From a404ee5df70c5a85cbcf0cbac84e69e5c9e6608c Mon Sep 17 00:00:00 2001 From: aaronaxvig Date: Sat, 10 Oct 2026 15:04:59 -0500 Subject: [PATCH] Add PAN-OS 10.2 reference files --- reference/PAN-OS/addressed/10.2.10-h10.html | 171 + reference/PAN-OS/addressed/10.2.10-h12.html | 525 +++ reference/PAN-OS/addressed/10.2.10-h14.html | 509 +++ reference/PAN-OS/addressed/10.2.10-h17.html | 645 +++ reference/PAN-OS/addressed/10.2.10-h18.html | 460 ++ reference/PAN-OS/addressed/10.2.10-h2.html | 114 + reference/PAN-OS/addressed/10.2.10-h21.html | 871 ++++ reference/PAN-OS/addressed/10.2.10-h27.html | 624 +++ reference/PAN-OS/addressed/10.2.10-h3.html | 196 + reference/PAN-OS/addressed/10.2.10-h4.html | 327 ++ reference/PAN-OS/addressed/10.2.10-h40.html | 70 + reference/PAN-OS/addressed/10.2.10-h5.html | 78 + reference/PAN-OS/addressed/10.2.10-h7.html | 372 ++ reference/PAN-OS/addressed/10.2.10-h9.html | 204 + reference/PAN-OS/addressed/10.2.10.html | 742 ++++ reference/PAN-OS/addressed/10.2.11-h1.html | 69 + reference/PAN-OS/addressed/10.2.11-h10.html | 41 + reference/PAN-OS/addressed/10.2.11-h12.html | 351 ++ reference/PAN-OS/addressed/10.2.11-h2.html | 91 + reference/PAN-OS/addressed/10.2.11-h3.html | 45 + reference/PAN-OS/addressed/10.2.11-h4.html | 57 + reference/PAN-OS/addressed/10.2.11-h6.html | 170 + reference/PAN-OS/addressed/10.2.11-h9.html | 170 + reference/PAN-OS/addressed/10.2.11.html | 1474 +++++++ reference/PAN-OS/addressed/10.2.12-h1.html | 42 + reference/PAN-OS/addressed/10.2.12-h2.html | 61 + reference/PAN-OS/addressed/10.2.12-h3.html | 129 + reference/PAN-OS/addressed/10.2.12-h4.html | 41 + reference/PAN-OS/addressed/10.2.12-h6.html | 451 ++ reference/PAN-OS/addressed/10.2.12.html | 449 ++ reference/PAN-OS/addressed/10.2.13-h24.html | 60 + reference/PAN-OS/addressed/10.2.14-h1.html | 33 + reference/PAN-OS/addressed/10.2.14.html | 4322 +++++++++++++++++++ reference/PAN-OS/addressed/10.2.15.html | 613 +++ reference/PAN-OS/addressed/10.2.16-h10.html | 60 + reference/PAN-OS/addressed/10.2.17.html | 3915 +++++++++++++++++ reference/PAN-OS/addressed/10.2.18-h10.html | 82 + reference/PAN-OS/addressed/10.2.8-h10.html | 501 +++ reference/PAN-OS/addressed/10.2.8-h13.html | 355 ++ reference/PAN-OS/addressed/10.2.8-h15.html | 184 + reference/PAN-OS/addressed/10.2.8-h18.html | 316 ++ reference/PAN-OS/addressed/10.2.8-h19.html | 41 + reference/PAN-OS/addressed/10.2.8-h3.html | 41 + reference/PAN-OS/addressed/10.2.8-h4.html | 219 + reference/PAN-OS/addressed/10.2.8.html | 2791 ++++++++++++ reference/PAN-OS/addressed/10.2.9-h1.html | 41 + reference/PAN-OS/addressed/10.2.9-h11.html | 147 + reference/PAN-OS/addressed/10.2.9-h14.html | 356 ++ reference/PAN-OS/addressed/10.2.9-h16.html | 235 + reference/PAN-OS/addressed/10.2.9-h18.html | 333 ++ reference/PAN-OS/addressed/10.2.9-h19.html | 41 + reference/PAN-OS/addressed/10.2.9-h21.html | 241 ++ reference/PAN-OS/addressed/10.2.9-h9.html | 445 ++ reference/PAN-OS/addressed/10.2.9.html | 365 ++ 54 files changed, 25286 insertions(+) create mode 100644 reference/PAN-OS/addressed/10.2.10-h10.html create mode 100644 reference/PAN-OS/addressed/10.2.10-h12.html create mode 100644 reference/PAN-OS/addressed/10.2.10-h14.html create mode 100644 reference/PAN-OS/addressed/10.2.10-h17.html create mode 100644 reference/PAN-OS/addressed/10.2.10-h18.html create mode 100644 reference/PAN-OS/addressed/10.2.10-h2.html create mode 100644 reference/PAN-OS/addressed/10.2.10-h21.html create mode 100644 reference/PAN-OS/addressed/10.2.10-h27.html create mode 100644 reference/PAN-OS/addressed/10.2.10-h3.html create mode 100644 reference/PAN-OS/addressed/10.2.10-h4.html create mode 100644 reference/PAN-OS/addressed/10.2.10-h40.html create mode 100644 reference/PAN-OS/addressed/10.2.10-h5.html create mode 100644 reference/PAN-OS/addressed/10.2.10-h7.html create mode 100644 reference/PAN-OS/addressed/10.2.10-h9.html create mode 100644 reference/PAN-OS/addressed/10.2.10.html create mode 100644 reference/PAN-OS/addressed/10.2.11-h1.html create mode 100644 reference/PAN-OS/addressed/10.2.11-h10.html create mode 100644 reference/PAN-OS/addressed/10.2.11-h12.html create mode 100644 reference/PAN-OS/addressed/10.2.11-h2.html create mode 100644 reference/PAN-OS/addressed/10.2.11-h3.html create mode 100644 reference/PAN-OS/addressed/10.2.11-h4.html create mode 100644 reference/PAN-OS/addressed/10.2.11-h6.html create mode 100644 reference/PAN-OS/addressed/10.2.11-h9.html create mode 100644 reference/PAN-OS/addressed/10.2.11.html create mode 100644 reference/PAN-OS/addressed/10.2.12-h1.html create mode 100644 reference/PAN-OS/addressed/10.2.12-h2.html create mode 100644 reference/PAN-OS/addressed/10.2.12-h3.html create mode 100644 reference/PAN-OS/addressed/10.2.12-h4.html create mode 100644 reference/PAN-OS/addressed/10.2.12-h6.html create mode 100644 reference/PAN-OS/addressed/10.2.12.html create mode 100644 reference/PAN-OS/addressed/10.2.13-h24.html create mode 100644 reference/PAN-OS/addressed/10.2.14-h1.html create mode 100644 reference/PAN-OS/addressed/10.2.14.html create mode 100644 reference/PAN-OS/addressed/10.2.15.html create mode 100644 reference/PAN-OS/addressed/10.2.16-h10.html create mode 100644 reference/PAN-OS/addressed/10.2.17.html create mode 100644 reference/PAN-OS/addressed/10.2.18-h10.html create mode 100644 reference/PAN-OS/addressed/10.2.8-h10.html create mode 100644 reference/PAN-OS/addressed/10.2.8-h13.html create mode 100644 reference/PAN-OS/addressed/10.2.8-h15.html create mode 100644 reference/PAN-OS/addressed/10.2.8-h18.html create mode 100644 reference/PAN-OS/addressed/10.2.8-h19.html create mode 100644 reference/PAN-OS/addressed/10.2.8-h3.html create mode 100644 reference/PAN-OS/addressed/10.2.8-h4.html create mode 100644 reference/PAN-OS/addressed/10.2.8.html create mode 100644 reference/PAN-OS/addressed/10.2.9-h1.html create mode 100644 reference/PAN-OS/addressed/10.2.9-h11.html create mode 100644 reference/PAN-OS/addressed/10.2.9-h14.html create mode 100644 reference/PAN-OS/addressed/10.2.9-h16.html create mode 100644 reference/PAN-OS/addressed/10.2.9-h18.html create mode 100644 reference/PAN-OS/addressed/10.2.9-h19.html create mode 100644 reference/PAN-OS/addressed/10.2.9-h21.html create mode 100644 reference/PAN-OS/addressed/10.2.9-h9.html create mode 100644 reference/PAN-OS/addressed/10.2.9.html diff --git a/reference/PAN-OS/addressed/10.2.10-h10.html b/reference/PAN-OS/addressed/10.2.10-h10.html new file mode 100644 index 0000000..2c20d26 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.10-h10.html @@ -0,0 +1,171 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-268823
+ 		+
+ Fixed an issue where + Monitor > Log Display did not + display all logs when you applied a filter. +
+
+
PAN-268727
+ 		+
+ Fixed an issue where traffic was dropped when the accumulation proxy + was enabled and header insertion modified packets. +
+
+
PAN-268314
+ 		+
+ Fixed an issue where new files were not sent to WildFire. With this + fix, the WildFire reserved drive space has been increased for greater + session caching capability. +
+
+
PAN-268002
+ 		+
+ Fixed an issue where URL filtering response pages were not displayed + for sites that were blocked as a result of SSL/TLS handshake + inspection. +
+
+
PAN-267704
+ 		+
+ Fixed an issue where the firewall did not send an ICMP error packet to + Envoy when the MSS was exceeded. +
+
+
PAN-263973
+ 		+
+ Fixed an issue where log collectors had a low incoming log rate. +
+
+
PAN-261673
+ 		+
+ (VM-Series firewalls on Microsoft Azure environments only) Fixed an issue where, when Accelerated Networking was enabled, + traffic was dropped because of the + flow_parse_ip_hdr counter related + to an Nvidia driver issue. +
+
+
PAN-257601
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where + Networking Cards (NC) experienced an internal link fault which caused + path monitoring failure on the Dataplane Processing Card (DPC). +
+
+
PAN-253213
+ 		+
+ Fixed an issue where the firewall sent HIP notifications every time it + received a HIP report instead of every two hours. +
+
+
PAN-246699
+ 		+
+ Fixed an issue on Panorama where + Rule Usage and + Apps Seen under Security policy + rules stopped incrementing. +
+
+
PAN-233195
+ 		+
+ Fixed an issue where logs continued to be ingested when the + vldmgr + process was restarted. +
+
diff --git a/reference/PAN-OS/addressed/10.2.10-h12.html b/reference/PAN-OS/addressed/10.2.10-h12.html new file mode 100644 index 0000000..25526b6 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.10-h12.html @@ -0,0 +1,525 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-273215
+ 		+
+ Fixed an issue where a syntax error in the index generation script + caused a high management plane CPU load after upgrading +
+
+
PAN-271774
+ 		+
+ Fixed an issue where the firewall logs displayed the reason for data + filtering action as + FW Skipped: XXXX. +
+
+
PAN-268823
+ 		+
+ Fixed an issue where + Monitor > Log Display did not + display all logs when you applied a filter. +
+
+
PAN-268727
+ 		+
+ Fixed an issue where traffic was dropped when the accumulation proxy + was enabled and header insertion modified packets. +
+
+
PAN-268314
+ 		+
+ Fixed an issue where new files were not sent to WildFire. With this + fix, the WildFire reserved drive space has been increased for greater + session caching capability. +
+
+
PAN-268002
+ 		+
+ Fixed an issue where URL filtering response pages were not displayed + for sites that were blocked as a result of SSL/TLS handshake + inspection. +
+
+
PAN-267704
+ 		+
+ Fixed an issue where the firewall did not send an ICMP error packet to + Envoy when the MSS was exceeded. +
+
+
PAN-265111
+ 		+
+ Fixed an issue where fragmented SSL hello packets were reordered when + going out of the SC/ZTT towards the datacenter. +
+
+
PAN-264249
+ 		+
+ Fixed an issue on the firewall where SNMP queries timed out when using + SNMP. +
+
+
PAN-263973
+ 		+
+ Fixed an issue where log collectors had a low incoming log rate. +
+
+
PAN-263287
+ 		+
+ The PAN-COMMON-MIB.my file was updated to support new object + identifiers (OID) to poll interface use via SNMP with table + identifiers. +
+
+
PAN-262383
+ 		+
+ Fixed an issue where the firewall was unable to decompress the HTTP2 + header, which caused the session to be classified as unknown-tcp + instead of web-browsing. +
+
+
PAN-261673
+ 		+
+ (VM-Series firewalls on Microsoft Azure environments only) Fixed an issue where, when Accelerated Networking was enabled, + traffic was dropped because of the + flow_parse_ip_hdr counter related + to an Nvidia driver issue. +
+
+
PAN-259910
+ 		+
+ Fixed an issue where the firewall reported the same value over + consecutive SNMP polls when asynchronous mode was enabled. +
+
+
PAN-259351
+ 		+
+ A fix was made to address + CVE-2024-3393. +
+
+
PAN-258166
+ 		+
+ (PA-220 firewalls only) Fixed an issue where + the root partition frequently reached 100%. +
+
+
PAN-257601
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where + Networking Cards (NC) experienced an internal link fault which caused + path monitoring failure on the Dataplane Processing Card (DPC). +
+
+
PAN-257515
+ 		+
+ Fixed an issue where Possible Domain Fronting Detection for HTTP/2 + generated false positives. With this change, domain fronting is + limited to HTTP/1. +
+
+
PAN-257327
+ 		+
+ (PA-5440 firewalls only) Fixed an issue where a + failover event occurred unexpectedly on the firewall. +
+
+
PAN-255930
+ 		+
+ Fixed an issue where persistent DIPP NAT entries were deleted even + when being used during an active session. +
+
+
PAN-253213
+ 		+
+ Fixed an issue where the firewall sent HIP notifications every time it + received a HIP report instead of every two hours. +
+
+
PAN-248067
+ 		+
+ Fixed an issue where inter firewall tunnels between Mobile User + Gateway node and ZTNA tunnel terminators were down due to host routes + getting aged out while still in the routing table. +
+
+
PAN-247857
+ 		+
+ (PA-7050 firewalls in HA configurations only) + Fixed an issue on the firewall where a dataplane process restarted + when updating the routing table. +
+
+
PAN-246699
+ 		+
+ Fixed an issue on Panorama where + Rule Usage and + Apps Seen under Security policy + rules stopped incrementing. +
+
+
PAN-245428
+ 		+
+ Fixed an issue where FIB entries aged out and were incorrectly removed + after an HA failover event. +
+
+
PAN-244894
+ 		+
+ Fixed an issue where turning off + mprelay + logging caused + mprelay + heartbeat failure. +
+
+
PAN-241126
+ 		+
+ Fixed an issue where the client IP address was incorrect in the + authentication logs for Captive Portal authentication events when the + client used IPv6. +
+
+
PAN-240739
+ 		+
+ Fixed an issue where the ECMP FIB update on the dataplane did not + clear the pending change flag, which caused the next non-ECMP FIB + update to miss the latest generation ID and age out after 5 minutes. +
+
+
PAN-239271
+ 		+
+ Fixed an issue where changing the firewall's DNS led to connectivity + to the hostname-configured User-ID agent. +
+
+
PAN-236685
+ 		+
+ Fixed an issue where the Traffic log did not display the results of an + application filter. +
+
+
PAN-233712
+ 		+
+ Fixed an issue where the firewall did not install a host route in the + FIB when the BGP peer was down, which caused traffic to be dropped. +
+
+
PAN-233581
+ 		+
+ Fixed an issue on firewalls in active/active HA configurations where + SYN+ACK packets of asymmetric TCP sessions were dropped because of a + session synchronization issue. +
+
+
PAN-233195
+ 		+
+ Fixed an issue where logs continued to be ingested when the + vldmgr + process was restarted. +
+
+
PAN-229367
+ 		+
+ Fixed an issue where the firewall restarted when a route update + message was received while the firewall was processing traffic. +
+
+
PAN-227543
+ 		+
