Processed new reference files
This commit is contained in:
@@ -0,0 +1,9 @@
|
||||
---
|
||||
type: Addressed
|
||||
product: PAN-OS
|
||||
version: 11.1.10-h27
|
||||
---
|
||||
|
||||
## BLANK-000000
|
||||
|
||||
Fixes were made to address [CVE-2026-0273](https://security-stg.paloaltonetworks.com/CVE-2026-0273) and [CVE-2026-0272](https://security-stg.paloaltonetworks.com/CVE-2026-0272).
|
||||
@@ -0,0 +1,142 @@
|
||||
---
|
||||
type: Addressed
|
||||
product: PAN-OS
|
||||
version: 11.1.10-h28
|
||||
---
|
||||
|
||||
## PAN-321340
|
||||
|
||||
```caveat
|
||||
Firewalls in FIPS mode only
|
||||
```
|
||||
|
||||
Fixed an issue where GlobalProtect unexpectedly prompted for RADIUS authentication instead of client certificate authentication due to an OSCP validation error and subsequent CRL verification failure, which led to certificates being marked as invalid.
|
||||
|
||||
## PAN-319288
|
||||
|
||||
Fixed an issue where a DPC in Slot 4 restarted repeatedly, which caused internal path monitoring failures and a failover event.
|
||||
|
||||
## PAN-318580
|
||||
|
||||
Fixed an issue where processes restarted and the firewall unexpectedly rebooted when you configured a Security policy rule with **Source Device > quarantine**.
|
||||
|
||||
## PAN-317755
|
||||
|
||||
Fixed an issue on Panorama where selective push operations failed when plugin configurations included access-domain or log-collector references.
|
||||
|
||||
## PAN-317466
|
||||
|
||||
Fixed an issue where SIP sessions stopped progressing after the firewall received fragmented packets, fragmented at header field.
|
||||
|
||||
## PAN-316556
|
||||
|
||||
Fixed an issue where a race condition between the session ager and packet processing resulted in memory corruption and caused the pan_task process to stop responding, which resulted in the firewall becoming unresponsive
|
||||
|
||||
## PAN-315337
|
||||
|
||||
Fixed an issue where GlobalProtect throughput was reduced after an upgrade.
|
||||
|
||||
## PAN-315314
|
||||
|
||||
Fixed an issue where, when a push operation from Panorama to the firewall failed, accounting logs stopped forwarding.
|
||||
|
||||
## PAN-315160
|
||||
|
||||
```caveat
|
||||
PA-7500 firewalls only
|
||||
```
|
||||
|
||||
Fixed an issue where internal path monitoring logs incorrectly reported internal path monitoring failures when they did not occur.
|
||||
|
||||
## PAN-314623
|
||||
|
||||
```caveat
|
||||
Firewalls in active/passive HA configurations only
|
||||
```
|
||||
|
||||
Fixed an issue where, after a failover, routing information within OSPF protocol was not correctly translated or propagated, which affected network path convergence and FRR capabilities.
|
||||
|
||||
## PAN-313827
|
||||
|
||||
Fixed an issue where a memory leak occurred related to the reportd process when custom reports were run via API.
|
||||
|
||||
## PAN-313606
|
||||
|
||||
Fixed an issue where Panorama pushed commits took longer than expected to complete without displaying an error message when committing due to slow cloud-app compilation.
|
||||
|
||||
## PAN-311658
|
||||
|
||||
Fixed an issue where the reportd process stopped responding, which caused the firewall to reboot.
|
||||
|
||||
## PAN-311248
|
||||
|
||||
Fixed an issue where the ABR failed to translate and advertise the default route (0.0.0.0/0) from an OSPF NSSA area into the OSPF backbone area as a Type-5 LSA.
|
||||
|
||||
## PAN-310240
|
||||
|
||||
Fixed an issue where software packet buffers were completely utilized when performing a Data Loss Prevention longevity test.
|
||||
|
||||
## PAN-309853
|
||||
|
||||
```caveat
|
||||
Firewalls with FIPS-CC enabled only
|
||||
```
|
||||
|
||||
Fixed an issue where, when attempting to make changes to the GlobalProtect portal, an error message was displayed and configuration updates failed.
