Add two new PAN-OS 11.2 releases
This commit is contained in:
@@ -0,0 +1,165 @@
|
||||
---
|
||||
type: Addressed
|
||||
product: PAN-OS
|
||||
version: 11.2.10-h5
|
||||
---
|
||||
|
||||
## PAN-318275
|
||||
|
||||
```caveat
|
||||
VM-Series firewalls only
|
||||
```
|
||||
|
||||
Fixed an issue where the firewall became unresponsive and did not automatically reboot, which led to prolonged outages. With this fix, the Linux kernel configuration will trigger a system panic and reboot.
|
||||
|
||||
## PAN-316911
|
||||
|
||||
```caveat
|
||||
VM-Series firewalls on Amazon Web Services (AWS) environments only
|
||||
```
|
||||
|
||||
Fixed an issue where a newly bootstrapped firewall required a management server restart, relicensing, or license push from Panorama to invoke the device certificate.
|
||||
|
||||
## PAN-315912
|
||||
|
||||
Fixed an issue where the Maximum Segment Size (MSS) rewrite functionality for packets ingressing through SD-WAN interfaces on firewalls was not optimized.
|
||||
|
||||
## PAN-314147
|
||||
|
||||
Fixed an issue where SSL traffic was dropped on SD-WAN DIA interfaces with member having different MTU.
|
||||
|
||||
## PAN-313623
|
||||
|
||||
Fixed an issue where the /opt/pancfg/mgmt/ssl/private/ directory on Palo Alto Networks devices with TPM support became 100% utilized due to an accumulation of undeleted .pub_pem files. This occurred because executing the show device-certificate status CLI command initiated a process that generated these files but failed to remove them, which prevented the fetching of new device certificates.
|
||||
|
||||
## PAN-313216
|
||||
|
||||
Fixed an issue where firewalls with Prisma Access incorrectly displayed some traffic as unsanctioned in traffic logs for cloud applications that were tagged as **sanctioned**.
|
||||
|
||||
## PAN-312706
|
||||
|
||||
Fixed an issue where the firewalls restarted due to a function lacking a NULL-pointer sanity check.
|
||||
|
||||
## PAN-311512
|
||||
|
||||
Fixed an issue where HIP (Host Information Profile) reports were blocked on GlobalProtect when **Authentication Cookie Usage Restrictions** was enabled and the Prisma Access Agent protocol was in use. This occurred because the system failed to correctly process HIP messages that were relayed via IPSec tunnels with a Virtual IP as the source, leading to their rejection.
|
||||
|
||||
## PAN-309300
|
||||
|
||||
Fixed an issue where management plane system resources configuration size exceeded 28 MB for over 4 hours, and the following error message was displayed: Configuration size reaching device capacity limit.
|
||||
|
||||
## PAN-308786
|
||||
|
||||
```caveat
|
||||
Panorama appliances only
|
||||
```
|
||||
|
||||
Fixed an issue where traffic log queries using the **device_name** filter returned no results, and complex log queries that included negation operators produced incorrect outputs.
|
||||
|
||||
## PAN-308564
|
||||
|
||||
Fixed an issue where packets were dropped on SD-WAN interfaces when a proxy was enabled due to an MTU inconsistency where the firewall failed to rewrite the maximum segment size in SYN/ACK packets based on the SD-WAN virtual interface MTU.
|
||||
|
||||
**Note**: This fix does not apply when the traffic egress interface is SD-WAN Direct Internet Access (DIA) interface and proxy is enabled.
|
||||
|
||||
## PAN-308507
|
||||
|
||||
```caveat
|
||||
Panorama managed firewalls only
|
||||
```
|
||||
|
||||
Fixed an issue where the firewall intermittently failed to maintain active log forwarding streams to Strata Logging Service (SLS) even when duplicate logging and enhanced application logging were enabled.
|
||||
|
||||
## PAN-308418
|
||||
|
||||
Fixed an issue where, when Advanced DNS Security was enabled and experienced unusually high loads, DNS resolution failures occurred with the error **resources-unavailable**.
|
||||
|
||||
## PAN-306555
|
||||
|
||||
Fixed an issue where the firewall stopped responding, which led to service outages.
|
||||
|
||||
## PAN-304019
|
||||
|
||||
```caveat
|
||||
VM-Series firewalls only
|
||||
```
|
||||
|
||||
Fixed an issue where the firewall did not send traffic to SCM or SLS via a configured explicit proxy IP address when the proxy username was not configured.