+ Fixed an issue where the firewall did not match traffic to FQDN + objects if the FQDN object contained uppercase characters. +
+
+
PAN-227503
+ 		+
+ Fixed an issue where the link status of the log interface was unable + to be obtained correctly using SNMP. +
+
+
PAN-225213
+ 		+
+ Fixed an issue where + Push All Changes displayed changes + that were already committed in the push scope for another device group + after performing a selective commit and selective push to the first + device group. +
+
diff --git a/reference/PAN-OS/addressed/10.2.10-h14.html b/reference/PAN-OS/addressed/10.2.10-h14.html new file mode 100644 index 0000000..cc45235 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.10-h14.html @@ -0,0 +1,509 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-279604
+ 		+
+ Fixed an issue where scheduled SaaS application usage reports were + generated incorrectly, and the login page was displayed instead of the + report content. +
+
+
PAN-276822
+ 		+
+ Fixed an issue where the packet buffer size increased significantly + when WildFire File Forwarding was continued after a threat detection + and then canceled. +
+
+
PAN-276177
+ 		+
+ Fixed an issue where + App Acceleration did not work with + Oracle databases. +
+
+
PAN-274592
+ 		+
+ (Firewalls in HA configurations only) Fixed an + issue where the firewall did not fail over when the active firewall + experienced data plane issues. +
+
+
PAN-273994
+ 		+
+ A fix was made to address + CVE-2025-0111. +
+
+
PAN-273971
+ 		+
+ A fix was made to address + CVE-2025-0108. +
+
+
PAN-273278
+ 		+
+ A fix was made to address + CVE-2025-0109. +
+
+
PAN-273153
+ 		+
+ Fixed an issue where the Panorama web interface was slower than + expected due to excessive polling of the + MonitorDirect.getTasks API by the + Task Manager. +
+
+
PAN-273021
+ 		+
+ Fixed an issue where 25G port links did not come up due to a change in + the handling of 25G DAC modules. +
+
+
PAN-271926
+ 		+
+ Fixed an issue where TLS 1.3 decryption failed with a bad record MAC + error when the firewall was configured to decrypt and inspect TLS + traffic. +
+
+
PAN-271301
+ 		+
+ (VM-Series firewalls on Amazon Web Services (AWS) environments with + GWLB integrated only) Fixed an issue where DNS queries timed out when overlay routing was + enabled. +
+
+
PAN-270549
+ 		+
+ Fixed an issue where some TLS connections were not handled correctly, + which led to instability in the dataplane. +
+
+
PAN-269899
+ 		+
+ Fixed an issue where the Panorama web interface was slower than + expected when querying for device tags. +
+
+
PAN-269731
+ 		+
+ Fixed an issue where Panorama did not display logs from firewalls + after upgrading to PAN-OS 10.2.11 on devices due to Elasticsearch (ES) + getting restarted continuously. +
+
+
PAN-269027
+ 		+
+ Fixed an issue related to external dynamic lists that caused commit + times on the firewall to be higher than expected. +
+
+
PAN-268972
+ 		+
+ Fixed an issue where Panorama was slower than expected when using a + high number of device group tags in a non-shared context. +
+
+
PAN-268501
+ 		+
+ Fixed an issue where the firewall was unable to generate a TSF file + due to a full root partition. +
+
+
PAN-268489
+ 		+
Fixed a Threat log PCAP ID overwrapping issue.
+
+
PAN-268260
+ 		+
+ Fixed an issue on hardware firewalls where, when SSL decryption was + enabled and Client Hello messages spanned multiple TCP segments, some + SSL decrypted sessions failed. +
+
+
PAN-267781
+ 		+
+ Fixed an issue where Panorama did not display the Source Dynamic + Address Group. +
+
+
PAN-267671
+ 		+
+ Fixed an issue where the firewall rebooted unexpectedly due to the + all_task + process restarting and repeated OOM conditions occurring on the + pan_task + process. +
+
+
PAN-265791
+ 		+
+ Fixed an issue where the + all_task + process stopped responding, which caused the dataplane to go down. +
+
+
PAN-265179
+ 		+ Fixed an issue where a kernel race condition caused the firewall to + reboot with a kernel panic. +
+
PAN-262627
+ 		+
+ Fixed an issue where the firewall rebooted into maintenance mode due + to a service failure in the + configd + process. +
+
+
PAN-261739
+ 		+
+ (VM-Series firewalls in Microsoft Azure environments only) Fixed an issue where the firewall displayed 0 for the physical port + counters read from MAC. +
+
+
PAN-261074
+ 		+
+ Fixed an issue where the firewall delayed video file transfers over + SMB when Exclude Video Traffic from + the Tunnel feature was enabled and no applications were added to the + list. +
+
+
PAN-260827
+ 		+
+ Fixed an issue where the firewall consumed excessive CPU while + processing traffic for a workload running on a GKE cluster, which + caused reduced throughput. +
+
+
PAN-260090
+ 		+
+ Fixed an issue where commit all operations failed when the application + openair-psa was used as a keyword + on a remote network instance that was upgraded to PAN-OS 10.2.4-h20. +
+
+
PAN-259727
+ 		+
+ (Panorama appliances in HA configurations only) + Fixed an issue where Panorama became unresponsive and displayed a 504 + gateway timeout error when accessing the web interface or the CLI. +
+
+
PAN-246304
+ 		+
+ Fixed an issue on Panorama where commits failed due to a timeout in + the + sysd + process during decryption. +
+
+
PAN-239952
+ 		+
+ (Firewalls in active/passive HA configurations only) Fixed an issue where HA sync messages from the active firewall took + longer than expected to reach the passive firewall. +
+
+
PAN-222484
+ 		+
+ A fix was made to address + CVE-2024-5920. +
+
diff --git a/reference/PAN-OS/addressed/10.2.10-h17.html b/reference/PAN-OS/addressed/10.2.10-h17.html new file mode 100644 index 0000000..109af5a --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.10-h17.html @@ -0,0 +1,645 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Issue IDDescription
+
PAN-282236
+ 		+ Fixed an issue where large IPv6 packets were reassembled incorrectly on + the firewall when the packets arrived fragmented over an IPv4 tunnel. +
+
PAN-277234
+ 		+
+ Fixed an issue where a device group import resulted in a Security + policy rule being created with + Application set to + none. +
+
+
PAN-277135
+ 		+
+ Fixed an issue where the firewall stopped responding when a DNS client + closed or reset a TCP connection while the firewall was sending a + response. +
+
+
PAN-276607
+ 		+
+ Fixed an issue where GlobalProtect users experienced DNS resolution + timeouts when using Prisma Access. +
+
+
PAN-274570
+ 		+
+ Fixed an issue where the + devsrvr + process restarted after a failed commit due to an invalid memory + access. +
+
+
PAN-273453
+ 		+
+ Fixed an issue where restarting the firewall did not initiate an + autocommit job, which caused the firewall to stop responding and the + HA interface to go down. +
+
+
PAN-272395
+ 		+
+ Fixed an issue where informational logs caused the + distributord + process log file to be frequently overwritten. +
+
+
PAN-271507
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where + the DPC on slot 3 intermittently stopped responding due an + all_pktproc + restart. +
+
+
PAN-271351
+ 		+
+ A fix was made to address + CVE-2025-0116. +
+
+
PAN-271184
+ 		+
+ Fixed an issue where Device Telemetry failed due to an issue with the + encoding of characters in the log file path. +
+
+
PAN-269677
+ 		+
+ Fixed an issue where Panorama did not check for a NULL pointer when + querying logs, which caused logs to not display on the web interface. +
+
+
PAN-269106
+ 		+
+ Fixed an issue where the wifclient stopped responding during server + certificate verification for MICA gRPC connections and caused the + dataplane to restart when using a cloud-based ML detection engine + (MICA). On certain platforms, this caused the firewall to reboot + periodically. +
+
+
PAN-268823
+ 		+
+ Fixed an issue where + Monitor > Log Display did not + display all logs when you applied a filter. +
+
+
PAN-267097
+ 		+
+ Fixed an issue where the replay database size increased significantly + due to local and special configurations not being purged after + commits. +
+
+
PAN-266695
+ 		+
+ Fixed an issue on Panorama where a cyclic nested address group + configuration caused the + configd + process to stop responding after a commit. +
+
+
PAN-266427
+ 		+
+ Fixed an issue on the firewall where, when a high number of SD-WAN + branch sites or interfaces were not connected, SD-WAN processes and + tund + processes stopped responding due to a high probing rate. +
+
+
PAN-265900
+ 		+
+ Fixed an issue where the firewall stopped responding due to a + tund + process or SD-WAN process restart. +
+
+
PAN-264883
+ 		+
+ (PA-7080 appliances with LPCs only) Fixed an + issue where syslog forwarding over TCP stopped after upgrading. +
+
+
PAN-264708
+ 		+
+ Fixed an issue where a selective push was blocked when a configuration + load was done. +
+
+
PAN-264678
+ 		+
+ Fixed an issue where + Preview Changes did not display + configuration changes in + Commit and pushPush Scope. +
+
+
PAN-263369
+ 		+
+ Fixed an issue where commits from Panorama to Panorama virtual + appliances failed with the error message + Internal error during commit processing. Commit/Validate failed + after upgrading Panorama. +
+
+
PAN-262831
+ 		+
+ (PA-5400f Series firewalls only) Fixed an + intermittent issue where the + all_task + process stopped responding, which caused the firewall to restart. +
+
+
PAN-262540
+ 		+
+ Fixed an issue where application traffic transactions that reused TCP + ports did not work with decryption. +
+
+
PAN-261673
+ 		+
+ (VM-Series firewalls on Microsoft Azure environments only) Fixed an issue where, when Accelerated Networking was enabled, + traffic was dropped because of the + flow_parse_ip_hdr counter related + to an Nvidia driver issue. +
+
+
PAN-260218
+ 		+
+ Fixed an issue where BGP Aggregate Advertise filters did not work as + expected when the summary option was enabled, and only summarized + routes were advertised. +
+
+
PAN-259351
+ 		+
+ A fix was made to address + CVE-2024-3393. +
+
+
PAN-257601
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where + Networking Cards (NC) experienced an internal link fault which caused + path monitoring failure on the Dataplane Processing Card (DPC). +
+
+
PAN-256738
+ 		+
+ (VM-Series firewalls in HA configurations only) + Fixed an issue where BGP routes from the active firewall were lost + when the passive firewall was rebooted. +
+
+
PAN-256223
+ 		+
+ Fixed an issue where device telemetry log collection filled the root + partition. +
+
+
PAN-255323
+ 		+
+ (PA-7050 firewalls only) Fixed an issue where + the Network Processing Card (NPC), Data Processing Card (DPC), and Log + forwarding Card (LFC) remained in a starting state after an unexpected + power cycle. +
+
+
PAN-254422
+ 		+
+ Fixed an issue where the firewall required a restart when an SD-WAN + policy rule was pushed from Panorama. +
+
+
PAN-254403
+ 		+
+ Fixed an issue where not all syslog logs were displayed in + MonitorMonitorSystem + when FIPS mode was enabled. +
+
+
PAN-254241
+ 		+
+ Fixed an issue where the firewall stopped responding due to a high + number of SD-WAN probes being sent. +
+
+
PAN-252300
+ 		+
+ Fixed an issue where you were unable to select device groups in the + push scope for user accounts. +
+
+
PAN-249384
+ 		+
+ Fixed an issue on Panorama where configuration locks were observed + during a partial rulebase commit. +
+
+
PAN-249011
+ 		+
+ Fixed an issue where the firewall became unresponsive when committing + a configuration change with a large number of uncommitted changes in + the replay database. +
+
+
PAN-243240
+ 		+
+ Fixed an issue where the using QoS caused packet buffer utilization to + increase exponentially and the + PKI POOL DFLT pool depleted until + a reboot was performed. +
+
+
PAN-242479
+ 		+
+ Fixed an issue where a high number of packets caused high packet + descriptors on the firewall when handling EtherIP traffic. +
+
+
PAN-238286
+ 		+
+ Fixed an issue where FTP control connections were lost after an HA + failover event. +
+
+
PAN-230893
+ 		+
+ Added a CLI command to address an issue where system lock files + blocked authentication. +
+
+
PAN-193285
+ 		+
+ Fixed an issue where the policy optimizer feature did not add entries + back to the + mongodb + database after removing them during an upgrade or downgrade. +
+
diff --git a/reference/PAN-OS/addressed/10.2.10-h18.html b/reference/PAN-OS/addressed/10.2.10-h18.html new file mode 100644 index 0000000..7210d5b --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.10-h18.html @@ -0,0 +1,460 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Issue IDDescription
+
PAN-286255
+ 		+
+ Fixed an issue where, when the firewall received an unexpected + termination request for SSL sessions, the dataplane experienced a slow + buffer resource leak. +
+
+
PAN-283813
+ 		+
+ Fixed an issue on Panorama where the web interface performance was + slower than usual when retrieving read-only configurations from + Panorama. +
+
+
PAN-279400
+ 		+
+ Fixed an issue where, when + Restrict Certificate Extensions was + enabled on decryption profiles, the basic constraints extension was + overwritten incorrectly. +
+
+
PAN-278150
+ 		+
+ Fixed an issue where the firewall removed the Authentication Key + Identifier (AKID) from the certificate during SSL decryption, which + caused Python 3.13 to fail with a certificate verification error. +
+
+
PAN-277417
+ 		+
+ Fixed an memory leak issue related to TLS inbound decryption. +
+
+
PAN-277147
+ 		+
+ Fixed an issue where daily scheduled reports were not generated and + emailed. +
+
+
PAN-276692
+ 		+
+ Fixed an issue where the firewall did not install a Pay-as-you-go + (PAYG) license if the check failed. +
+
+
PAN-276678
+ 		+
+ Fixed an issue where Panorama became unresponsive while performing a + dynamic address update without a lock. +
+
+
PAN-271425
+ 		+