|
||||
|
||||
## PAN-308775
|
||||
|
||||
```caveat
|
||||
Firewalls in active/passive configurations only
|
||||
```
|
||||
|
||||
Fixed an issue where NTP status intermittently showed as rejected on the active firewall, which prevented the firewalls from synchronizing time.
|
||||
|
||||
## PAN-308668
|
||||
|
||||
Fixed an issue on Prisma Access Remote Network firewalls where high CPU utilization caused slowness and command timeouts.
|
||||
|
||||
## PAN-297819
|
||||
|
||||
Fixed an issue where the firewall was unable to send device telemetry files to Cortex Data Lake due to the firewall receiving an invalid upload token.
|
||||
|
||||
## PAN-293142
|
||||
|
||||
Fixed an issue where firewall components became unresponsive during sustained operation.
|
||||
|
||||
## PAN-291660
|
||||
|
||||
Fixed an issue where the firewall incorrectly reported the speed of 25G interfaces as 1G when queried using SNMP for the ifHighSpeed OID.
|
||||
|
||||
## PAN-289460
|
||||
|
||||
Fixed an issue where the timestamp value in SNMPv3 trap headers was incorrect.
|
||||
|
||||
To use this fix, run the CLI command debug log-receiver enginetime-from-snmptime yes.
|
||||
|
||||
## PAN-282335
|
||||
|
||||
Fixed an issue where firewalls in a cluster experienced approximately 50% packet loss on IPSec NATT tunnels when tunnel acceleration was enabled.
|
||||
|
||||
## PAN-280536
|
||||
|
||||
Fixed an issue where firewalls that were connected to the same Cloud Identity Engine displayed inconsistent group membership information, with some firewalls showing only a subset of users belonging to a group. This occurred due to a full or incremental group sync failure.
|
||||
|
||||
This fix introduces a retry mechanism for failed group queries to the Cloud Identity Engine. To use this feature, run the following CLI commands.
|
||||
|
||||
To enable the retry mechanism: debug user-id dscd retry-enable on.
|
||||
|
||||
To set the retry time: debug user-id dscd retry-time set-time <1-10>. The default value is 5 seconds.
|
||||
|
||||
To set the number of retry attempts: debug user-id dscd retry attempts set-attempts <3-10>. The default value is 5 attempts.
|
||||
|
||||
To disable the retry mechanism: debug user-id dscd retry-enable off.
|
||||
|
||||
Additionally, a system log is now generated when a group sync fails, and you are able to monitor the group sync status with the following CLI commands:
|
||||
|
||||
- show user group count list cloud-identity-engine
|
||||
- show user group count name <group_name>
|
||||
|
||||
## PAN-213491
|
||||
|
||||
Fixed an issue where the management CPU was high, which caused the web interface to be slower than expected.
|
||||
@@ -0,0 +1,9 @@
|
||||
---
|
||||
type: Addressed
|
||||
product: PAN-OS
|
||||
version: 11.1.13-h7
|
||||
---
|
||||
|
||||
## BLANK-000000
|
||||
|
||||
Fixes were made to address [CVE-2026-0273](https://security-stg.paloaltonetworks.com/CVE-2026-0273) and [CVE-2026-0272](https://security-stg.paloaltonetworks.com/CVE-2026-0272).
|
||||
@@ -0,0 +1,157 @@
|
||||
---
|
||||
type: Addressed
|
||||
product: PAN-OS
|
||||
version: 11.1.13-h8
|
||||
---
|
||||
|
||||
## PAN-321340
|
||||
|
||||
```caveat
|
||||
Firewalls in FIPS mode only
|
||||
```
|
||||
|
||||
Fixed an issue where GlobalProtect unexpectedly prompted for RADIUS authentication instead of client certificate authentication due to an OSCP validation error and subsequent CRL verification failure, which led to certificates being marked as invalid.
|
||||
|
||||
## PAN-320598
|
||||
|
||||
Fixed an issue where internal and external DNS names did not resolve when connected to a GlobalProtect gateway.
