFire submission logs incorrectly reported allowed malicious samples even when they were blocked by threat prevention profiles.

## PAN-267444

Fixed an issue where large file downloads or uploads failed or remained in an incomplete state when using DLP HTTP2 mirror mode.

## PAN-267204

Fixed an issue where Panorama port 9300 did not adhere to restricted TLS versions and ciphers.

## PAN-266695

Fixed an issue on Panorama where a cyclic nested address group configuration caused the configd process to stop responding after a commit.

## PAN-266559

Fixed an issue where partial commits failed when objects that were referenced in a high number of Security policy rules were renamed.

## PAN-266354

Fixed an issue where Hybrid-SWG explicit proxy connections failed when the number of destination domains exceeded 1024.

## PAN-266116

Fixed an issue where URLs did not work due to certificate revocation list (CRL) requests failing.

## PAN-265745

Fixed an issue where the firewall displayed incorrect MAC receive error counters for VMWare devices hosted in ESXi.

## PAN-264477

Fixed an issue where the firewall did not start Elasticsearch after a commit if Elasticsearch was not previously enabled and started.

## PAN-264423

Fixed an issue where the firewall sent a 503 response when a client connected to a web server when the firewall was configured as a web proxy and authentication bypass for Kerberos was enabled.

## PAN-263291

Fixed an issue where Microsoft Outlook did not work as expected when the GlobalProtect clientless VPN was configured.

## PAN-262063

Fixed an issue where the firewall did not display the converted configurations before a commit and reboot, and the commit failed when attempting to migrate from MS to FRR mode.

## PAN-261998

Fixed an issue where the firewall configuration process restarted during an External Dynamic List refresh or a commit and push operation.

## PAN-261825

Fixed an issue where traffic was dropped when Data Loss Prevention or Advanced URL Filtering were enabled. This occurred when the payload size was greater than 3.5 KB.

## PAN-261739

```caveat
VM-Series firewalls in Microsoft Azure environments only
```

Fixed an issue where the firewall displayed 0 for the physical port counters read from MAC.

## PAN-261597

Fixed an issue where the all_pktproc process stopped responding, which caused the firewall to become unavailable.

## PAN-261429

Fixed an issue where the show auth radius-require-msg-authentic command CLI displayed no output.

## PAN-261312

Fixed an issue where a commit for a policy and configuration dump overlapped, which resulted in a null pointer exception.

## PAN-260300

```caveat
PA-5410, PA-5420, PA-5430, PA-5440 and PA-5445 firewalls only
```

Fixed an issue related to the all_pktproc process where DPC slot 3 stopped responding.

## PAN-260149

Fixed an issue where the management plane DNS cache size was lower than expected.

## PAN-260059

Fixed an issue where Device Telemetry Regions did not show up with the latest content due to content files not being parsed for the region list when Telemetry was turned off.

## PAN-260015

Fixed an issue on the firewall where the dataplane restarted due to insufficient allocation of memory buffers.

## PAN-259767

Fixed an issue where GlobalProtect users were unable to connect when the option Block sessions if the certificate was not issued to the authenticating device was enabled in the certificate profile.

## PAN-259076

Fixed an issue where the firewall displayed an OCSP/CRL check failure when accessing websites.

## PAN-258743

Fixed an issue where, when you attempted to select a redistribution profile when creating a BGP Redistribute policy rule, the firewall displayed an empty dropdown.

## PAN-258680

Fixed an issue on Panorama where, when you removed Security profile groups from a Security policy rule via the CLI and committed the change, the Security policy rule was deleted.

## PAN-258570

Fixed an issue where the firewall might reboot unexpectedly due to the varrcvr process progressively using more memory when WildFire file forwarding is handling PE files.

## PAN-257183

Fixed an issue where the firewall dropped DNS traffic when using DNS Security.

## PAN-256904

Fixed an issue where the firewall inconsistently blocked URLs due to intermittent URL category misidentification.

## PAN-256867

Fixed an issue where the logrcvr process stopped responding while processing session logs for forwarding to the LFC.

## PAN-255914

(VM-Series firewalls on Amazon Web Services (AWS) environments only) Fixed an issue where a newly bootstrapped firewall required a management server restart, relicensing, or license push from Panorama to invoke the device certificate.

## PAN-255619

Fixed an intermittent issue where file downloads from websites failed when decrypting HTTP/2 traffic.

## PAN-254293

Fixed an issue where an explicit proxy caused intermittent SSL handshake failures to SAP applications accessing public URLs.

## PAN-253778

```caveat
PA-7500 Series firewalls in a cluster configuration only
```

Fixed an issue where users were able to enable or disable certain configurations.

## PAN-253127

Fixed an issue where, after upgrading to PAN-OS 11.0.2-h3, the hardware pool DFLT became highly utilized, and the packet buffer gradually increased.

## PAN-251724

Fixed an issue where users matched incorrect Security policy rules with a HIP profile.

## PAN-248157

Fixed an issue where the firewall showed three different sets of name validation rules when generating, importing, or editing a certificate.

## PAN-245064

```caveat
Multi-vsys firewalls only
```

Fixed an issue where commits failed on the firewall after selecting Export or push device config bundle on Panorama and a force push was required.

## PAN-235733

Fixed an issue where the displayed NTP information was incorrect if the DNS servers timed out.

## PAN-234993

Fixed an issue where CPU base gateway auto-scaling failed, which caused performance issues.

## PAN-233868

Fixed an issue where the firewall took an incorrect action for overlapping custom and edl-url-categories in a policy rule.

## PAN-216054

Fixed an issue that caused the firewall fan speed to increase while it was idle.