+ (Firewalls in active/active high availability (HA) configurations + only) Fixed an issue with SSL inbound decryption on firewalls on a vwire + setup with asymmetric routing. +
+
+ To use this fix, enter the CLI command + set system setting ssl-decrypt ha-vwire-mac-learn global yes + on both firewalls in an HA pair. +
+
+
PAN-269956
+ 		+
+ Fixed an issue where the + all_pktproc + process stopped responding, which caused internal path monitor + failures. +
+
+
PAN-269700
+ 		+
+ Fixed an issue where commits to service connection firewalls from + Panorama failed. +
+
+
PAN-269499
+ 		+
+ Fixed an issue where the firewall stopped responding when receiving a + high number of logs. +
+
+
PAN-269291
+ 		+
+ Fixed an issue where the scheduled report generation script did not + return debug information. +
+
+
PAN-265646
+ 		+
+ Fixed an issue where the config lock icon was not visible for a custom + role-based admin when a Superuser admin had acquired the config lock. +
+
+
PAN-264169
+ 		+
+ (PA-5400 Series firewalls only) Fixed an issue + where the firewall sent correlated event logs to the syslog server + using the management interface instead of the log interface. +
+
+
PAN-263291
+ 		+
+ Fixed an issue where Microsoft Outlook did not work as expected when + the GlobalProtect clientless VPN was configured. +
+
+
PAN-262946
+ 		+
+ Fixed an issue on the firewall where logging in via the CLI or web + interface did not work due to increased memory usage. +
+
+
PAN-260564
+ 		+
+ Fixed an issue on firewalls in HA configurations where a network loop + was detected by switches after suspending HA on the active firewall. +
+
+
PAN-257432
+ 		+
+ Fixed an issue on Panorama where the + reportd + process stopped responding, which caused a log query issue. +
+
+
PAN-256666
+ 		+
+ Fixed an issue where the + configd + process stopped responding when + Commit and Push operations were + performed on multiple device groups. +
+
+
PAN-256115
+ 		+
+ Fixed an issue where, after replacing a Panorama appliance or log + collector, the secondary Panorama appliance or log collector displayed + a disconnected status for the + inter-log collector connection. +
+
+
PAN-254524
+ 		+
+ Fixed an issue on Panorama where, when the + Commit and Push button was clicked + during a selective + Commit and Push operation, the + window stopped responding, which caused the operation to be delayed. +
+
+
PAN-254174
+ 		+
+ A fix was made to address + CVE-2025-0115. +
+
+
PAN-251929
+ 		+
+ Fixed an issue where inbound decryption did not work when FIPS self + tests were turned on. +
+
+
PAN-244227
+ 		+
+ Fixed an issue where inconsistent FIB entries across the dataplane + were not detected. +
+
+
PAN-241547
+ 		+
+ A fix was made to address + CVE-2023-48795. +
+
+
PAN-238594
+ 		+
+ Fixed an issue where the firewall rebooted when a QSFP28 cable was + removed from the port while the port was passing traffic. +
+
+
PAN-237010
+ 		+
+ Fixed an issue on Panorama where local commits took longer than + expected after an upgrade. +
+
+
PAN-233868
+ 		+
+ Fixed an issue where the firewall took an incorrect action for + overlapping custom and edl-url-categories in a policy rule. +
+
+
PAN-224833
+ 		+
+ Fixed an issue where the firewall dropped DHCPv6 relay packets if + there were duplicate link-local addresses on different sub-interfaces. +
+
+
PAN-214177
+ 		+
+ Fixed an issue where template configurations were not properly pushed + to the firewall during an export or push of the device configuration + bundle. +
+
diff --git a/reference/PAN-OS/addressed/10.2.10-h2.html b/reference/PAN-OS/addressed/10.2.10-h2.html new file mode 100644 index 0000000..6630d27 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.10-h2.html @@ -0,0 +1,114 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-259733
+ 		+
+ Fixed an issue where a custom report was not deleted on Panorama when + expected. +
+
+
PAN-259344
+ 		+
+ Fixed an issue where performing a configuration commit on a firewall + locally or from Panorama caused a memory leak related to the + configd + process and resulted in a out-of-memory (OOM) condition. +
+
+
PAN-258941
+ 		+
+ Fixed an issue where some URLs were not accessible when connected to + Prisma Access explicit proxy. +
+
+
PAN-249266
+ 		+
+ Fixed an issue where the + config + process virtual memory was exceeded due to delays in post-commit + processing. +
+
+
PAN-247099
+ 		+
+ Fixed an issue where the firewall decrypted traffic unexpectedly when + the client hello was spread across multiple packets. +
+
+
PAN-225087
+ 		+
+ Fixed an issue where the dataplane logs were corrupted with unexpected + IPv6 addresses. +
+
diff --git a/reference/PAN-OS/addressed/10.2.10-h21.html b/reference/PAN-OS/addressed/10.2.10-h21.html new file mode 100644 index 0000000..8275f40 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.10-h21.html @@ -0,0 +1,871 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Issue IDDescription
+
PAN-291060
+ 		+
+ Fixed an issue where commits failed due to the configured connected + gateway IPv6 address in the NAT64 policy exceeding the 31 character + limit. +
+
+
PAN-288930
+ 		+
+ Fixed an issue where, when ACE was enabled, traffic from cloud + applications randomly matched an incorrect + cloud-apps policy rule. +
+
+
PAN-286475
+ 		+
+ Fixed an issue where the option to sort sequence numbers was missing + from Filters prefix list in the + advanced routing filters. +
+
+
PAN-284908
+ 		+
+ Fixed an issue where retrieving filenames from OneDrive resulted in a + cache miss. +
+
+
PAN-284552
+ 		+
+ Fixed an intermittent issue where gateway logout events were not + logged when the GlobalProtect client was unable to send a logout + notification, which resulted in the inactivity logout timer not + triggering a gateway logout event. This caused user sessions to remain + active beyond the configured inactivity timeout. +
+
+
PAN-284116
+ 		+
+ Fixed an issue where mTLS decryption bypass did not work when the + decryption profile was configured with the maximum TLS version as TLS + 1.3. +
+
+
PAN-283644
+ 		+
+ (Prisma Access only) Fixed an issue where URL + log ingestion decreased after an upgrade, and secondary connections + were lost. +
+
+
PAN-282640
+ 		+
+ Fixed an issue where custom reports showed incomplete data when + exported in CSV format from Panorama. +
+
+
PAN-280698
+ 		+
+ Fixed an issue where the firewall removed the TCP timestamp from + client hello messages that did not fit in a single packet, which + resulted in connection issues. +
+
+
PAN-280505
+ 		+
+ Fixed an issue where the web interface did not display a message to + commit prior changes before attempting a partial configuration load. +
+
+
PAN-280409
+ 		+
+ Fixed an issue where the popup window did not appear as expected for + Clientless VPN users. +
+
+
PAN-279621
+ 		+
+ Fixed an issue where processes stopped responding when HTTPS Forward + traffic was run. +
+
+
PAN-279495
+ 		+
+ Fixed an issue where accessing a URL from the browser returned the + error message + ERR_RESPONSE_HEADERS_TRUNCATED + when the firewall was configured with TLS 1.3. +
+
+
PAN-279336
+ 		+
+ Fixed an issue where the CLI did not display a message to commit prior + changes before loading a partial configuration. +
+
+
PAN-279176
+ 		+
+ Fixed an issue where the configuration audit displayed inaccurate + information after partially loading the configuration via the CLI, + which caused the audit to flag the configuration as deleted or + changed. +
+
+
PAN-278812
+ 		+
+ Fixed an issue where authentication to GlobalProtect failed with the + error message + User not in allowed list. +
+
+
PAN-277617
+ 		+
+ Fixed an issue where deleting the NTP server address caused a commit + validation error. This occurred when the configuration included both + primary and secondary NTP servers and the secondary server was + removed. +
+
+
PAN-276016
+ 		+
+ Fixed an issue where Prisma Access cap700 instances did not insert + HTTP headers when accessing certain Google domains if the 32 byte pool + size was low. +
+
+
PAN-273949
+ 		+
+ Fixed an issue where the firewall generated the following error + message in the + snmpd + logs: pan_get_keystr_from_cryptod +
+
+ (pan_snmpinterface.c:181): Key X2F1dGhfa2V5 import from cryptod + failed. +
+
+
PAN-272539
+ 		+
+ (Panorama appliances on Microsoft Azure environments only) Fixed an issue where user to IP address mapping was missing for + some users connected to specific Prisma Access gateways, which caused + the collection layer Azure firewall to not form the mapping. +
+
+
PAN-271432
+ 		+
+ Fixed an issue where the firewall was unable to decrypt SSL traffic + when using forward proxy and HSM with an ECDSA signing certificate. +
+
+
PAN-270849
+ 		+
+ Fixed a memory leak issue related to the + configd + process that occurred when running consecutive commits for multiple + days. +
+
+
PAN-269624
+ 		+
+ Fixed an issue where GlobalProtect clients failed to connect with the + error message + The device or feature requires a GlobalProtect subscription + license. +
+
+
PAN-268909
+ 		+
+ Fixed an issue where IP address tags were removed from firewalls after + a management server or + useridd + process restart. This occurred when a Panorama serial-number based + configuration was used for User-ID redistribution. +
+
+
PAN-268708
+ 		+
+ Fixed an issue where PDF summary and email reports displayed IPv6 + addresses instead of IPv4 addresses. +
+
+
PAN-268614
+ 		+
+ Fixed an issue on the web interface where, when all rules were + highlighted when a read-only admin user clicked the + Highlight Unused Rules checkbox. +
+
+
PAN-268017
+ 		+
+ Fixed an issue where the IP address-to-user mapping timeout was + triggered and the Inactivity TTL was refreshed unexpectedly +
+
+
PAN-265782
+ 		+
+ Fixed an issue on Panorama where, after you enabled multihop in a BFD + profile, you were unable to disable it via the web interface. +
+
+
PAN-264883
+ 		+
+ (PA-7080 appliances with LPCs only) Fixed an + issue where syslog forwarding over TCP stopped after upgrading. +
+
+
PAN-260796
+ 		+
+ Fixed an issue where servers were not accessible through an active SSL + GlobalProtect VPN tunnel until a new connection was established or the + session was cleared on the firewall. +
+
+
PAN-260132
+ 		+
+ Fixed an issue where secondary IP addresses with a /32 prefix + configured on Layer 3 interfaces were not reachable in FRR mode. +
+
+
PAN-259759
+ 		+
+ A fix was made to address + CVE-2025-0125. +
+
+
PAN-257624
+ 		+
+ Fixed an issue where the firewall web interface was blank after + logging in. +
+
+
PAN-257117
+ 		+
+ Fixed an issue where CSV or PDF exports of zones did not contain all + zones. +
+
+
PAN-255759
+ 		+
+ Fixed an issue where the firewall was unable to match HIP data with + the correct anti-malware object for Windows Defender. +
+
+
PAN-255252
+ 		+
+ Fixed an issue where Panorama administrators with the type Dynamic + were unable to create, modify, or delete BGP Dampening profiles. +
+
+
PAN-253829
+ 		+
+ Fixed an issue where the CLI command + show running security-policy timed + out when the Security policy was large. +
+
+
PAN-253584
+ 		+
+ Fixed an issue where + ikemgr + process unexpectedly stopped due to a memory mapping in an incorrect + location. +
+
+
PAN-252974
+ 		+
+ (PA-450 firewalls only) Fixed an issue where + specific routes were not advertised when BGP Aggregate was configured + with the advertise filter. +
+
+
PAN-252270
+ 		+
+ Fixed an issue on the firewall where changes were incorrectly applied + after a reboot or a restart of the + configd + process. +
+
+
PAN-249581
+ 		+
+ Fixed an issue where stale BGP routes were advertised to peers even + when they were not present in the local RIB table. +
+
+
PAN-248975
+ 		+
+ Fixed an issue on the Panorama web interface where no content was + displayed after logging in. +
+
+
PAN-243333
+ 		+
+ Fixed an issue where selective push operations failed with the + following error message: + SelPush:Base config is invalid! invalid configuration. Schema + verification failed. This occurred when a policy rule was moved from the post-rule base + to the pre-rule base. +
+
+
PAN-241230
+ 		+
+ Fixed an issue where the SNMP get request status value for Panorama + connections was incorrect. +
+
+
PAN-240001
+ 		+
+ Fixed an issue where the + pan_task + process restarted due to + configd + and + devsrvr + process memory requirements. +
+
+
PAN-239256
+ 		+
+ Fixed an issue where ARP entries were unable to be completed for + subinterfaces with SNAT configured. +
+
+
PAN-238610
+ 		+
+ Fixed an issue with the Panorama Virtual Appliance where, after the + mgmtsrvr + restarted on the passive appliance, stale IP address tags were pushed + to the connected firewalls with the message + clear all registered ip addresses. +
+
+
PAN-237582
+ 		+
+ Fixed an issue where logs were intermittently missing on the log + collector due to missing aliases for some indices. +
+
+
PAN-237475
+ 		+
+ Fixed an issue where the firewall stopped responding when FIPS mode + was enabled. +
+
+
PAN-232530
+ 		+
+ Fixed an issue where the + useridd + process ran out of memory and restarted when the number of user or + user groups exceeded the threshold. +
+
+
PAN-230330
+ 		+
+ (PA-220 firewalls only) Fixed an issue where + disk space usage was significantly higher than expected after + upgrading. +
+
+
PAN-224729
+ 		+
+ Fixed an issue where you were unable to create duplicate entries in + Advanced Routing AS path prepend in the BGP filter route map. +
+
+
PAN-224195
+ 		+
+ Fixed an issue where Captive Portal redirects failed with a 500 + Internal error when the captive portal token was disabled. +
+
+
PAN-222579
+ 		+
+ Fixed an issue where the + useridd + and + distd + process restarted, which resulted in missing mappings. +
+
+
PAN-221571
+ 		+