|
||||
|
||||
## PAN-319288
|
||||
|
||||
Fixed an issue where a DPC in Slot 4 restarted repeatedly, which caused internal path monitoring failures and a failover event.
|
||||
|
||||
## PAN-318580
|
||||
|
||||
Fixed an issue where processes restarted and the firewall unexpectedly rebooted when you configured a Security policy rule with **Source Device > quarantine**.
|
||||
|
||||
## PAN-317755
|
||||
|
||||
Fixed an issue on Panorama where selective push operations failed when plugin configurations included access-domain or log-collector references.
|
||||
|
||||
## PAN-316556
|
||||
|
||||
Fixed an issue where a race condition between the session ager and packet processing resulted in memory corruption and caused the pan_task process to stop responding, which resulted in the firewall becoming unresponsive
|
||||
|
||||
## PAN-316120
|
||||
|
||||
Fixed an issue where, after Advanced Routing was enabled, the firewall advertised routes to internal BGP neighbors with the original external BGP next-hop address.
|
||||
|
||||
## PAN-315337
|
||||
|
||||
Fixed an issue where GlobalProtect throughput was reduced after an upgrade.
|
||||
|
||||
## PAN-315314
|
||||
|
||||
Fixed an issue where, when a push operation from Panorama to the firewall failed, accounting logs stopped forwarding.
|
||||
|
||||
## PAN-315160
|
||||
|
||||
```caveat
|
||||
PA-7500 firewalls only
|
||||
```
|
||||
|
||||
Fixed an issue where internal path monitoring logs incorrectly reported internal path monitoring failures when they did not occur.
|
||||
|
||||
## PAN-314752
|
||||
|
||||
Fixed an issue on Panorama where, after removing a scheduled configuration push, Panorama still initiated the push at its previously scheduled time.
|
||||
|
||||
## PAN-314623
|
||||
|
||||
```caveat
|
||||
Firewalls in active/passive HA configurations only
|
||||
```
|
||||
|
||||
Fixed an issue where, after a failover, routing information within OSPF protocol was not correctly translated or propagated, which affected network path convergence and FRR capabilities.
|
||||
|
||||
## PAN-314385
|
||||
|
||||
```caveat
|
||||
Firewalls in active/passive HA clusters only
|
||||
```
|
||||
|
||||
Fixed an issue where high dataplane CPU usage occurred and traffic offloading decreased when a failover occurred from the active firewall to the passive firewall, and then back to the active firewall.
|
||||
|
||||
## PAN-313827
|
||||
|
||||
Fixed an issue where a memory leak occurred related to the reportd process when custom reports were run via API.
|
||||
|
||||
## PAN-313700
|
||||
|
||||
Fixed an issue where an unexpected reboot occurred when Inline Cloud Analysis was enabled in an Anti-Spyware and Vulnerability profile.
|
||||
|
||||
## PAN-313606
|
||||
|
||||
Fixed an issue where Panorama pushed commits took longer than expected to complete without displaying an error message when committing due to slow cloud-app compilation.
|
||||
|
||||
## PAN-313443
|
||||
|
||||
Fixed an issue where firewalls acting as an accumulation proxy sent a server hello with an earlier TCP timestamp value than a preceding ACK packet, which prevented successful session establishment. This occurred when the client hello messages were split across multiple network segments.
|
||||
|
||||
To use this fix, run the CLI command debug dataplane set ssl-decrypt accumulate-client-hello ts-relay yes.
|
||||
|
||||
## PAN-313036
|
||||
|
||||
Fixed an issue where the firewall dataplane continuously accumulated packets in the ctd_pkt_queue and packet buffers, which caused resource exhaustion and prematurely terminated sessions.
|
||||
|
||||
## PAN-311658
|
||||
|
||||
Fixed an issue where the reportd process stopped responding, which caused the firewall to reboot.
|
||||
|
||||
## PAN-311098
|
||||
|
||||
Fixed an issue where firewalls entered a nonfunctional state due to L7 running out of resources due to a high volume of traffic.