|
||||
|
||||
## PAN-303745
|
||||
|
||||
Fixed an issue where inter-dataplane forwarding did not work for sessions ingressing on Slot 2, which resulted in intermittent ping failures to interfaces on Network Card 2 when traffic was forwarded to Slot 3.
|
||||
|
||||
**Note**: With this fix, after a slot restart, the global counter will still show dot1q errors for a short period.
|
||||
|
||||
## PAN-302564
|
||||
|
||||
Fixed an issue on the firewall where a path monitoring failure occurred and caused the dataplane to restart.
|
||||
|
||||
## PAN-301653
|
||||
|
||||
Fixed an issue where DNS traffic sessions prematurely terminated with the message resources-unavailable. This occurred due to IPv4 fragmented DNS responses causing the Advanced DNS Security module to incorrectly pack the DNS payload multiple times when forwarding to the cloud for inspection.
|
||||
|
||||
## PAN-302983
|
||||
|
||||
Fixed an issue where, after committing changes on Panorama, a shared post-rule moved to the end of the post shared rulebase on the managed device instead of remaining at the top.
|
||||
|
||||
## PAN-300837
|
||||
|
||||
Fixed an issue where firewalls experienced multiple reboots due to the pan_task process restarting with a SIGSEGV signal. This occurred because the client-to-firewall side assumed TLS 1.3 for the firewall-server side.
|
||||
|
||||
## PAN-300671
|
||||
|
||||
Fixed an issue where traffic reports that were generated with destination/source and destination/source hostnames were not displayed in IPv4 format.
|
||||
|
||||
## PAN-300423
|
||||
|
||||
Fixed an issue where Data Processing Cards (DPCs) installed in slots 5 and 6 remained stuck in a starting state with the error **Signal detected for port xeS5-DP0 but Link Down** alerts, which resulted in device instability.
|
||||
|
||||
## PAN-299242
|
||||
|
||||
Fixed an issue where the firewall's SSL proxy sent an empty HTTP2 SETTINGS message to the client before confirming server support, which caused some clients to incorrectly assume HTTP/2 support and not fall back to HTTP/1.1. Additionally, the firewall dropped HTTP1.1 400 Bad Request frames from the server, which prevented the client from correctly detecting the lack of HTTP/2 support.
|
||||
|
||||
## PAN-298617
|
||||
|
||||
Optimized the commit workflow to reduce the size of the effective configuration, resulting in lower memory consumption.
|
||||
|
||||
## PAN-297708
|
||||
|
||||
Fixed an issue where a long-lived session with many Machine Learning (ML) model triggers caused a memory leak of feature states associated with the ML model runs. This resulted in Spyware_State failure increases, allocation max outs, and impaired policy matching.
|
||||
|
||||
## PAN-295802
|
||||
|
||||
Fixed an issue where a memory leak related to the configd process occurred.
|
||||
|
||||
## PAN-295309
|
||||
|
||||
Fixed an issue where OSPF session using MD5 authentication experienced intermittent flapping due to out-of-order packet processing.
|
||||
|
||||
## PAN-293644
|
||||
|
||||
```caveat
|
||||
Firewalls in HA configurations only
|
||||
```
|
||||
|
||||
Fixed an issue where the configd process stopped responding during an External Dynamic List (EDL) refresh.
|
||||
|
||||
## PAN-290938
|
||||
|
||||
Fixed an issue where multiple memory leaks occurred related to the configd process.
|
||||
|
||||
## PAN-264762
|
||||
|
||||
Fixed an issue where the firewall showed the status of SFP+ interfaces as not up, or up but not configured, when a PAN-SFP-PLUS-SR cable was connected.
|
||||
|
||||
## PAN-263691
|
||||
|
||||
Fixed an issue where the firewall rebooted unexpectedly due to a memory leak in the all_task process.
|
||||
|
||||
## PAN-250339
|
||||
|
||||
Added an improvement to automatically clean up idle HTTP connection pools to address an issue where idle connection pools accumulated when a circuit breaker limit was reached, which caused client requests to fail with a 503 no_healthy_upstream error.
|
||||
|
||||
## PAN-248913
|
||||
|
||||
Fixed an issue where the Elasticsearch client certificate was not auto renewed, which caused it to enter a Red state, and logs were not displayed in Panorama.