+ Fixed an issue on the web interface where the Security policy rule hit + count remained at 0 for some rules even though the traffic logs showed + live hits. +
+
+
PAN-212182
+ 		+
+ Fixed an issue where TLS 1.3 connections failed if the server sent a + certificate request after sending its certificate. +
+
diff --git a/reference/PAN-OS/addressed/10.2.10-h27.html b/reference/PAN-OS/addressed/10.2.10-h27.html new file mode 100644 index 0000000..b9d2b30 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.10-h27.html @@ -0,0 +1,624 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Issue IDDescription
+
PAN-297261
+ 		+
+ Fixed an issue where the proxy-protocol debug level was set to + verbose on Prisma Access + instances, even when it was not explicitly configured, which caused + excessive logging by the + pan_task + process. +
+
+
PAN-296519
+ 		+
+ Fixed an issue where a stream receiving a reconnect signal with an + associated error in + Wifclient + caused the entire pool to close, which resulted in a complete + disconnection. +
+
+
PAN-296478
+ 		+
+ Fixed an issue where, after upgrading to PAN-OS 10.2.13-h10, + GlobalProtect Clientless VPN on PA-3250 firewalls failed to execute + JavaScript links, resulting in an authorization error. This occurred + because the firewall was incorrectly injecting text into URLs when + JavaScript buttons or dropdown menus were clicked within the + Clientless VPN portal. +
+
+
PAN-295812
+ 		+
+ Fixed an issue where the throughput data on the Switch Card Module + (SCM) was not accurately reported. This issue affected Standard SC + USABN and USABN-2 when using Direct-IO deployment. +
+
+
PAN-291635
+ 		+
+ Fixed an issue where cookie surrogate cache entries remained + unresolved after an + idmgr + process reset due to the request not being retransmitted. This + occurred because the timestamp in the cache entry was refreshed even + when the UID was 0, which prevented the retransmission of the request + if the initial response was not received. +
+
+
PAN-290088
+ 		+
+ Fixed an issue where a memory leak occurred related to the + configd + process when pushing configurations from Panorama to a firewall. This + occurred when the configurations contained shared policy rules. +
+
+
PAN-289239
+ 		+
+ Fixed an issue on Panorama where a new virtual system (vsys) was + automatically created with the name of a device group. +
+
+
PAN-287818
+ 		+
+ Fixed an issue where sessions timed out sooner than expected due to + the pan_proxy_accumulation + _restore_timeout not initiating + when the accumulationsession_init + failed. +
+
+
PAN-287023
+ 		+
+ Fixed an issue where a large number of logs caused the + logrcvr + process to stop responding. +
+
+
PAN-287002
+ 		+
+ A fix was made to address + CVE-2025-0133. +
+
+
PAN-286296
+ 		+
+ Fixed an issue where the Prisma Access gateway experienced process + restarts and system reboots. +
+
+
PAN-285298
+ 		+
+ Fixed an issue where the firewall became unresponsive when the + show user user- ids user all CLI + command was executed repeatedly on large scale LDAP group mappings, + and you were unable to connect to the gateways with the error message + The network connection is unreachable or the gateway is + unresponsive. Check the network connection and reconnect. +
+
+
PAN-284066
+ 		+
+ Fixed an issue where, after an upgrade, the SNMP polled values for + IF-MIB::ifInErrors displayed a + high number of errors that did not match the values in the CLI show + interface command. +
+
+
PAN-284003
+ 		+
+ Fixed an issue where clients did not receive a valid response when + searching a website due to a compression error. +
+
+
PAN-279901
+ 		+
+ An issue was fixed where the firewall dropped fragmented TLS + ClientHello packets, which blocked access to certain websites. This + occurred because the packets arrived truncated, in varying sizes and + orders, and the firewall's heuristics failed to handle them correctly. +
+
+ To enable this fix, run: + debug dataplane set ssl-decrypt accumulate-client-hello disjoined + yes +
+
+
PAN-279500
+ 		+
+ Fixed an issue where TLS connections failed to establish in asymmetric + routing environments if the firewall did not see server-to-client + (s2c) packets of the TLS handshake. +
+
+ To use this fix, run the following CLI command: + debug dataplane set ssl-decrypt accumulate-client-hello + asym-disable yes. +
+
+
PAN-279191
+ 		+
+ Fixed an issue where a GlobalProtect gateway stopped responding when + handling HTTP/1.1 traffic with web inspection enabled. +
+
+
PAN-276795
+ 		+
+ Fixed an issue where the GlobalProtect client displayed an error + message when you clicked + Check Now and + Preferred Releases and + Base Releases were unchecked (Device > Software). +
+
+
PAN-274797
+ 		+
+ Fixed an issue where a DPC on slot 3 failed intermittently due to the + pktlog_forwarding process restarting, which resulted in an unexpected HA failover. +
+
+
PAN-273597
+ 		+
+ Fixed an issue where logs in the cloud database displayed in the + Not-Resolved category but not in the + local database. +
+
+
PAN-271701
+ 		+
+ Fixed an issue where Advanced Services, App-ID Cloud Engine (ACE), and + Enhanced Application Log stopped working due to incorrect memory usage + accounting, which caused memory usage to remain at 99% after an + extended period of time. +
+
+
PAN-271215
+ 		+
+ A fix was made to address + CVE-2025-4230. +
+
+
PAN-266653
+ 		+
+ Fixed an issue where unexpected path monitor failures caused the + firewall to stop responding. +
+
+
PAN-264725
+ 		+
+ Fixed an issue where Auto Quarantine did not work when simplified + logging was enabled. +
+
+
PAN-263559
+ 		+
+ Fixed an issue where the dataplane stopped responding and the firewall + unexpectedly rebooted due to multiple process restarts. +
+
+
PAN-261825
+ 		+
+ Fixed an issue where traffic was dropped when Data Loss Prevention or + Advanced URL Filtering were enabled. This occurred when the payload + size was greater than 3.5 KB. +
+
+
PAN-259741
+ 		+
+ Fixed an issue where the firewall dropped GRE keepalive packets that + were encapsulated under another GRE tunnel. +
+
+
PAN-259076
+ 		+
+ Fixed an issue where the firewall displayed an OCSP/CRL check failure + when accessing websites. +
+
+
PAN-252706
+ 		+
+ Fixed an issue where the URL filtering response page for + Continue and + Override did not work with IPv6 + Router Advertisement (RA) or Multicast Listener Query (MLQ) for + IPv6-to-IPv6 and IPv6- to-IPv4 traffic. +
+
+
PAN-251241
+ 		+
+ Fixed an issue that blocked auto-discovery of the ICD Cloud server for + the configured Enforcer URL. +
+
+
PAN-250146
+ 		+
+ Fixed an issue on the web interface where templates incorrectly showed + that telemetry was enabled when it was not enabled. With this fix, the + telemetry setting is not displayed in the template on the web + interface. +
+
+
PAN-248740
+ 		+
+ (PA-4000 and PA-5000 Series firewalls) Fixed an + issue where, when SSL decryption was enabled, you were unable to + interact with the login button on some websites due to a content + length mismatch error. This occurred because the firewall incorrectly + flagged the final packet in the replay as send + original when it contained only a + gzip end marker and no data. +
+
+
PAN-247575
+ 		+
+ Fixed an issue where the error message import of <issuecert> failed. Please check the validity of the + key pair and try again + for unmatched keys for EC certificates. +
+
+
PAN-242602
+ 		+
+ Fixed an issue where GlobalProtect clients experienced slow SMB-V3 + download throughput when passing through a Prisma IPSec tunnel and the + firewall and the SMB-V3 session owner dataplane was the same as the + IPSec-ESP tunnel on the multi-dataplane firewall. +
+
+
PAN-241536
+ 		+
+ Fixed an issue on Panorama where admin users with the Custom Panorama + Admin role were unable to add, edit, or delete route filters under + Routing Profiles. +
+
+
PAN-231386
+ 		+
+ Fixed an issue where the + configd process stopped responding + during certificate verification. +
+
+
PAN-211910
+ 		+
+ Fixed an issue where the + dnsproxyd process stopped responding + during stability tests. +
+
+
PAN-202905
+ 		+
+ Fixed an issue on the firewall web interface where the + Next Hop value was not displayed in + the static route configuration, the + admin-dist values were empty, and + the path-monitor parameters were not listed in the management server + web interface when the firewall was configured in FRR mode. +
+
diff --git a/reference/PAN-OS/addressed/10.2.10-h3.html b/reference/PAN-OS/addressed/10.2.10-h3.html new file mode 100644 index 0000000..c7750e3 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.10-h3.html @@ -0,0 +1,196 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-259997
+ 		+
+ (PA-3410, PA-3420, and PA-3430 firewalls only) + Fixed an issue where the install failed when upgrading from PAN-OS + 10.2.3-h3 and later 10.2 releases to PAN-OS 10.2.10 due to the number + of configured vsys zones exceeding the zone limit in PAN-OS 10.2.10. +
+
+
PAN-259480
+ 		+
+ Fixed an issue where the + varrcvr + process stopped responding after running out of memory due to how the + process queued and dequeued files for WildFire file forwarding when a + WildFire Analysis Security profile was enabled. +
+
+
PAN-257462
+ 		+
+ Fixed an issue related to the + varrcvr + process where the management plane CPU was higher than expected during + WildFire updates. +
+
+
PAN-256939
+ 		+
+ Fixed an issue on the firewall where disk space was low in + /opt/pancfg/, which caused dynamic content installation to fail. +
+
+
PAN-254373
+ 		+
+ Fixed an issue where the firewall did not handle error code 500 + responses from the WildFire cloud correctly. +
+
+
PAN-253400
+ 		+
+ Fixed an issue where the + logrcvr + process stopped responding. +
+
+
PAN-249814
+ 		+
+ Fixed an issue where multiple + all_task + processes stopped responding, which caused the dataplane to fail. +
+
+
PAN-244746
+ 		+
+ Fixed an issue where changes committed on Panorama were not reflected + on the firewall after a successful push. +
+
+
PAN-235840
+ 		+
+ Fixed an issue where, after a configuration push from Panorama to + managed firewalls, the status displayed as + None and the push took longer than + expected. +
+
+
PAN-234560
+ 		+
+ Fixed an issue where the daily summary report displayed IPv6 addresses + instead of IPv4 addresses. +
+
diff --git a/reference/PAN-OS/addressed/10.2.10-h4.html b/reference/PAN-OS/addressed/10.2.10-h4.html new file mode 100644 index 0000000..72e13c0 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.10-h4.html @@ -0,0 +1,327 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-263226
+ 		+
+ Fixed an issue where decryption based traffic failed on Explicit Proxy + nodes. +
+
+
PAN-263164
+ 		+
+ Fixes a problem where Netflow User ID information was truncated to 31 + characters. +
+
+
PAN-262287
+ 		+
+ Fixed an issue where dereferencing a NULL pointer that occurs might + cause + pan_task + processes to crash. +
+
+
PAN-261917
+ 		+
+ Fixed an issue where websites with a no-decrypt policy rule were + decrypted in traffic log when using a Google Chrome browser with PQC + enabled +
+
+
PAN-261797
+ 		+
+ (Firewalls and Panorama appliances in FIPS-CC mode only) Fixed an issue where the + authd + process restarted if RADIUS PAP/CHAP authentication was used. +
+
+
PAN-261270
+ 		+
+ Fixed an issue where the firewall decremented the TTL/Hop limit for + BGPv6 packets by 1 after IPSec decryption. +
+
+
PAN-260662
+ 		+
+ Fixed an issue where large file downloads were slower than expected + when private IP address visibility was enabled. +
+
+
PAN-258442
+ 		+
+ Fixed an issue where changes made to the split tunnel configuration on + the Prisma Access gateway were not reflected on the GlobalProtect + client. +
+
+
PAN-257957
+ 		+
+ (Firewalls and Panorama appliances in FIPS-CC mode only) Fixed an issue where the + authd + process restarted if RADIUS PAP/CHAP authentication was used. +
+
+
PAN-257563
+ 		+
+ Fixed an issue where the + logrcvr component for SASE and + MCW displayed incorrect zones in the traffic flow. +
+
+
PAN-256223
+ 		+
+ Fixed an issue where device telemetry log collection filled the root + partition. +
+
+
PAN-255619
+ 		+
+ Fixed an intermittent issue where file downloads from websites failed. +
+
+
PAN-254826
+ 		+
+ Fixed an issue where the firewall stopped responding when processing + traffic. +
+
+
PAN-254671
+ 		+
+ Fixed an issue where excessive + Timed out while getting config lock + error messages were generated when making bulk changes via XML API. +
+
+
PAN-250371
+ 		+
+ Fixed an issue where the + logrcvr + process stopped responding, which caused commits to fail with the + error message + Management server failed to send phase 1 to client logrcvr. +
+
+
PAN-247257
+ 		+
+ Fixed an issue where the + useridd + process stopped responding, which caused the firewall to reboot. +
+
+
PAN-242958
+ 		+
+ Fixed an issue where the firewall intermittently logged + connect-agent-failure messages + for service connection instances due to bi-directional host ID + redistribution. +
+
+
PAN-242331
+ 		+
+ Fixed an issue where Prisma Access remote network firewalls + intermittently created incorrect user-to-IP-address mappings. +
+
+
PAN-240990
+ 		+
+ Fixed an issue where + l3svc.py displayed incorrect logs. +
+
+
PAN-218873
+ 		+
+ Fixed an issue where a HIP mask was reused when an existing IP address + user mapping was updated by a new IP address user mapping that had a + different username but the same IP address. +
+
diff --git a/reference/PAN-OS/addressed/10.2.10-h40.html b/reference/PAN-OS/addressed/10.2.10-h40.html new file mode 100644 index 0000000..7e9053c --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.10-h40.html @@ -0,0 +1,70 @@ + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
—
+ 		+