|
||||
|
||||
## PAN-309853
|
||||
|
||||
```caveat
|
||||
Firewalls with FIPS-CC enabled only
|
||||
```
|
||||
|
||||
Fixed an issue where, when attempting to make changes to the GlobalProtect portal, an error message was displayed and configuration updates failed.
|
||||
|
||||
## PAN-308775
|
||||
|
||||
```caveat
|
||||
Firewalls in active/passive configurations only
|
||||
```
|
||||
|
||||
Fixed an issue where NTP status intermittently showed as rejected on the active firewall, which prevented the firewalls from synchronizing time.
|
||||
|
||||
## PAN-308668
|
||||
|
||||
Fixed an issue on Prisma Access Remote Network firewalls where high CPU utilization caused slowness and command timeouts.
|
||||
|
||||
## PAN-308444
|
||||
|
||||
Fixed an issue where pushing multiple policy rules failed when the policy rules contained a large number of dynamic address object groups or user groups.
|
||||
|
||||
## PAN-297819
|
||||
|
||||
Fixed an issue where the firewall was unable to send device telemetry files to Cortex Data Lake due to the firewall receiving an invalid upload token.
|
||||
|
||||
## PAN-295082
|
||||
|
||||
Fixed an issue on the Panorama web interface where you were unable to delete or change a logical router for tunnel, SD-WAN, VLAN, or loopback interfaces under a template.
|
||||
|
||||
## PAN-293142
|
||||
|
||||
Fixed an issue where firewall components became unresponsive during sustained operation.
|
||||
|
||||
## PAN-289460
|
||||
|
||||
Fixed an issue where the timestamp value in SNMPv3 trap headers was incorrect.
|
||||
|
||||
To use this fix, run the CLI command debug log-receiver enginetime-from-snmptime yes.
|
||||
|
||||
## PAN-282335
|
||||
|
||||
Fixed an issue where firewalls in a cluster experienced approximately 50% packet loss on IPSec NATT tunnels when tunnel acceleration was enabled.
|
||||
|
||||
## PAN-240066
|
||||
|
||||
Fixed a duplicate MAC address issue where an ethernet interface sent out Gratuitous ARP (GARP) messages for an IP address that was not configured on it.
|
||||
|
||||
## PAN-213491
|
||||
|
||||
Fixed an issue where the management CPU was high, which caused the web interface to be slower than expected.
|
||||
@@ -0,0 +1,9 @@
|
||||
---
|
||||
type: Addressed
|
||||
product: PAN-OS
|
||||
version: 11.1.6-h33
|
||||
---
|
||||
|
||||
## BLANK-000000
|
||||
|
||||
Fixes were made to address [CVE-2026-0273](https://security-stg.paloaltonetworks.com/CVE-2026-0273) and [CVE-2026-0272](https://security-stg.paloaltonetworks.com/CVE-2026-0272).
|
||||
@@ -0,0 +1,49 @@
|
||||
---
|
||||
type: Addressed
|
||||
product: PAN-OS
|
||||
version: 11.1.6-h34
|
||||
---
|
||||
|
||||
## PAN-321340
|
||||
|
||||
```caveat
|
||||
Firewalls in FIPS mode only
|
||||
```
|
||||
|
||||
Fixed an issue where GlobalProtect unexpectedly prompted for RADIUS authentication instead of client certificate authentication due to an OSCP validation error and subsequent CRL verification failure, which led to certificates being marked as invalid.
|
||||
|
||||
## PAN-319288
|
||||
|
||||
Fixed an issue where a DPC in Slot 4 restarted repeatedly, which caused internal path monitoring failures and a failover event.
|
||||
|
||||
## PAN-318580
|
||||
|
||||
Fixed an issue where processes restarted and the firewall unexpectedly rebooted when you configured a Security policy rule with **Source Device > quarantine**.
|
||||
|
||||
## PAN-316556
|
||||
|
||||
Fixed an issue where a race condition between the session ager and packet processing resulted in memory corruption and caused the pan_task process to stop responding, which resulted in the firewall becoming unresponsive
|
||||
|
||||
## PAN-315314
|
||||
|
||||
Fixed an issue where, when a push operation from Panorama to the firewall failed, accounting logs stopped forwarding.