|
||||
@@ -0,0 +1,153 @@
|
||||
---
|
||||
type: Addressed
|
||||
product: PAN-OS
|
||||
version: 11.2.7-h12
|
||||
---
|
||||
|
||||
## PAN-316911
|
||||
|
||||
```caveat
|
||||
VM-Series firewalls on Amazon Web Services (AWS) environments only
|
||||
```
|
||||
|
||||
Fixed an issue where a newly bootstrapped firewall required a management server restart, relicensing, or license push from Panorama to invoke the device certificate.
|
||||
|
||||
## PAN-315912
|
||||
|
||||
Fixed an issue where the Maximum Segment Size (MSS) rewrite functionality for packets ingressing through SD-WAN interfaces on firewalls was not optimized.
|
||||
|
||||
## PAN-314147
|
||||
|
||||
Fixed an issue where SSL traffic was dropped on SD-WAN DIA interfaces with member having different MTU.
|
||||
|
||||
## PAN-313623
|
||||
|
||||
Fixed an issue where the /opt/pancfg/mgmt/ssl/private/ directory on Palo Alto Networks devices with TPM support became 100% utilized due to an accumulation of undeleted .pub_pem files. This occurred because executing the show device-certificate status CLI command initiated a process that generated these files but failed to remove them, which prevented the fetching of new device certificates.
|
||||
|
||||
## PAN-313216
|
||||
|
||||
Fixed an issue where firewalls with Prisma Access incorrectly displayed some traffic as unsanctioned in traffic logs for cloud applications that were tagged as **sanctioned**.
|
||||
|
||||
## PAN-312706
|
||||
|
||||
Fixed an issue where the firewalls restarted due to a function lacking a NULL-pointer sanity check.
|
||||
|
||||
## PAN-311512
|
||||
|
||||
Fixed an issue where HIP (Host Information Profile) reports were blocked on GlobalProtect when **Authentication Cookie Usage Restrictions** was enabled and the Prisma Access Agent protocol was in use. This occurred because the system failed to correctly process HIP messages that were relayed via IPSec tunnels with a Virtual IP as the source, leading to their rejection.
|
||||
|
||||
## PAN-309300
|
||||
|
||||
Fixed an issue where management plane system resources configuration size exceeded 28 MB for over 4 hours, and the following error message was displayed: Configuration size reaching device capacity limit.
|
||||
|
||||
## PAN-308786
|
||||
|
||||
```caveat
|
||||
Panorama appliances only
|
||||
```
|
||||
|
||||
Fixed an issue where traffic log queries using the **device_name** filter returned no results, and complex log queries that included negation operators produced incorrect outputs.
|
||||
|
||||
## PAN-308564
|
||||
|
||||
Fixed an issue where packets were dropped on SD-WAN interfaces when a proxy was enabled due to an MTU inconsistency where the firewall failed to rewrite the maximum segment size in SYN/ACK packets based on the SD-WAN virtual interface MTU.
|
||||
|
||||
**Note**: This fix does not apply when the traffic egress interface is SD-WAN Direct Internet Access (DIA) interface and proxy is enabled.
|
||||
|
||||
## PAN-308507
|
||||
|
||||
```caveat
|
||||
Panorama managed firewalls only
|
||||
```
|
||||
|
||||
Fixed an issue where the firewall intermittently failed to maintain active log forwarding streams to Strata Logging Service (SLS) even when duplicate logging and enhanced application logging were enabled.
|
||||
|
||||
## PAN-308418
|
||||
|
||||
Fixed an issue where, when Advanced DNS Security was enabled and experienced unusually high loads, DNS resolution failures occurred with the error **resources-unavailable**.
|
||||
|
||||
## PAN-306555
|
||||
|
||||
Fixed an issue where the firewall stopped responding, which led to service outages.
|
||||
|
||||
## PAN-304019
|
||||
|
||||
```caveat
|
||||
VM-Series firewalls only
|
||||
```
|
||||
|
||||
Fixed an issue where the firewall did not send traffic to SCM or SLS via a configured explicit proxy IP address when the proxy username was not configured.
|
||||
|
||||
## PAN-303745
|
||||
|
||||
Fixed an issue where inter-dataplane forwarding did not work for sessions ingressing on Slot 2, which resulted in intermittent ping failures to interfaces on Network Card 2 when traffic was forwarded to Slot 3.
|
||||
|
||||
**Note**: With this fix, after a slot restart, the global counter will still show dot1q errors for a short period.
|
||||
|
||||
## PAN-302983
|
||||
|
||||
Fixed an issue where, after committing changes on Panorama, a shared post-rule moved to the end of the post shared rulebase on the managed device instead of remaining at the top.