+ Fixes were made to address the following CVEs: + +
+
PAN-320598
 +
+ Fixed an issue where internal and external DNS names did not resolve + when connected to a GlobalProtect gateway. +
+
diff --git a/reference/PAN-OS/addressed/10.2.10-h5.html b/reference/PAN-OS/addressed/10.2.10-h5.html new file mode 100644 index 0000000..321c409 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.10-h5.html @@ -0,0 +1,78 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Issue IDDescription
+
PAN-256077
+ 		+
+ Fixed an issue where the GlobalProtect client would disconnect + consistently due to keep-alive timeouts when using an SSL-only tunnel. +
+
+
PAN-241044
+ 		+
+ Fixed an issue where traffic was denied by the interzone-default + policy rule when a Security policy rule with an FQDN destination was + configured. +
+
+
PAN-222590
+ 		+
+ Fixed an issue where a semicolon appeared at the end of file names of + data filtering logs. +
+
+
PAN-217198
+ 		+
+ Fixed an issue where Security policy rules did not display values for + FQDN. +
+
+
PAN-203231
+ 		+
+ Fixed an issue where + Software Version in the device + summary report exported from Panorama included HTML tags. +
+
diff --git a/reference/PAN-OS/addressed/10.2.10-h7.html b/reference/PAN-OS/addressed/10.2.10-h7.html new file mode 100644 index 0000000..6f9c0b2 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.10-h7.html @@ -0,0 +1,372 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Issue IDDescription
+
PAN-267662
+ 		+
+ Fixed an issue where the firewall experienced a memory out-of-bounds + access when the firewall was configured with SD-WAN and the SD-WAN + plugin was loading, which caused the firewall to stop responding and + drop VPN tunnels. +
+
+
PAN-266769
+ 		+
+ Fixed an issue where the GlobalProtect gateway did not handle IP + address changes of the inner gateway when the NGPA new protocol + enabled. +
+
+
PAN-265742
+ 		+
+ Fixed an issue on the Panorama web interface where the + OK button on the GlobalProtect + gateway configuration dialog box was not clickable. +
+
+
PAN-265462
+ 		+
+ Fixed an issue where you were unable to download PDFs when connected + via Clientless VPN. +
+
+
PAN-264871
+ 		+
+ Fixed an issue on Panorama where the + configd + process stopped responding when viewing IP addresses on dynamic + address groups with a large number of IP addresses. +
+
+
PAN-264246
+ 		+
+ Fixed an issue where the Authentication Portal did not work properly + with session cookies when the request to the portal contained the + header Sec-Fetch-Site=cross-site. +
+
+
PAN-263680
+ 		+
+ Fixed an issue where Prisma Access gateways consistently stopped + responding with process restarts. +
+
+
PAN-262340
+ 		+
+ Fixed an issue where FQDN resolution failed for address objects, and + all FQDN traffic was denied by the interzone-default policy rule. +
+
+
PAN-261484
+ 		+
+ Fixed an issue on the firewall where DPDK allocated twice the amount + of memory as requested for pre-allocation. +
+
+
PAN-260928
+ 		+
+ Fixed an issue where GlobalProtect failed to connect connect when + using LDAP authentication with machine certificates with the error + message + You are not authorized to connect to GlobalProtect portal. +
+
+
PAN-260512
+ 		+
+ Fixed an issue where accessing the IP address of the device address + group objects from the user interface caused the + configd + process to stop responding. +
+
+
PAN-259002
+ 		+
+ Fixed an issue where frequent external dynamic list updates caused the + configd + process to restart. +
+
+
PAN-257736
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where + traffic to benign applications was was impacted by holding TCP + sequential segments for MLC inspection and not releasing the full + chain after a benign verdict was received. +
+
+
PAN-256077
+ 		+
+ Fixed an issue where the GlobalProtect client would disconnect + consistently due to keep-alive timeouts when using an SSL-only tunnel. +
+
+
PAN-255619
+ 		+
+ Fixed an intermittent issue where file downloads from websites failed. +
+
+
PAN-255509
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where + BFD sessions flapped intermittently. +
+
+
PAN-250787
+ 		+
+ Fixed an issue where network issues between the firewall and the log + collector caused + logrcvr + process memory exhaustion. +
+
+
PAN-250394
+ 		+
+ Fixed an issue where a large amount of group data caused serialization + errors and prevented synchronization. +
+
+
PAN-241044
+ 		+
+ Fixed an issue where traffic was denied by the interzone-default + policy rule when a Security policy rule with an FQDN destination was + configured. +
+
+
PAN-233681
+ 		+
+ Fixed an issue where the + authd + process on Prisma Access firewalls stopped responding after receiving + the SIGUSR1 signal. +
+
+
PAN-226361
+ 		+
+ Fixed an issue where sessions might end unexpectedly with the error + resources-unavailable when the + firewall incorrectly interprets the Content and Threat Detection (CTD) + global packet queue as being full. +
+
+
PAN-222590
+ 		+
+ Fixed an issue where a semicolon appeared at the end of file names of + data filtering logs. +
+
+
PAN-217198
+ 		+
+ Fixed an issue where Security policy rules did not display values for + FQDN. +
+
+
PAN-203231
+ 		+
+ Fixed an issue where + Software Version in the device + summary report exported from Panorama included HTML tags. +
+
diff --git a/reference/PAN-OS/addressed/10.2.10-h9.html b/reference/PAN-OS/addressed/10.2.10-h9.html new file mode 100644 index 0000000..17c045f --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.10-h9.html @@ -0,0 +1,204 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-272809
+ 		+
+ A fix was made to address + CVE-2024-0012 + (PAN-SA-2024-0015) and + CVE-2024-9474. +
+
+
PAN-268314
+ 		+
+ Fixed an issue where new files were not sent to WildFire. With this + fix, the WildFire reserved drive space has been increased for greater + session caching capability. +
+
+
PAN-267535
+ 		+
+ Fixed an issue where + all_task + processes stopped responding on the remote network firewall, which + caused tunnels to go down and the + pan_task + CPU usage to approach 100%. +
+
+
PAN-265778
+ 		+
+ Fixed an issue where the GlobalProtect client failed to connect after + an upgrade due to the group names not being retrieved on time. +
+
+
PAN-265399
+ 		+
+ Fixed an issue where DNS queries for uppercase internal domain (SRV + record) timed out when DNS Security was enabled. +
+
+
PAN-255915
+ 		+
+ Fixed an issue where a memory leak in the + sslmgr + process caused the firewall to restart. +
+
+
PAN-240251
+ 		+
+ Fixed an issue where the + vldmgr + process incorrectly restarted during an Elasticsearch restart. +
+
+
PAN-232368
+ 		+
+ Fixed an issue where commits failed with the error message + Error: Max. user groups used in policy 1389 exceed capacity + (1000). +
+
+
PAN-218279
+ 		+
+ Fixed an issue on Panorama where hostname variables displayed as + unknown when exporting template or + template stack variables in CSV format. +
+
diff --git a/reference/PAN-OS/addressed/10.2.10.html b/reference/PAN-OS/addressed/10.2.10.html new file mode 100644 index 0000000..67b065e --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.10.html @@ -0,0 +1,742 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-257197
+ 		+
+ Fixed an issue where ifType and + ifSpeed were not populated in + asynchronous mode of SNMP operations. +
+
+
PAN-256181
+ 		+
+ Fixed an issue where the management interface and front panel port + interface statistics were not populated in asynchronous mode of SNMP + operations. +
+
+
PAN-255868
+ 		+
+ (PA-3400 Series firewalls only) Fixed an issue + where the firewall entered maintenance mode after enabling kernel data + collection during the silent reboot. +
+
+
PAN-255396
+ 		+
+ Fixed an issue where, when using serial number and IP address + authentication, and multiple gateways were configured, the portal + returned the last gateway in the list and disregarded the satellite + assignment by serial number. +
+
+
PAN-253546
+ 		+
+ Fixed an issue where a TLS client hello was split into multiple + packets and arrived out of order, so the packets were dropped and the + session terminated. +
+
+
PAN-253317
+ 		+
+ (VM-Series firewalls on Microsoft Azure environments only) Fixed an issue where you were unable to log in to the firewall + after a private data reset. +
+
+
PAN-252730
+ 		+
+ Fixed an issue where the Elasticsearch status for a log collector + group changed to red or yellow after performing a collector group + push. +
+
+
PAN-252517
+ 		+
+ Fixed an issue where SNMP failed to respond to multiple Object + Identifier (OID) queries in a single SNMP GET request. +
+
+
PAN-251895
+ 		+
+ Fixed an issue where enabling inline Cloud Analysis features caused a + slow packet buffer leak, which resulted in performance issues and + dropped traffic. +
+
+
PAN-251639
+ 		+
+ Fixed an issue where an out of memory condition might occur due to a + memory leak in the + varrcvr + process when a Wildfire Analysis security profile is enabled. +
+
+
PAN-251563
+ 		+
+ Added CPLD enhancement to capture external power issues. +
+
+
PAN-251013
+ 		+
+ Fixed an issue on the web interface where the + Virtual Router and + Virtual System configurations for + the template incorrectly showed as + none. +
+
+
PAN-250083
+ 		+
+ Fixed an issue on firewalls in HA configurations where packets were + dropped over HA3 HSCI due to the default MRU being incorrect. +
+
+
PAN-250020
+ 		+
+ Fixed an issue where MLC2 verdict retrieval failed due to a regression + in loopback data flag handling. +
+
+
PAN-248130
+ 		+
+ Fixed an issue where the + AND operation under a Dynamic + Address Group comparison did not work after upgrading the AWS plugin + to 3.0.1. +
+
+
PAN-248105
+ 		+
+ Fixed an issue where the GlobalProtect SSL VPN tunnel immediately + disconnected due to a keep-alive timeout. +
+
+
PAN-246976
+ 		+
+ Fixed an issue with unbalanced NAT session distribution with + multidataplane firewalls when persistent-dipp was enabled. +
+
+
PAN-246960
+ 		+
+ Fixed an issue where firewalls failed to fetch content updates from + the WildFire private cloud due to an + Unsupported protocol error. +
+
+
PAN-245850
+ 		+
+ Fixed an issue on Panorama appliances in active/passive HA + configurations where the firewalls entered an HA out-of-sync status + and jobs failed on the passive appliance with the error message + Could not merged running config from file. +
+
+
PAN-245842
+ 		+
+ Fixed an issue with the syn-cookie option where traffic unexpectedly + stopped during packet exchange. +
+
+
PAN-245690
+ 		+
+ Fixed an issue where the managed collectors health status on Panorama + displayed as empty. +
+
+
PAN-245125
+ 		+
+ (VM-Series firewalls in Microsoft Azure environments only) Fixed an issue where file descriptors were not closed due to + invalid configurations. +
+
+
PAN-244907
+ 		+
+ Fixed an issue where ports did not go down when moving from an active + state to a suspended state. +
+
+
PAN-244746
+ 		+
+ Fixed an issue where changes committed on Panorama were not reflected + on the firewall after a successful push. +
+
+
PAN-244648
+ 		+
+ (PA-5200 Series only) Fixed an issue where the + firewall did not boot up after a factory reset, and, with FIPS mode + enabled, the firewall rebooted into maintenance mode. +
+
+
PAN-244622
+ 		+
+ Fixed an issue where FIB repush did not work with Advanced Routing + enabled. +
+
+
PAN-244013
+ 		+
+ Fixed an issue where the web interface did not display newly added + antispyware signatures or Vulnerability signatures. +
+
+
PAN-243240
+ 		+
+ Fixed an issue where the using QoS caused packet buffer utilization to + increase exponentially and the + PKI POOL DFLT pool depleted until + a reboot was performed. +
+
+
PAN-242893
+ 		+
+ Fixed an issue where the verdict for www.googleapis.com displayed the + message not-resolved. +
+
+
PAN-242309
+ 		+
+ Fixed an issue where a higher byte count (s2c) was observed for + DNS-Base application. +
+
+
PAN-241230
+ 		+
+ Fixed an issue where the SNMP get request status value for Panorama + connections was incorrect. +
+
+
PAN-241192
+ 		+
+ Fixed an issue where HIP reports did not match HIP objects configured + with certificate check. +
+
+
PAN-240786
+ 		+
+ Fixed an issue on firewalls in HA configurations where VXLAN sessions + were allocated, but not installed or freed, which resulted in a + constant high session table usage that was not synced between the + firewalls. This resulted in a session count mismatch. +
+
+
PAN-240612
+ 		+
Fixed a kernel panic caused by a third-party issue
+
+
PAN-240368
+ 		+
+ Fixed an issue where Authentication Portal redirection for HTTPS + websites did not work when + Enhanced Handling of SSL/TLS Handshakes for Decrypted Traffic + was enabled. +
+
+
PAN-240347
+ 		+
+ Fixed an issue with the web interface where the + Dashboard and a + Device Group policy rule took longer + than expected to load. +
+
+
PAN-240225
+ 		+
+ Fixed an issue where authentication failed on web-based GlobalProtect + portal. +
+
+
PAN-239662
+ 		+
+ Fixed an issue where the NSSA default route from the firewall was not + generated to advertise even though the backbone area default route was + advertised during a graceful restart. +
+
+
PAN-239354
+ 		+
+ Fixed an issue where DNS resolution was delayed when an antispyware + policy rule was applied to both client to firewall and firewall to + internal DNS server legs of a connection. +
+
+
PAN-238625
+ 		+
+ Fixed an issue where, when the physical interface went down, the + SD-WAN Ethernet connection state still showed + UP/path-monitor due to the Active + URL SaaS monitor connection state remaining UP/path-monitor. +
+
+
PAN-237608
+ 		+
+ Fixed an issue where a NetFlow export truncated the source username. +
+
+
PAN-236133
+ 		+