|
||||
|
||||
## PAN-308775
|
||||
|
||||
```caveat
|
||||
Firewalls in active/passive configurations only
|
||||
```
|
||||
|
||||
Fixed an issue where NTP status intermittently showed as rejected on the active firewall, which prevented the firewalls from synchronizing time.
|
||||
|
||||
## PAN-308668
|
||||
|
||||
Fixed an issue on Prisma Access Remote Network firewalls where high CPU utilization caused slowness and command timeouts.
|
||||
|
||||
## PAN-291660
|
||||
|
||||
Fixed an issue where the firewall incorrectly reported the speed of 25G interfaces as 1G when queried using SNMP for the ifHighSpeed OID.
|
||||
|
||||
## PAN-213491
|
||||
|
||||
Fixed an issue where the management CPU was high, which caused the web interface to be slower than expected.
|
||||
@@ -0,0 +1,79 @@
|
||||
---
|
||||
type: Addressed
|
||||
product: PAN-OS
|
||||
version: 11.2.10-h10
|
||||
---
|
||||
|
||||
## PAN-321150
|
||||
|
||||
Fixed an issue where the interface remained down after an upgrade.
|
||||
|
||||
## PAN-320598
|
||||
|
||||
Fixed an issue where internal and external DNS names did not resolve when connected to a GlobalProtect gateway.
|
||||
|
||||
## PAN-319266
|
||||
|
||||
```caveat
|
||||
Cloud IPS only
|
||||
```
|
||||
|
||||
Increased scale limit for zone mappings.
|
||||
|
||||
## PAN-317755
|
||||
|
||||
Fixed an issue on Panorama where selective push operations failed when plugin configurations included access-domain or log-collector references.
|
||||
|
||||
## PAN-315337
|
||||
|
||||
Fixed an issue where GlobalProtect throughput was reduced after an upgrade.
|
||||
|
||||
## PAN-315314
|
||||
|
||||
Fixed an issue where, when a push operation from Panorama to the firewall failed, accounting logs stopped forwarding.
|
||||
|
||||
## PAN-314319
|
||||
|
||||
Added a CLI command to enable and disable AHO software offload optimization.
|
||||
|
||||
## PAN-313828
|
||||
|
||||
Fixed an issue where the firewall did not forward traffic due to memory issues on a forwarding component.
|
||||
|
||||
## PAN-313606
|
||||
|
||||
Fixed an issue where Panorama pushed commits took longer than expected to complete without displaying an error message when committing due to slow cloud-app compilation.
|
||||
|
||||
## PAN-310263
|
||||
|
||||
```caveat
|
||||
VM-Series firewalls only
|
||||
```
|
||||
|
||||
Fixed an issue where enabling TLS1.3 in a decryption profile prevented access to websites.
|
||||
|
||||
## PAN-310240
|
||||
|
||||
Fixed an issue where software packet buffers were completely utilized when performing a Data Loss Prevention longevity test.
|
||||
|
||||
## PAN-307976
|
||||
|
||||
```caveat
|
||||
Firewalls in active/active HA configurations only
|
||||
```
|
||||
|
||||
Fixed an issue where tunnels failed to come up with the error message failed to find a socket for transmission.
|
||||
|
||||
## PAN-307618
|
||||
|
||||
Added a debug CLI command to address where remote networks for Prisma Access tenants randomly dropped monitoring packets from peer devices, which caused tunnels to be marked as down. This occurred when a CPU core suddenly experienced high utilization.
|
||||
|
||||
To utilize this fix, run debug dataplane set ssl-decrypt use-new-peek-window yes.
|
||||
|
||||
## PAN-292306
|
||||
|
||||
Fixed an issue where the authd process stopped handling RADIUS authentication requests and required a restart.
|
||||
|
||||
## PAN-234302
|
||||
|
||||
Fixed an issue where commit operations took longer than expected to complete due to EDL timeouts occurring on passive nodes when a service route was enabled.
