---
type: Addressed
product: PAN-OS
version: 11.1.10-h21
---

## PAN-316911

Fixed an issue where a newly bootstrapped firewall required a management server restart, relicensing, or license push from Panorama to invoke the device certificate.

## PAN-315176

Added an enable and disable CLI command to address an issue where the firewall experienced increased packet drops and slower performance after an upgrade due to high burst traffic.

## PAN-314319

Fixed an issue where the firewall experienced increased packet drops and slower performance after an upgrade due to high burst traffic.

## PAN-314142

Fixed an issue where establishing log forwarding connections to the Strata Logging Service (SLS) took longer than expected, which resulted in delayed log visibility on SLS.

## PAN-314061

Fixed an issue where traffic was disrupted during IPSec rekey operations due to a 2 second delay in sending the DELETE message for the previous Security Association (SA) to the peer gateway after a new SA was negotiated.

## PAN-313850

Fixed an issue where a split-brain condition occurred and HA1/HA2 links went down while upgrading when the HA configuration used dataplane interfaces for HA1 and a combination of HSCI and Ethernet interfaces for HA2.

## PAN-313623

Fixed an issue where the /opt/pancfg/mgmt/ssl/private/ directory on Palo Alto Networks devices with TPM support became 100% utilized due to an accumulation of undeleted .pub_pem files. This occurred because executing the show device-certificate status CLI command initiated a process that generated these files but failed to remove them, which prevented the fetching of new device certificates.

## PAN-313572

Fixed an issue where the dataplane restarted due to a segmentation fault.

## PAN-312706

Fixed an issue where the firewalls restarted due to a function lacking a NULL-pointer sanity check.

## PAN-311285

Fixed an issue where a memory leak occurred related to the ospfd process, which caused RAM usage to continuously increase on active devices in an HA cluster until the device stopped responding, even after an HA failover.

## PAN-311250

Fixed an issue where logs from multiple devices were not visible on Panorama even though the Elasticsearch health status on the dedicated Log Collectors appeared green.

## PAN-311073

Fixed an issue where firewalls incorrectly updated the modified date and MD5 hash of policy rules during an HA sync commit job or a subsequent local commit, even when no changes were made to the policy rules.

## PAN-309300

Fixed an issue where management plane system resources configuration size exceeded 28 MB for over 4 hours, and the following error message was displayed: Configuration size reaching device capacity limit.

## PAN-308786

Fixed an issue where traffic log queries using the device_name filter returned no results, and complex log queries that included negation operators produced incorrect outputs.

## PAN-308654

Fixed an issue where the Elasticsearch Close Indices process closed more indices than expected and dropped the number of open shards below the minimum of 800 per Elasticsearch instance. This occurred because the process did not correctly account for the number of Elasticsearch instances when calculating the maximum number of allowed open shards.

## PAN-308507

Fixed an issue where the firewall intermittently failed to maintain active log forwarding streams to Cortex Data Lake even when duplicate logging and enhanced application logging were enabled.

## PAN-307702

Fixed an issue where traffic passing through AE layer 2 interfaces was interrupted during HA failovers.

## PAN-307597

Fixed an issue where BGP peering sessions between a hub firewall and a satellite firewall over GlobalProtect LSVPN failed to connect.

## PAN-306555

Fixed an issue where the firewall stopped responding, which led to service outages.

## PAN-305700

Fixed an issue where a reboot loop occurred when OSPF interfaces were configured with a link type of **point-to-point**.

## PAN-305552

Fixed an issue where DLP logs displayed an incorrect file type when the firewall did not set the file type field.

## PAN-304718

Fixed an issue where OSPF and BGP outages occurred due to an all_task process restart during clientless VPN content rewrite processing.

## PAN-304696

Fixed an issue where the Cloud User-ID connection timed out because the firewall took too long to process the OCSP response.

## PAN-304576

Fixed an issue where the firewall entered a non-functional state due to segmentation fault within the all_pktproc process that was caused by a session that involved http2 cleartext traffic.

## PAN-304205

Fixed an issue on Panorama where, after upgrading to an affected release, a partial commit via the API did not push configuration changes to managed firewalls, and a full commit was required to synchronize the configuration.

## PAN-303959

Fixed an issue where traffic was incorrectly identified as unknown-tcp/unknown-udp due to App-ID resource leak and eventually dropped.

## PAN-303745

Fixed an issue where inter-dataplane forwarding did not work for sessions ingressing on Slot 2, which resulted in intermittent ping failures to interfaces on Network Card 2 when traffic was forwarded to Slot 3.

**Note**: With this fix, after a slot restart, the global counter will still show dot1q errors for a short period.

## PAN-303722

Fixed an issue on the firewall where configuring spyware and vulnerability profiles in Security policy rules caused a memory leak in the devsrvr process with each configuration commit.

## PAN-302654

Fixed an issue where, when the HA configuration had multiple logical routers, static or connected routes redistributed into OSPF aged out in the LSDB, which caused the routes to be removed on peer OSPF neighbors.