+ Fixed an issue where SSL traffic was impacted when + SSL Command and Control detector for + Incline Cloud Analysis was set to + reset-both, + reset-client, + reset-server, or + drop. +
+
+
PAN-232550
+ 		+
+ Fixed an issue where SNMPv3 authentication failed when using SHA-512 + Auth protocol. +
+
+
PAN-231642
+ 		+
+ Fixed an issue on the Panorama web interface where users who were + logged in through multiple sessions were able to see an active lock on + only one session. +
+
+
PAN-229115
+ 		+
+ Fixed an issue on the web interface where the screen was blank after + logging in to Panorama. +
+
+
PAN-226108
+ 		+
+ Fixed an issue where the + masterd + process was unable to start or stop the + sysd + process. +
+
+
PAN-225394
+ 		+
+ Fixed an issue on the firewall where SNMP incorrectly reported high + packet descriptor usage. +
+
+
PAN-223914
+ 		+
+ Fixed an issue on Panorama where the + reportd + process unexpectedly stopped responding. +
+
+
PAN-223418
+ 		+
+ Fixed an issue where heartbeats to the + brdagent + process were lost, resulting in the process not responding, which + caused the firewall to reboot. +
+
+
PAN-221041
+ 		+
+ Fixed an issue where the following error message was seen frequently + in the system logs: + Clearing snmpd.log due to log overflow. +
+
+
PAN-216941
+ 		+
+ (Panorama appliances in Log Collector mode only) Fixed an issue where Panorama stopped processing and saving logs. +
+
+
PAN-164885
+ 		+
+ Fixed an issue on Panorama where + Commit and Push or + Push to Devices operations failed + when an external dynamic list was configured to check for updates + every 5 minutes due to the commit and external dynamic fetch processes + overlapping. +
+
diff --git a/reference/PAN-OS/addressed/10.2.11-h1.html b/reference/PAN-OS/addressed/10.2.11-h1.html new file mode 100644 index 0000000..3f4b7c3 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.11-h1.html @@ -0,0 +1,69 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-263226
+ 		+
+ Fixed an issue where decryption based traffic failed on Explicit Proxy + nodes. +
+
+
PAN-261917
+ 		+
+ Fixed an issue where websites with a no-decrypt policy rule were + decrypted in traffic log when using a Google Chrome browser with PQC + enabled. +
+
+
PAN-257957
+ 		+
+ (Firewalls and Panorama appliances in FIPS-CC mode only) Fixed an issue where the + authd + process restarted if RADIUS PAP/CHAP authentication was used. +
+
diff --git a/reference/PAN-OS/addressed/10.2.11-h10.html b/reference/PAN-OS/addressed/10.2.11-h10.html new file mode 100644 index 0000000..0b0f4b5 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.11-h10.html @@ -0,0 +1,41 @@ + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-259351
+ 		+
+ A fix was made to address + CVE-2024-3393. +
+
diff --git a/reference/PAN-OS/addressed/10.2.11-h12.html b/reference/PAN-OS/addressed/10.2.11-h12.html new file mode 100644 index 0000000..17c52ca --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.11-h12.html @@ -0,0 +1,351 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-279604
+ 		+
+ Fixed an issue where scheduled SaaS application usage reports were + generated incorrectly, and the login page was displayed instead of the + report content. +
+
+
PAN-273994
+ 		+
+ A fix was made to address + CVE-2025-0111. +
+
+
PAN-273971
+ 		+
+ A fix was made to address + CVE-2025-0108. +
+
+
PAN-273278
+ 		+
+ A fix was made to address + CVE-2025-0109. +
+
+
PAN-271926
+ 		+
+ Fixed an issue where TLS 1.3 decryption failed with a bad record MAC + error when the firewall was configured to decrypt and inspect TLS + traffic. +
+
+
PAN-270549
+ 		+
+ Fixed an issue where some TLS connections were not handled correctly, + which led to instability in the dataplane. +
+
+
PAN-269731
+ 		+
+ Fixed an issue where Panorama did not display logs from firewalls + after upgrading to PAN-OS 10.2.11 on devices due to Elasticsearch (ES) + getting restarted continuously. +
+
+
PAN-268727
+ 		+
+ Fixed an issue where traffic was dropped when the accumulation proxy + was enabled and header insertion modified packets. +
+
+
PAN-268319
+ 		+
+ Fixed an issue where + Receive Time and + Time Generated were not visible as + attributes in the Filter Builder for + system logs and URL filtering logs. +
+
+
PAN-268260
+ 		+
+ Fixed an issue on hardware firewalls where, when SSL decryption was + enabled and Client Hello messages spanned multiple TCP segments, some + SSL decrypted sessions failed. +
+
+
PAN-267781
+ 		+
+ Fixed an issue where Panorama did not display the Source Dynamic + Address Group. +
+
+
PAN-264762
+ 		+
+ Fixed an issue where the firewall showed the status of SFP+ interfaces + as not up, or up but not configured, when a PAN-SFP-PLUS-SR cable was + connected. +
+
+
PAN-263465
+ 		+
+ Fixed an issue where the + logrcvr + process stopped responding due to a memory leak and buffer overrun. +
+
+
PAN-261739
+ 		+
+ (VM-Series firewalls in Microsoft Azure environments only) Fixed an issue where the firewall displayed 0 for the physical port + counters read from MAC. +
+
+
PAN-259351
+ 		+
+ A fix was made to address + CVE-2024-3393. +
+
+
PAN-256051
+ 		+
+ Fixed an issue on the firewall where enabling flow basic caused the + firewall to stop responding due to a + masterd + process restart. +
+
+
PAN-255619
+ 		+
+ Fixed an intermittent issue where file downloads from websites failed + when decrypting HTTP/2 traffic. +
+
+
PAN-249597
+ 		+
+ Fixed an issue where the Policy page + on the Panorama web interface was slower than expected when a device + group had a large number of managed devices. +
+
+
PAN-241004
+ 		+
+ Fixed an issue where DNS Proxy dropped client requests of the type + ns for a root domain. +
+
+
PAN-233965
+ 		+
+ Fixed an issue here the + tund + process stopped responding, which caused push operation to managed + firewalls or making changes to local firewalls to fail. +
+
+
PAN-230825
+ 		+
+ Fixed an issue where link flaps occurred on Panorama appliances in HA + configurations. +
+
diff --git a/reference/PAN-OS/addressed/10.2.11-h2.html b/reference/PAN-OS/addressed/10.2.11-h2.html new file mode 100644 index 0000000..6264df1 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.11-h2.html @@ -0,0 +1,91 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-265438
+ 		+
+ Fixed an issue where the firewall did not update the Nicafe firmware + from 2.110 to 2.111. +
+
+
PAN-265336
+ 		+
+ Fixed an issue where the copper ports flapped when generating a + technical support file, executing telemetry, or retrieving port status + using a Management Data Input/Output (MDIO) read. +
+
+
PAN-264871
+ 		+
+ Fixed an issue on Panorama where the + configd + process stopped responding when viewing IP addresses on dynamic + address groups with a large number of IP addresses. +
+
+
PAN-260512
+ 		+
+ Fixed an issue where accessing the IP address of the device address + group objects from the user interface caused the + configd + process to stop responding. +
+
diff --git a/reference/PAN-OS/addressed/10.2.11-h3.html b/reference/PAN-OS/addressed/10.2.11-h3.html new file mode 100644 index 0000000..1f02b52 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.11-h3.html @@ -0,0 +1,45 @@ + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-264680
+ 		+
+ (PA-220 firewalls only) Fixed an issue where + Device > Setup was not displayed + on the web interface. +
+
+
PAN-262340
+ 		+
+ Fixed an issue where FQDN resolution failed for address objects, and + all FQDN traffic was denied by the interzone-default policy rule. +
+
diff --git a/reference/PAN-OS/addressed/10.2.11-h4.html b/reference/PAN-OS/addressed/10.2.11-h4.html new file mode 100644 index 0000000..c1a0b74 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.11-h4.html @@ -0,0 +1,57 @@ + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-262287
+ 		+
+ Fixed an issue where dereferencing a NULL pointer that occurred caused + pan_task + processes to stop responding. +
+
+
PAN-226361
+ 		+
+ Fixed an issue where sessions bypassed L7 inspection or ended + unexpectedly with the error + resources unavailable when the + firewall incorrectly interpreted the Content and Threat Detection + (CTD) global packet queue as being full. +
+
diff --git a/reference/PAN-OS/addressed/10.2.11-h6.html b/reference/PAN-OS/addressed/10.2.11-h6.html new file mode 100644 index 0000000..e90cac0 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.11-h6.html @@ -0,0 +1,170 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-272809
+ 		+
+ A fix was made to address + CVE-2024-0012 + (PAN-SA-2024-0015) and + CVE-2024-9474. +
+
+
PAN-267001
+ 		+
+ Fixed an issue where multicast streams were unstable with ECMP and + dropped every 30 seconds. +
+
+
PAN-266704
+ 		+
+ Fixed an issue where filtering BGP routes by peer name in Advanced + Routing Engine (ARE) did not display the correct routes. +
+
+
PAN-266312
+ 		+ Fixed an issue where BFD sessions took longer than expected to establish + after an HA failover due to BGP. +
+
PAN-262287
+ 		+
+ Fixed an issue where dereferencing a NULL pointer that occurred caused + pan_task + processes to stop responding. +
+
+
PAN-259870
+ 		+
+ (PA-7000b firewalls only) Fixed an issue where + Luna Network Hardware Security Modules (HSM) did not work after an + upgrade or downgrade. +
+
+
PAN-258912
+ 		+
+ (PA-7000b firewalls only) Fixed an issue where + the firewall web interface displayed an incorrect HSM client version + when the client was upgraded to version 7.2.0.220. +
+
+
PAN-255360
+ 		+
+ Fixed an issue where the firewall booted into maintenance mode when + there was no connectivity to the specified HSM. +
+
+
PAN-226361
+ 		+
+ Fixed an issue where sessions bypassed L7 inspection or ended + unexpectedly with the error + resources unavailable when the + firewall incorrectly interpreted the Content and Threat Detection + (CTD) global packet queue as being full. +
+
diff --git a/reference/PAN-OS/addressed/10.2.11-h9.html b/reference/PAN-OS/addressed/10.2.11-h9.html new file mode 100644 index 0000000..be4bdc7 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.11-h9.html @@ -0,0 +1,170 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-273215
+ 		+
+ Fixed an issue where a syntax error in the index generation script + caused a high management plane CPU load after upgrading. +
+
+
PAN-268823
+ 		+
+ Fixed an issue where + Monitor > Log Display did not + display all logs when you applied a filter. +
+
+
PAN-268339
+ 		+
+ Fixed an issue where + syslog-ng failed to start due to + the syslog-ng.config file being corrupted when upgrading from PAN-OS + 10.2.9-h1 to PAN-OS 10.2.11. +
+
+
PAN-264249
+ 		+
+ Fixed an issue on the firewall where SNMP queries timed out when using + SNMP. +
+
+
PAN-263973
+ 		+
+ Fixed an issue where log collectors had a low incoming log rate. +
+
+
PAN-263287
+ 		+
+ The PAN-COMMON-MIB.my file was updated to support new object + identifiers (OID) to poll interface use via SNMP with table + identifiers. +
+
+
PAN-261332
+ 		+
+ A fix was made to address + CVE-2024-2552. +
+
+
PAN-259910
+ 		+
+ Fixed an issue where the firewall reported the same value over + consecutive SNMP polls when asynchronous mode was enabled. +
+
+
PAN-257601
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where + Networking Cards (NC) experienced an internal link fault which caused + path monitoring failure on the Dataplane Processing Card (DPC). +
+
+
PAN-246699
+ 		+
+ Fixed an issue on Panorama where + Rule Usage and + Apps Seen under Security policy + rules stopped incrementing. +
+
+
PAN-225213
+ 		+
+ Fixed an issue where + Push All Changes displayed changes + that were already committed in the push scope for another device group + after performing a selective commit and selective push to the first + device group. +
+
diff --git a/reference/PAN-OS/addressed/10.2.11.html b/reference/PAN-OS/addressed/10.2.11.html new file mode 100644 index 0000000..755eb14 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.11.html @@ -0,0 +1,1474 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-259997
+ 		+
+ (PA-3410, PA-3420, and PA-3430 firewalls only) + Fixed an issue where the install failed when upgrading from PAN-OS + 10.2.3-h3 and later 10.2 releases to PAN-OS 10.2.10 due to the number + of configured vsys zones exceeding the zone limit in PAN-OS 10.2.10. +
+
+
PAN-259480
+ 		+
+ Fixed an issue where the + varrcvr + process stopped responding after running out of memory due to how the + process queued and dequeued files for WildFire file forwarding when a + WildFire Analysis Security Profile was enabled. +
+
+
PAN-259473
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where + the chassis shut down when FAN1 was removed. +
+
+
PAN-259344
+ 		+
+ Fixed an issue where performing a configuration commit on a firewall + locally or from Panorama caused a memory leak related to the + configd + process and resulted in an out-of-memory (OOM) condition. +
+
+
PAN-257925
+ 		+
+ (CN-Series firewalls only) Fixed an issue where + the CLI command + show system setting ctd state did + not work as expected. +
+
+
PAN-257601
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where + Networking Cards (NC) experienced an internal link fault which caused + path monitoring failure on the Dataplane Processing Card (DPC). +
+
+
PAN-257515
+ 		+
+ Fixed an issue where Possible Domain Fronting Detection for HTTP/2 + generated false positives. With this change, domain fronting is + limited to HTTP/1. +
+
+
PAN-257355
+ 		+
+ Fixed an issue where a false positive HTTP/TLS evasion alert was + generated when the domain had DNS load balance. +
+
+
PAN-257462
+ 		+
+ Fixed an issue related to the + varrcvr + process where the management plane CPU was higher than expected during + WildFire updates. +
+
+
PAN-257432
+ 		+
+ Fixed an issue on Panorama where the + reportd + process stopped responding, which caused a log query issue. +