|
||||
@@ -0,0 +1,226 @@
|
||||
---
|
||||
type: Addressed
|
||||
product: PAN-OS
|
||||
version: 12.1.7
|
||||
---
|
||||
|
||||
## BLANK-000000
|
||||
|
||||
Fixes were made to address the following CVEs:
|
||||
|
||||
- [CVE-2026-0265](https://security.paloaltonetworks.com/CVE-2026-0265)
|
||||
- [CVE-2026-0264](https://security.paloaltonetworks.com/CVE-2026-0264)
|
||||
- [CVE-2026-0263](https://security.paloaltonetworks.com/CVE-2026-0263)
|
||||
- [CVE-2026-0262](https://security.paloaltonetworks.com/CVE-2026-0262)
|
||||
- [CVE-2026-0261](https://security.paloaltonetworks.com/CVE-2026-0261)
|
||||
- [CVE-2026-0258](https://security.paloaltonetworks.com/CVE-2026-0258)
|
||||
- [CVE-2026-0257](https://security.paloaltonetworks.com/CVE-2026-0257)
|
||||
- [CVE-2026-0256](https://security.paloaltonetworks.com/CVE-2026-0256)
|
||||
- [CVE-2026-0259](https://security.paloaltonetworks.com/CVE-2026-0259)
|
||||
- [CVE-2026-0300](https://security.paloaltonetworks.com/CVE-2026-0300)
|
||||
|
||||
## PAN-322815
|
||||
|
||||
```caveat
|
||||
VM-Series firewalls on Microsoft Azure environments only
|
||||
```
|
||||
|
||||
Fixed an issue where the firewall entered maintenance mode after enabling FIPS-CC mode and rebooted.
|
||||
|
||||
## PAN-322681
|
||||
|
||||
Fixed an issue where the PDF Summary Reports were not generated correctly after upgrading to an affected release.
|
||||
|
||||
## PAN-322630
|
||||
|
||||
Fixed an issue where IKE gateways were not visible within Panorama Templates under **Network Profiles** from a custom administrator role after upgrading to an affected PAN-OS release.
|
||||
|
||||
## PAN-320897
|
||||
|
||||
Fixed an issue where the firewall did not detect evasions due to TCP checksum offloading not being enabled.
|
||||
|
||||
## PAN-318288
|
||||
|
||||
Fixed an issue where traffic initiated from Microsoft Azure to an on-premises firewall was not decrypted, which caused the firewall to drop the traffic. This occurred due to the firewall incorrectly identifying SPI values.
|
||||
|
||||
## PAN-318275
|
||||
|
||||
```caveat
|
||||
VM-Series firewalls only
|
||||
```
|
||||
|
||||
Fixed an issue where the firewall became unresponsive and did not automatically reboot, which led to prolonged outages. With this fix, the Linux kernel configuration will trigger a system panic and reboot.
|
||||
|
||||
## PAN-317772
|
||||
|
||||
Added a fix to improve performance in lossy network conditions.
|
||||
|
||||
## PAN-317583
|
||||
|
||||
Fixed an issue with intermittent ICMP ping drops and packet loss in traffic flows between a hub and branch after upgrading to an affected PAN-OS release due to incorrect SD-WAN path monitor state.
|
||||
|
||||
## PAN-317548
|
||||
|
||||
Fixed an issue where an IMA violation occurred when Panorama accessed GRUB during the installation process, which caused upgrades from PAN-OS 12.1.4 to PAN-OS 12.1.5 to fail.
|
||||
|
||||
## PAN-317466
|
||||
|
||||
Fixed an issue where SIP sessions stopped progressing after the firewall received fragmented packets, fragmented at header field.
|
||||
|
||||
## PAN-317215
|
||||
|
||||
```caveat
|
||||
VM-Series firewalls on ESXi with Intel E810 NICs using PCI passthrough
|
||||
```
|
||||
|
||||
Fixed an issue where the brdagent process became unresponsive during data port initialization, which resulted in system instability, interface outages, HA split-brain conditions, and unexpected reboots during failover.
|
||||
|
||||
## PAN-317177
|
||||
|
||||
Fixed an issue on firewalls in DHCP Client mode where, after upgrading to an affected release, the SNMP process unexpectedly restarted after a commit, which led to false interface flap notifications on SNMP managers.