|
||||
|
||||
## PAN-302564
|
||||
|
||||
Fixed an issue on the firewall where a path monitoring failure occurred and caused the dataplane to restart.
|
||||
|
||||
## PAN-301653
|
||||
|
||||
Fixed an issue where DNS traffic sessions prematurely terminated with the message resources-unavailable. This occurred due to IPv4 fragmented DNS responses causing the Advanced DNS Security module to incorrectly pack the DNS payload multiple times when forwarding to the cloud for inspection.
|
||||
|
||||
## PAN-300837
|
||||
|
||||
Fixed an issue where firewalls experienced multiple reboots due to the pan_task process restarting with a SIGSEGV signal. This occurred because the client-to-firewall side assumed TLS 1.3 for the firewall-server side.
|
||||
|
||||
## PAN-300671
|
||||
|
||||
Fixed an issue where traffic reports that were generated with destination/source and destination/source hostnames were not displayed in IPv4 format.
|
||||
|
||||
## PAN-300423
|
||||
|
||||
Fixed an issue where Data Processing Cards (DPCs) installed in slots 5 and 6 remained stuck in a starting state with the error **Signal detected for port xeS5-DP0 but Link Down** alerts, which resulted in device instability.
|
||||
|
||||
## PAN-299242
|
||||
|
||||
Fixed an issue where the firewall's SSL proxy sent an empty HTTP2 SETTINGS message to the client before confirming server support, which caused some clients to incorrectly assume HTTP/2 support and not fall back to HTTP/1.1. Additionally, the firewall dropped HTTP1.1 400 Bad Request frames from the server, which prevented the client from correctly detecting the lack of HTTP/2 support.
|
||||
|
||||
## PAN-298617
|
||||
|
||||
Optimized the commit workflow to reduce the size of the effective configuration, resulting in lower memory consumption.
|
||||
|
||||
## PAN-297708
|
||||
|
||||
Fixed an issue where a long-lived session with many Machine Learning (ML) model triggers caused a memory leak of feature states associated with the ML model runs. This resulted in Spyware_State failure increases, allocation max outs, and impaired policy matching.
|
||||
|
||||
## PAN-295802
|
||||
|
||||
Fixed an issue where a memory leak related to the configd process occurred.
|
||||
|
||||
## PAN-295309
|
||||
|
||||
Fixed an issue where OSPF session using MD5 authentication experienced intermittent flapping due to out-of-order packet processing.
|
||||
|
||||
## PAN-293644
|
||||
|
||||
```caveat
|
||||
Firewalls in HA configurations only
|
||||
```
|
||||
|
||||
Fixed an issue where the configd process stopped responding during an External Dynamic List (EDL) refresh.
|
||||
|
||||
## PAN-290938
|
||||
|
||||
Fixed an issue where multiple memory leaks occurred related to the configd process.
|
||||
|
||||
## PAN-264762
|
||||
|
||||
Fixed an issue where the firewall showed the status of SFP+ interfaces as not up, or up but not configured, when a PAN-SFP-PLUS-SR cable was connected.
|
||||
|
||||
## PAN-263691
|
||||
|
||||
Fixed an issue where the firewall rebooted unexpectedly due to a memory leak in the all_task process.
|
||||
|
||||
## PAN-248913
|
||||
|
||||
Fixed an issue where the Elasticsearch client certificate was not auto renewed, which caused it to enter a Red state, and logs were not displayed in Panorama.
|
||||
@@ -18,7 +18,8 @@
|
||||
"12.1.3_2026-03-31.md",
|
||||
"12.1.4_2026-03-31.md",
|
||||
"12.1.5_2026-03-31.md",
|
||||
"12.1.6_2026-03-31.md"]
|
||||
"12.1.6_2026-03-31.md"
|
||||
]
|
||||
}
|
||||
},
|
||||
"11": {
|
||||
@@ -78,9 +79,11 @@
|
||||
"11.2.5_2026-03-16.md",
|
||||
"11.2.6_2026-03-16.md",
|
||||
"11.2.7_2026-03-16.md",
|
||||
"11.2.7-h12_2026-04-13.md",
|
||||
"11.2.8_2026-03-16.md",
|
||||
"11.2.9_2026-03-16.md",
|
||||
"11.2.10_2026-03-16.md"
|
||||
"11.2.10_2026-03-16.md",
|
||||
"11.2.10-h5_2026-04-13.md"
|
||||
]
|
||||
},
|
||||
"11.1": {
|
||||
|
||||
Reference in New Issue
Block a user