+
+
PAN-257021
+ 		+
+ "Fixed an issue on the web interface where + Match Evidence log details for + Monitor > Correlated events did + not populate." +
+
+
PAN-256939
+ 		+
+ Fixed an issue on the firewall where disk space was low in + /opt/pancfg/, which caused + dynamic content installation to fail. +
+
+
PAN-256738
+ 		+
+ (VM-Series firewalls in HA configurations only) + Fixed an issue where BGP routes from the active firewall were lost + when the passive firewall was rebooted. +
+
+
PAN-256666
+ 		+
+ Fixed an issue where the + configd + process stopped responding when + Commit and Push operations were + performed on multiple device groups. +
+
+
PAN-256223
+ 		+
+ Fixed an issue where device telemetry log collection filled the root + partition. +
+
+
PAN-255163
+ 		+
+ (CN-Series firewalls only) Fixed an issue where + the system database key that stored the configuration status of the + dataplane pod was not updated frequently. +
+
+
PAN-254373
+ 		+
+ Fixed an issue where the firewall did not handle error code 500 + responses from the WildFire cloud correctly. +
+
+
PAN-253085
+ 		+
+ Fixed an issue where the firewall restarted when the parsing of the + cross-pkt http origin header failed when processing a translator + website. +
+
+
PAN-252411
+ 		+
+ Fixed an issue where, when log files were purged from the rollup + summary logs, the summary report still used the rollup summary data, + which resulted in the summary report displaying less data. +
+
+
PAN-251929
+ 		+
+ Fixed an issue where inbound decryption did not work when FIPS + self-tests were turned on. +
+
+
PAN-251847
+ 		+
+ Fixed an issue on log collectors where the incoming log rate was lower + than expected. +
+
+
PAN-251676
+ 		+
+ Fixed an issue on Panorama appliances in large-scale deployments where + configd + process core files consumed more space in the /opt/panlogs partition + than was available. +
+
+
PAN-251656
+ 		+
+ Fixed an issue where enabling lockless QoS caused traffic disruptions. +
+
+
PAN-250371
+ 		+
+ Fixed an issue where the + logrcvr + process stopped responding, which caused commits to fail with the + error message + Management server failed to send phase 1 to client logrcvr. +
+
+
PAN-250062
+ 		+
+ Fixed an issue where device telemetry failed after upgrading due to + bundle generation failure. +
+
+
PAN-249814
+ 		+
+ Fixed an issue where multiple + all_task + processes stopped responding, which caused the dataplane to fail. +
+
+
PAN-248975
+ 		+
+ Fixed an issue on the Panorama web interface where no content was + displayed after logging in. +
+
+
PAN-248508
+ 		+
+ (VM-Series firewalls on Amazon Web Services (AWS) environments + only) Fixed an issue where the firewall did not perform MSS clamping when + GWLB endpoints were mapped to static subinterfaces. +
+
+
PAN-248211
+ 		+
+ Fixed an issue on Panorama where commits failed when Advanced Routing + was enabled. +
+
+
PAN-247257
+ 		+
+ Fixed an issue where the + useridd + process stopped responding, which caused the firewall to reboot. +
+
+
PAN-247099
+ 		+
+ Fixed an issue where the firewall decrypted traffic unexpectedly when + the client hello was spread across multiple packets. +
+
+
PAN-246707
+ 		+
+ Fixed an issue where failover was not triggered when multiple + processes stopped responding. +
+
+
PAN-246420
+ 		+
+ (PA-5450 Series firewalls only) Fixed an issue + where the firewall rebooted unexpectedly during an upgrade. +
+
+
PAN-245428
+ 		+
+ Fixed an issue where FIB entries aged out and were incorrectly removed + after an HA failover event. +
+
+
PAN-245157
+ 		+
+ (VM-Series firewalls in Microsoft Azure environments only) Fixed an issue where the firewall restarted after an HA failover + when DPDK was enabled. +
+
+
PAN-244894
+ 		+
+ Fixed an issue where turning off + mprelay + logging caused + mprelay + heartbeat failure. +
+
+
PAN-244227
+ 		+
+ Fixed an issue where inconsistent FIB entries across the dataplane + were not detected. +
+
+
PAN-242601
+ 		+
+ Fixed an issue where the + all-task + process stopped responding with DNS traffic due to an incorrect + cleanup by + pan_free. +
+
+
PAN-242519
+ 		+
+ Fixed an issue where scheduled email reports failed if the + @ + symbol before the mail client was missing. +
+
+
PAN-242414
+ 		+
+ Fixed an issue where the CLI command + show ntp displayed the NTP status + as error instead of + sync. +
+
+
PAN-242146
+ 		+
+ Fixed an issue where the DHCP was unable to find the interface, which + resulted in the DHCP process and all connected DHCP services to stop + responding. +
+
+
PAN-240993
+ 		+
+ Fixed an issue where you were unable to revert a sort in the task + manager in the Admin column. +
+
+
PAN-240251
+ 		+
+ Fixed an issue where the + vldmgr + process incorrectly restarted during an Elasticsearch restart. +
+
+
PAN-239952
+ 		+
+ (Firewalls in active/passive HA configurations only) Fixed an issue where HA sync messages from the active firewall took + longer than expected to reach the passive firewall. +
+
+
PAN-239575
+ 		+
+ Fixed an issue where the TCP window size of the server-to-client flow + for HTTP/2 connection sessions decremented if HTTP/2 stream sessions + were closed due to a Security Profile or a Security policy rule. This + caused the connection session to have a TCP window of 0. +
+
+
PAN-239337
+ 		+
+ Fixed an issue where the log_index was suspended and corrupted BDX + files flooded the index_log. +
+
+
PAN-239271
+ 		+
+ Fixed an issue where changing the firewall's DNS servers could lead to + connectivity to the hostname-configured User-ID agent. +
+
+
PAN-238705
+ 		+
+ (PA-400 Series firewalls only) Fixed an issue + where HA link-monitor did not work. +
+
+
PAN-238562
+ 		+
+ Fixed an issue where log collectors stopped responding when gathering + reports from Panorama. +
+
+
PAN-238508
+ 		+
+ Fixed an issue where the + routed + process created excessive logs in the log file. +
+
+
PAN-238355
+ 		+
+ Fixed an issue where, when a device group was not successfully + renamed, unexpected configuration changes to the device group + structure occurred. +
+
+
PAN-238249
+ 		+
+ Fixed an issue where static route path monitor packets from a + multislot chassis were intercepted by the firewall performing Static + NAT (SNAT). +
+
+
PAN-237678
+ 		+
+ Fixed an issue with firewalls in active/passive HA configurations + where the passive firewall displayed the error message + Unable to read QSFP Module ID + when the passive link state was set to shutdown. +
+
+
PAN-237582
+ 		+
+ Fixed an issue where logs were intermittently missing on the log + collector due to missing aliases for some indices. +
+
+
PAN-237562
+ 		+
+ Fixed an issue where firewalls generated link-change system logs for + SFP ports even when no cable was connected to the ports. +
+
+
PAN-237478
+ 		+
+ Fixed an issue where the Traffic log displayed 0 bytes for denied + sessions. +
+
+
PAN-237369
+ 		+
+ (PA-1420 firewalls only) Fixed an issue where + the + all_task + process stopped responding, which caused the firewall to become + unresponsive. +
+
+
PAN-236497
+ 		+
+ Fixed an issue where the firewall was unable to purge expired GTP-U + sessions that remained as allocated sessions even after the TTL was + expired. +
+
+
PAN-236261
+ 		+
+ Fixed an issue where a proxy server was used for external dynamic list + communication even when the dataplane interface was configured through + service routes. +
+
+
PAN-235877
+ 		+
+ Fixed an issue where the firewall failed to start up after upgrading + PAN-OS due to system file corruption. +
+
+
PAN-235336
+ 		+
+ Fixed an issue where the character limit for + dgname exceeded the supported + number of characters (31), which caused device group names to be + partially displayed during a validate operation. +
+
+
PAN-235081
+ 		+
+ (VM-Series firewalls only) Fixed an issue where + the firewall sent packets to its own interface after configuring + NAT64. +
+
+
PAN-234596
+ 		+
+ Fixed an issue on firewalls in active/passive HA configurations where + the passive firewall incorrectly became active after a reboot. +
+
+
PAN-234560
+ 		+
+ Fixed an issue where the daily summary report displayed IPv6 addresses + instead of IPv4 addresses. +
+
+
PAN-234459
+ 		+
+ Fixed an issue with the firewall web interface where local SSL + decryption exclusion cache entries were not visible. +
+
+
PAN-233689
+ 		+
+ (PA-7000 Series firewalls only) Fixed an issue + where the Log Forwarding Card (LFC) disk quota usage was reported as 0 + MB for all log types. +
+
+
PAN-233541
+ 		+
+ Fixed an issue where device group and template administrators with + access to a specific virtual system were able to see logs for all + virtual systems via Context Switch. +
+
+
PAN-233366
+ 		+
+ Fixed an issue where the DHCP server sent DHCP ACK messages as + broadcasts instead of unicasts when responding to DHCP INFORM + messages. +
+
+
PAN-233129
+ 		+
+ Fixed an issue where the firewall sent duplicate logs to syslog server + when the log forwarding profile was configured with + Shared enabled and was used in a + Security policy rule. +
+
+
PAN-232368
+ 		+
+ Fixed an issue where commits failed with the error message + Error: Max. user groups used in policy 1389 exceed capacity + (1000). +
+
+
PAN-231802
+ 		+
+ Fixed an issue where an Advanced Routing BGP session flapped with + commits when BGP peer authentication was enabled. +
+
+
PAN-230326
+ 		+
+ Fixed an issue where the Network Packet Broker (NPB) user interface + was incorrectly displayed on unsupported platforms. +
+
+
PAN-229873
+ 		+
+ (PA-7050 firewalls only) Fixed an issue related + to + brdagent + process errors. +
+
+
PAN-229606
+ 		+
+ Fixed an issue where the + brdagent + process stopped responding after an upgrade due to initialization + failure. +
+
+
PAN-227939
+ 		+
+ Fixed an issue where the + all_task + process stopped responding due to high wifclient memory usage, which + caused the firewall to reboot. +
+
+
PAN-227887
+ 		+
+ Fixed an issue where IP address checksums were calculated incorrectly. +
+
+
PAN-225213
+ 		+
+ Fixed an issue where + Push All Changes displayed changes + that were already committed in the push scope for another device group + after performing a selective commit and selective push to the first + device group. +
+
+
PAN-224938
+ 		+
+ Fixed an issue where the CLI command settings for + set system setting logging max-log-rate + did not persist after a + mgmtsrvr + process restart. +
+
+
PAN-224584
+ 		+
+ Fixed an issue on Panorama where generating UAR reports for 30 days or + more was slower than expected, and reports showed the same logs + repeatedly in a loop. +
+
+
PAN-224365
+ 		+
+ Fixed an issue where excessive network path monitoring messages were + generated in the system logs. +
+
+
PAN-221711
+ 		+
+ Fixed an issue on the firewall that caused the LFC to stop responding, + which impacted logging capability. +
+
+
PAN-221571
+ 		+
+ Fixed an issue on the web interface where the Security policy rule hit + count remained at 0 for some rules even though the traffic logs showed + live hits. +
+
+
PAN-220881
+ 		+
+ Fixed an issue where the CLI command + show logging-status did not + correctly display the last log created and forwarded timestamps. +
+
+
PAN-220500
+ 		+
+ (PA-5450 and PA-400 firewalls only) Fixed an + issue where the + request shutdown system CLI + command did not completely shut down the system. +
+
+
PAN-217307
+ 		+
+ Fixed an issue where the + log-start and + log-end policy rule filters did + not return reliable results when set to + no or + yes. +
+
+
PAN-215670
+ 		+
+ Fixed an issue where local reports and scheduled reports displayed + different data. +
+
+
PAN-215561
+ 		+
+ Fixed an issue where GlobalProtect authentication failed when new + users were added to an existing local database group user list. +
+
+
PAN-214177
+ 		+
+ Fixed an issue where template configurations were not properly pushed + to the firewall during an export or push of the device configuration + bundle. +
+
+
PAN-214100
+ 		+
+ Fixed an issue where selecting a threat name under + Threat Monitor + displayed the threat ID instead of the threat name. +
+
+
PAN-209542
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where, + when a log interface was configured, the log interface and the + management interface remained connected to the log collector when + upgrading to PAN-OS 10.2.2. +
+
+
PAN-205482
+ 		+
+ Fixed an issue related to the + configd + process where Panorama displayed the error + Server not responding when editing + policy rules. +
+
+
PAN-198622
+ 		+
+ Fixed an issue where username fields under + Policies were marked with the same + color as the first tag associated to that rule. +
+
+
PAN-196395
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where + the firewall accepted 12 Aggregate Ethernet interfaces, but you were + unable to configure interfaces 9-12 via the web interface. +
+
+
PAN-194968
+ 		+
+ Fixed an issue on the web interface where Antivirus updates were not + able to be downloaded and installed unless Apps and Threads updates + were downloaded and installed first, and the Antivirus content list + displayed as blank. The resulting error message from the update server + was also not reflected in the web interface. +
+
+
PAN-191632
+ 		+
+ Fixed an issue where console sessions were not cleared after the set + idle timeout value. +
+
diff --git a/reference/PAN-OS/addressed/10.2.12-h1.html b/reference/PAN-OS/addressed/10.2.12-h1.html new file mode 100644 index 0000000..d2016eb --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.12-h1.html @@ -0,0 +1,42 @@ + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-262287
+ 		+
+ Fixed an issue where dereferencing a NULL pointer that occurred caused + pan_task + processes to stop responding. +
+