|
||||
|
||||
## PAN-317068
|
||||
|
||||
Fixed an issue on the Panorama web interface where you were able to enable IPv6 for IKE gateways and IPSec tunnels even when IPv6 WAN was disabled, which resulted in an invalid configuration. To utilize this fix, upgrade to the latest Panorama plugin.
|
||||
|
||||
## PAN-316937
|
||||
|
||||
Fixed an issue where GlobalProtect users intermittently received incorrect private IP addresses after connecting to a gateway behind a Network Load Balancer (NLB).
|
||||
|
||||
## PAN-316740
|
||||
|
||||
Fixed an issue where, after upgrading to an affected release, HCE profiles exceeded the maximum character length when generated automatically, which caused subsequent commit operations to fail with a validation error. This occurred when HIP objects were associated with HIP profiles prior to the upgrade.
|
||||
|
||||
## PAN-316605
|
||||
|
||||
Fixed an issue where HIP redistribution to remote network nodes from external gateways resulted in a large amount of error messages in User-ID logs.
|
||||
|
||||
## PAN-315965
|
||||
|
||||
Fixed an issue to address TCP proxy fast recovery behavior to follow RFC 5681.
|
||||
|
||||
## PAN-315912
|
||||
|
||||
Fixed an issue where the Maximum Segment Size (MSS) rewrite functionality for packets ingressing through SD-WAN interfaces on firewalls was not optimized.
|
||||
|
||||
## PAN-315134
|
||||
|
||||
Fixed an issue where, after an upgrade, **IoT Devices > Asset Inventory** did not display device data even though the system reported a total count of devices.
|
||||
|
||||
## PAN-315005
|
||||
|
||||
Fixed an issue where configured RIPv2 timer parameters were not applied when the profile was configured with custom update, expire, and delete values, and the system continued to use the default timer settings, which caused unexpected route removal and network disconnections.
|
||||
|
||||
## PAN-314823
|
||||
|
||||
Fixed an issue where the management interface became unresponsive when attempting to untag an IP address via the web interface.
|
||||
|
||||
## PAN-314365
|
||||
|
||||
Fixed an issue where the logrcvr process stopped responding for traffic containing multiple XFF headers when URL XFF header logging was enabled along with additional XFF header logging, which caused subsequent commits to fail.
|
||||
|
||||
## PAN-314319
|
||||
|
||||
Added a CLI command to enable and disable AHO software offload optimization.
|
||||
|
||||
## PAN-314147
|
||||
|
||||
Fixed an issue where SSL traffic was dropped on SD-WAN DIA interfaces with member having different MTU.
|
||||
|
||||
## PAN-314020
|
||||
|
||||
Fixed an issue where the firewall did not decapsulate GENEVE packets when DNS Security retransmitted a DNS query after receiving a verdict from the cloud.
|
||||
|
||||
## PAN-313623
|
||||
|
||||
Fixed an issue where the /opt/pancfg/mgmt/ssl/private/ directory on Palo Alto Networks devices with TPM support became 100% utilized due to an accumulation of undeleted .pub_pem files. This occurred because executing the show device-certificate status CLI command initiated a process that generated these files but failed to remove them, which prevented the fetching of new device certificates.
|
||||
|
||||
## PAN-313606
|
||||
|
||||
Fixed an issue where Panorama pushed commits took longer than expected to complete without displaying an error message when committing due to slow cloud-app compilation.
|
||||
|
||||
## PAN-312514
|
||||
|
||||
Fixed an issue where correlation logs were not forwarded via syslog or email.
|
||||
|
||||
## PAN-312354
|
||||
|
||||
Fixed an issue where Captive Portal authentication redirects failed for HTTPS traffic when a user attempted to access internal HTTPS websites via URL, which led to **ERR_CONNECTION_RESET** error messages in the browser with SSL decryption and CTD handshake inspection enabled.
|
||||
|
||||
## PAN-311938
|
||||
|
||||
Fixed an issue where autocommits failed after an upgrade due to configuration memory allocation issues and 100% policy rule cache usage when both DNS Rewrite and URL Custom Category Match were configured.