## PAN-301731

Fixed an issue where, when the firewall was unable to establish an SCM connection due to the discovery service returning a 404 error when the device was not yet known to the service, the firewall did not retry the attempt as expected.

## PAN-300671

Fixed an issue where traffic reports that were generated with destination/source and destination/source hostnames were not displayed in IPv4 format.

## PAN-300664

Fixed an issue on the Panorama and firewall web interface where Applications pages became unresponsive after activating the SaaS Inline license.

## PAN-300423

Fixed an issue where Data Processing Cards (DPCs) installed in slots 5 and 6 remained stuck in a starting state with the error Signal detected for port xeS5-DP0 but Link Down alerts, which resulted in device instability.

## PAN-299705

Fixed an issue where API calls to commit changes on Panorama intermittently failed when using the XML API with refresh=no, which caused changes to not be applied to the partial-commit configuration.

## PAN-299495

Fixed an issue where the show system setting ssl-decrypt certificate CLI command did not display certificates when XML output was enabled.

## PAN-298945

Fixed an issue where OSCP HTTP POST requests were not formatted correctly, which caused failures with strict responders.

## PAN-298617

Optimized the commit workflow to reduce the size of the effective configuration, resulting in lower memory consumption.

## PAN-296694

Fixed an issue where the firewall rebooted due to the useridd process repeatedly restarting during an IP-port data type writes to the redis from multiple sources such as TSA or XML in a scale environment.

## PAN-295803

Addressed a memory leak issue under sc3 and automatic commit recovery (ACR) code path.

## PAN-295802

Fixed an issue where a memory leak related to the configd process occurred.

## PAN-296202

Added a log enhancement to capture an issue where, when a commit operation was in progress, newly deployed IP address tags that used the XML API were not immediately reflected in address group resolution, which delayed IP address mapping to address groups and caused traffic to be incorrectly allowed or denied.

## PAN-294379

Fixed an issue where, when all interfaces configured for SD-WAN SaaS Application path monitoring failed, the firewall stopped forwarding traffic even if the ISP links and default gateway probing were still active.

## PAN-292306

Fixed an issue where the authd process stopped handling RADIUS authentication requests and required a restart.

## PAN-291094

Fixed an issue the firewall experienced packet descriptor on chip and buffer spikes, which led to dropped traffic due to an unidentified traffic pattern.

## PAN-290938

Fixed an issue where multiple memory leaks occurred related to the configd process.

## PAN-288175

Addressed a stack buffer overflow memory leak under plugin management code path.

## PAN-287392

Fixed the issue on the web interface where **ACC** graphs displayed **No data to display** when a filter was applied to **Source IP** or **Destination IP**.

## PAN-287159

Fixed an issue where file uploads to Dropbox stalled when using a PA-CPT device with MLC2 and DLP Mirror mode enabled for HTTP2 traffic. This occurred because the proxy was unable to decrement packet counts properly when the queue was large, resulting in a receive window size of 0 for the parent session.

## PAN-283237

Fixed an issue where traffic logs incorrectly displayed the action as **allow** for traffic matching a Security policy rule configured with the action set to **deny**. This issue occurred due to the child session being used for policy rule lookup when a configuration update triggered a rematch if the FTP-data application was not in the rule.

## PAN-279364

Fixed an issue were the queue count in the task dump displayed an incorrect number of queues for SR-IOV interfaces due to the queue mapping logic incorrectly using a non-multi-NIC function.

## PAN-279209

Fixed an issue where changes made to the management interface permitted IP address list in a global template were not pushed to the template stack or firewalls.

## PAN-278688

Fixed an issue where DNS Security threat logs were not displayed on the firewall when packet capture was enabled and the domain name length was 62 characters.

## PAN-278628

Fixed an issue where the configd process restarted during a configuration push from Panorama, which caused the active firewall to lose management access for 20-30 minutes.

## PAN-277987

Fixed an issue where HA failover mode incorrectly changed from **interface move** to **secondary IP move** after a reboot.

## PAN-274742

Fixed an issue where the task-queue dump CLI command returned incorrect information in multi-nic mode.

## PAN-273487

Fixed an issue where the distributord process restarted on firewalls in multi-vsys environments with User-ID configured and Panorama as a redistribution client. This occurred when a large volume of IP address-to-user mappings were learned.

## PAN-273158

Fixed an issue where an incorrect ASIC configuration caused silent packet drops or application slowness when receiving a mix of jumbo and non-jumbo packets.

## PAN-262353

Fixed an issue where, when Panorama was upgraded but log collectors were on an earlier version, logs from a log collector group were not viewable on a Panorama.

## PAN-259785

Fixed an issue where the devsrvr process restarted and created a core dump because two threads did not terminate correctly.

## PAN-245686

Fixed an issue where memory leaks occurred when checking for, downloading, or installing dynamic updates.

## PAN-243507

Fixed an issue on the firewall web interface where **Logical Router** did not load after an FRR stack upgrade.
