aaron.axvig/firewallissues
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revise PAN-OS 11.2 addressed issues

Browse Source
This commit is contained in:
aaron.axvig
2026-04-13 14:56:21 -05:00
parent 19c7c5a6d3
commit 71f86eed34
84 changed files with 32057 additions and 236 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web/data/issues/PAN-OS/addressed/11.2.7-h1.md
+5 -3
View File
@@ -42,7 +42,7 @@ Fixed an issue where persistent commit failures occurred due to a missing transf
## PAN-289268
Fixed an issue where internet access through Secure Web Gateway (SWG) proxy nodes did not work when the default internet access policy rule source user was not known-user .
Fixed an issue where internet access through Secure Web Gateway (SWG) proxy nodes did not work when the default internet access policy rule source user was not **known-user**.
## PAN-288939
@@ -66,7 +66,9 @@ Fixed an issue where the popup window did not appear as expected for Clientless
## PAN-279901
Fixed an issue where the firewall dropped client hello packets when decryption was enabled, which prevented access to certain websites. This occurred when the client hello packet was truncated, the accumulation proxy assumed that the first packet contains at least 5 bytes, or out-of-order packets were waiting in L4 TCP.
An issue was fixed where the firewall dropped fragmented TLS ClientHello packets, which blocked access to certain websites. This occurred because the packets arrived truncated, in varying sizes and orders, and the firewall's heuristics failed to handle them correctly.
To enable this fix, run: debug dataplane set ssl-decrypt accumulate-client-hello disjoined yes
## PAN-279690
@@ -98,4 +100,4 @@ Fixed an issue where the all_pktproc process stopped responding when the firewal
## PAN-252706
Fixed an issue where the URL filtering response page for Continue and Override did not work with IPv6 Router Advertisement (RA) or Multicast Listener Query (MLQ) for IPv6-to-IPv6 and IPv6-to-IPv4 traffic.
Fixed an issue where the URL filtering response page for **Continue** and **Override** did not work with IPv6 Router Advertisement (RA) or Multicast Listener Query (MLQ) for IPv6-to-IPv6 and IPv6-to-IPv4 traffic.