|
||||
|
||||
## PAN-311040
|
||||
|
||||
Fixed an issue where the all_task process stopped responding and caused the firewall to reboot unexpectedly.
|
||||
|
||||
## PAN-310851
|
||||
|
||||
Fixed an issue where firewalls experienced snmpd log flooding with messages such as update_ifTable_utilization_rates(pan_interfacecache.c:1720): Last time is 0 for dedicated-ha2., which caused the snmpd log to overflow and be cleared every five minutes. This occurred because the snmpd process attempted to calculate interface utilization rates without first verifying if the interface had valid sysd configuration data, as the code incorrectly assumed all interfaces in the MIB would possess valid sysd data.
|
||||
|
||||
## PAN-308564
|
||||
|
||||
Fixed an issue where packets were dropped on SD-WAN interfaces when a proxy was enabled due to an MTU inconsistency where the firewall failed to rewrite the maximum segment size in SYN/ACK packets based on the SD-WAN virtual interface MTU.
|
||||
|
||||
Note: This fix does not apply when the traffic egress interface is SD-WAN Direct Internet Access (DIA) interface and proxy is enabled.
|
||||
|
||||
## PAN-308377
|
||||
|
||||
```caveat
|
||||
PA-7000 Series firewalls with an LFC in HA configurations only
|
||||
```
|
||||
|
||||
Fixed an issue where the firewall reached 100% disk utilization due to the logrcvr process repeatedly restarting and dumping core files due to a blocked hints processing thread, which caused a failover.
|
||||
|
||||
## PAN-304360
|
||||
|
||||
Fixed an issue where the firewall did not redistribute its application routes to BGP peers. This occurred in multi-mesh deployments with the multi-cloud networking feature enabled.
|
||||
|
||||
## PAN-302855
|
||||
|
||||
Fixed an issue where multiple processes restarted which caused the firewall to become unstable when processing traffic.
|
||||
|
||||
## PAN-302512
|
||||
|
||||
```caveat
|
||||
Log Collectors in HA configurations only
|
||||
```
|
||||
|
||||
Fixed an issue where log collectors displayed a disconnected inter-log collector status.
|
||||
|
||||
## PAN-300615
|
||||
|
||||
Fixed an issue where the pan_comm process stopped after multiple content versions were installed and the memory limits were reached.
|
||||
|
||||
## PAN-296635
|
||||
|
||||
Fixed an issue where the reportd process on passive Panorama management servers leaked memory due to scheduled report handling from the Strata Logging Service (SLS). This memory leak occurred daily, consuming available memory until the process was restarted.
|
||||
|
||||
## PAN-295806
|
||||
|
||||
Fixed an issue where memory leaks on the configd process occurred due to a hash insert operation failing during connection management and SSL connections.
|
||||
|
||||
## PAN-294998
|
||||
|
||||
Fixed an issue where the LogDB incorrectly reported that the database quota for extpcap logs was reached.
|
||||
|
||||
## PAN-289757
|
||||
|
||||
Fixed an issue where policy rule imports were blocked when **any** was in the source device column, which prevented the use of inbound policy rule recommendations. Additionally, when the source profile name was missing for inbound behaviors, a default policy rule name was not able to be generated.
|
||||
|
||||
## PAN-282335
|
||||
|
||||
Fixed an issue where firewalls in a cluster experienced approximately 50% packet loss on IPSec NATT tunnels when tunnel acceleration was enabled.
|
||||
|
||||
## PAN-273805
|
||||
|
||||
Fixed an issue where SAML authentication for GlobalProtect failed when the GlobalProtect portal was accessed externally on a non-standard port.
|
||||
|
||||
## PAN-273028
|
||||
|
||||
Fixed an issue where manual SCP exports from firewalls in FIPS mode were successful to SCP servers that were not FIPS-compliant. This occurred because the manual SCP process did not enforce FIPS security checks.
|
||||
|
||||
## PAN-260661
|
||||
|
||||
Fixed an issue where daily email reports generated from the custom report did not display the report details in PDF or CSV files.
|
||||
Reference in New Issue
Block a user