diff --git a/reference/PAN-OS/addressed/10.2.12-h2.html b/reference/PAN-OS/addressed/10.2.12-h2.html new file mode 100644 index 0000000..d32ffbb --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.12-h2.html @@ -0,0 +1,61 @@ + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-272809
+ 		+
+ A fix was made to address + CVE-2024-0012 + (PAN-SA-2024-0015) and + CVE-2024-9474. +
+
diff --git a/reference/PAN-OS/addressed/10.2.12-h3.html b/reference/PAN-OS/addressed/10.2.12-h3.html new file mode 100644 index 0000000..8ec3fcb --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.12-h3.html @@ -0,0 +1,129 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Issue IDDescription
+
PAN-273215
+ 		+
+ Fixed an issue where a syntax error in the index generation script + caused a high management plane CPU load after upgrading. +
+
+
PAN-272413
+ 		+
+ Fixed an issue where device telemetry did not generate logs after + upgrading the firewall. +
+
+
PAN-268823
+ 		+
+ Fixed an issue where + Monitor > Log Display did not + display all logs when you applied a filter. +
+
+
PAN-268339
+ 		+
+ Fixed an issue where + syslog-ng failed to start due to + the syslog-ng.config file being corrupted when upgrading from PAN-OS + 10.2.9-h1 to PAN-OS 10.2.11. +
+
+
PAN-264249
+ 		+
+ Fixed an issue on the firewall where SNMP queries timed out when using + SNMP. +
+
+
PAN-263973
+ 		+
+ Fixed an issue where log collectors had a low incoming log rate. +
+
+
PAN-263287
+ 		+
+ The PAN-COMMON-MIB.my file was updated to support new object + identifiers (OID) to poll interface use via SNMP with table + identifiers. +
+
+
PAN-259910
+ 		+
+ Fixed an issue where the firewall reported the same value over + consecutive SNMP polls when asynchronous mode was enabled. +
+
+
PAN-246699
+ 		+
+ Fixed an issue on Panorama where + Rule Usage and + Apps Seen under Security policy + rules stopped incrementing. +
+
diff --git a/reference/PAN-OS/addressed/10.2.12-h4.html b/reference/PAN-OS/addressed/10.2.12-h4.html new file mode 100644 index 0000000..0b0f4b5 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.12-h4.html @@ -0,0 +1,41 @@ + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-259351
+ 		+
+ A fix was made to address + CVE-2024-3393. +
+
diff --git a/reference/PAN-OS/addressed/10.2.12-h6.html b/reference/PAN-OS/addressed/10.2.12-h6.html new file mode 100644 index 0000000..22aa3bb --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.12-h6.html @@ -0,0 +1,451 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-279604
+ 		+
+ Fixed an issue where scheduled SaaS application usage reports were + generated incorrectly, and the login page was displayed instead of the + report content. +
+
+
PAN-273994
+ 		+
+ A fix was made to address + CVE-2025-0111. +
+
+
PAN-273971
+ 		+
+ A fix was made to address + CVE-2025-0108. +
+
+
PAN-273278
+ 		+
+ A fix was made to address + CVE-2025-0109. +
+
+
PAN-273277
+ 		+
+ Fixed an issue where GlobalProtect clients on macOS devices were + prompted to enter their username and password for Kerberos SSO + authentication. +
+
+
PAN-272006
+ 		+
+ Fixed an issue where the firewall did not trigger a kernel core dump + as a large core when the CPLD (Complex Programmable Logic Device) sent + a Non-Maskable Interrupt (NMI) to the CPU. +
+
+
PAN-271926
+ 		+
+ Fixed an issue where TLS 1.3 decryption failed with a bad record MAC + error when the firewall was configured to decrypt and inspect TLS + traffic. +
+
+
PAN-270549
+ 		+
+ Fixed an issue where some TLS connections were not handled correctly, + which led to instability in the dataplane. +
+
+
PAN-269899
+ 		+
+ Fixed an issue where the Panorama web interface was slower than + expected when querying for device tags. +
+
+
PAN-269731
+ 		+
+ Fixed an issue where Panorama did not display logs from firewalls + after upgrading to PAN-OS 10.2.11 on devices due to Elasticsearch (ES) + getting restarted continuously. +
+
+
PAN-268727
+ 		+
+ Fixed an issue where traffic was dropped when the accumulation proxy + was enabled and header insertion modified packets. +
+
+
PAN-268815
+ 		+
+ Fixed an issue where the firewall entered a non-functional state due + to duplicate entries in the shared memory. +
+
+
PAN-268319
+ 		+
+ Fixed an issue where + Receive Time and + Time Generated were not visible as + attributes in the Filter Builder for + system logs and URL filtering logs. +
+
+
PAN-268260
+ 		+
+ Fixed an issue on hardware firewalls where, when SSL decryption was + enabled and Client Hello messages spanned multiple TCP segments, some + SSL decrypted sessions failed. +
+
+
PAN-267781
+ 		+
+ Fixed an issue where Panorama did not display the Source Dynamic + Address Group. +
+
+
PAN-267671
+ 		+
+ Fixed an issue where the firewall rebooted unexpectedly due to the + all_task + process restarting and repeated OOM conditions occurring on the + pan_task + process. +
+
+
PAN-265179
+ 		+
+ Fixed an issue where a kernel race condition caused the firewall to + reboot with a kernel panic. +
+
+
PAN-263052
+ 		+
+ Fixed an issue where the + request logdb migrate-to-panorama start end-time <start-time> + <type> + CLI command did not work as expected, and you were unable to resend + logs from a firewall to Panorama or a log collector. +
+
+
PAN-261739
+ 		+
+ (VM-Series firewalls in Microsoft Azure environments only) Fixed an issue where the firewall displayed 0 for the physical port + counters read from MAC. +
+
+
PAN-258570
+ 		+
+ Fixed an issue where the + varrcvr + process memory use increased to 16 GB. +
+
+
PAN-257327
+ 		+
+ (PA-5440 firewalls only) Fixed an issue where a + failover event occurred unexpectedly on the firewall. +
+
+
PAN-253921
+ 		+
+ Fixed an issue where the firewall displayed the following error + message: + critical userid register 0 fail to integrate the update of + registered ip addresses since 2 seconds ago; critical system log + alerts observed. +
+
+
PAN-241004
+ 		+
+ Fixed an issue where DNS Proxy dropped client requests of the type + ns for a root domain. +
+
+
PAN-237246
+ 		+
+ Fixed an issue where the + all_pktproc + process repeatedly restarted, which caused the firewall to go into a + nonfunctional state. +
+
+
PAN-228877
+ 		+
+ (PA-5200 Series, PA-5400 Series, and PA-7000 Series firewalls + only) Fixed an issue with out-of-memory (OOM) conditions that caused slot + restarts due to + pan_cmd + consuming more than 300MB. +
+
+
PAN-225213
+ 		+
+ Fixed an issue where + Push All Changes displayed changes + that were already committed in the push scope for another device group + after performing a selective commit and selective push to the first + device group. +
+
+
PAN-223652
+ 		+
+ Fixed an issue where data was not thread safe and led to concurrent + read/write issues that caused GPSVC to stop working unexpectedly. +
+
diff --git a/reference/PAN-OS/addressed/10.2.12.html b/reference/PAN-OS/addressed/10.2.12.html new file mode 100644 index 0000000..3e4bb5d --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.12.html @@ -0,0 +1,449 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-264680
+ 		+
+ (PA-220 firewalls only) Fixed an issue where + Device > Setup was not displayed + on the web interface. +
+
+
PAN-263226
+ 		+
+ Fixed an issue where, when SSL decryption was enabled and Client Hello + messages spanned multiple TCP segments, some SSL decrypted sessions + failed. +
+
+
PAN-263164
+ 		+
+ Fixes a problem where Netflow User ID information was truncated to 31 + characters. +
+
+
PAN-262593
+ 		+
+ Fixed an issue where traffic to websites failed on the Google Chrome + web browser on Secure Web Gateway (SWG) nodes. +
+
+
PAN-261991
+ 		+
+ Fixed an issue where traffic that did not match a decryption policy + rule, or matched a no-decrypt policy rule, failed when accumulation + proxy was enabled and a Zone Protection profile was configured with + syn-cookies enabled. +
+
+
PAN-261917
+ 		+
+ Fixed an issue where websites with a no-decrypt policy rule were + decrypted in traffic log when using a Google Chrome browser with PQC + enabled. +
+
+
PAN-261489
+ 		+
+ Fixed an issue where an out-of-memory (OOM) condition caused a + firewall outage. +
+
+
PAN-261484
+ 		+
+ Fixed an issue on the firewall where DPDK allocated twice the amount + of memory as requested for pre-allocation. +
+
+
PAN-260928
+ 		+
+ Fixed an issue where GlobalProtect failed to connect when using LDAP + authentication with machine certificates with the error message + You are not authorized to connect to GlobalProtect portal. +
+
+
PAN-260738
+ 		+
+ Fixed an issue on the Panorama web interface where the progress bar + did not complete when importing a vulnerability profile configuration + through an XML file. +
+
+
PAN-260149
+ 		+
+ Fixed an issue where the management plane DNS cache size was lower + than expected. +
+
+
PAN-259883
+ 		+
+ Fixed an issue where the firewalls behind an Amazon Web Services (AWS) + Gateway Load Balancer (GWLB) stopped responding when processing GENEVE + packets with the reserved bit set. +
+
+
PAN-257994
+ 		+
+ (CN-Series firewalls only) Fixed an issue where + commits failed with the error + failed to handle CONFIG_UPDATE_START + due to cfgdb files for the + container not being symbolically linked to the + cfgdb files on the virtual + machine. +
+
+
PAN-257957
+ 		+
+ (Firewalls and Panorama appliances in FIPS-CC mode only) Fixed an issue where the + authd + process restarted if RADIUS PAP/CHAP authentication was used. +
+
+
PAN-257652
+ 		+
+ Fixed an issue where Internal Host Detection for IPv6 did not work + after upgrading to a PAN-OS 10.2 release. +
+
+
PAN-255611
+ 		+
+ Fixed an issue on the firewall where newly added routes were not + automatically sorted based on subnets when added to a redistribution + profile. +
+
+
PAN-255509
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where + BFD sessions flapped intermittently. +
+
+
PAN-255323
+ 		+
+ (PA-7050 firewalls only) Fixed an issue where + the Network Processing Card (NPC), Data Processing Card (DPC), and Log + Forwarding Card (LFC) remained in a starting state after an unexpected + power cycle. +
+
+
PAN-252974
+ 		+
+ (PA-450 firewalls only) Fixed an issue where + specific routes were not advertised when BGP Aggregate was configured + with the advertise filter. +
+
+
PAN-252669
+ 		+
+ Fixed an issue where the + ikemgr + process stopped responding with a + SIGSEGV error. +
+
+
PAN-251446
+ 		+
+ Fixed an issue where a critical system log was generated for a SAML + authenticated user whose username length was greater than 32 + characters. +
+
+
PAN-250394
+ 		+
+ Fixed an issue where a large amount of group data caused serialization + errors and prevented synchronization. +
+
+
PAN-239246
+ 		+
+ Fixed an issue where the CLI command + debug user-id dump hip-based-profile-database-entry + returned an incorrect value in the output for the + total size of hip reports. +
+
+
PAN-230825
+ 		+
+ Fixed an issue where link flaps occurred on Panorama appliances in + high-availability (HA) configurations. +
+
+
PAN-227543
+ 		+
+ Fixed an issue where the firewall did not match traffic to FQDN + objects if the FQDN object contained uppercase characters. +
+
+
PAN-226361
+ 		+
+ Fixed an issue where sessions might end unexpectedly with the error + resources-unavailable when the + firewall incorrectly interprets the Content and Threat Detection (CTD) + global packet queue as being full. +
+
+
PAN-221127
+ 		+
+ Fixed an issue where a large number of core files were generated, + which caused the root partition to become full and the firewall to + move into a non-functional state. +
+
+
PAN-210395
+ 		+
+ Fixed an issue where the GlobalProtect application configuration + screen did not display all value names when a language other than + English was selected. +
+
+
PAN-203231
+ 		+
+ Fixed an issue where + Software Version in the device + summary report exported from Panorama included HTML tags. +
+
+
PAN-189951
+ 		+
+ Fixed an issue where the CLI command + debug device-telemetry on debug + caused high CPU load. +
+
+
PAN-76904
+ 		+
+ (PA-5410 firewalls only) Fixed an issue where + the management interface went down and an error message displayed in + the show interface management CLI + command output. +
+
diff --git a/reference/PAN-OS/addressed/10.2.13-h24.html b/reference/PAN-OS/addressed/10.2.13-h24.html new file mode 100644 index 0000000..fc13875 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.13-h24.html @@ -0,0 +1,60 @@ + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
—
+ 		+
+ Fixes were made to address the following CVEs: + +
+
diff --git a/reference/PAN-OS/addressed/10.2.14-h1.html b/reference/PAN-OS/addressed/10.2.14-h1.html new file mode 100644 index 0000000..8b921b5 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.14-h1.html @@ -0,0 +1,33 @@ + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-286255
+ 		+
+ Fixed an issue where, when the firewall received an unexpected + termination request for SSL sessions, the dataplane experienced a slow + buffer resource leak. +
+
diff --git a/reference/PAN-OS/addressed/10.2.14.html b/reference/PAN-OS/addressed/10.2.14.html new file mode 100644 index 0000000..fdc51fc --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.14.html @@ -0,0 +1,4322 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-282640
+ 		+
+ Fixed an issue where custom reports showed incomplete data when + exported in CSV format from Panorama. +
+
+
PAN-282236
+ 		+
+ Fixed an issue where large IPv6 packets were reassembled incorrectly + on the firewall when the packets arrived fragmented over an IPv4 + tunnel. +
+
+
PAN-279746
+ 		+
+ Fixed an issue where SMTP packets were not sent out when the Client + Hello arrived at the firewall in multiple out-of-order segments and + the traffic was not subject to SSL decryption. +
+
+
PAN-279621
+ 		+
+ Fixed an issue where processes stopped responding when HTTPS Forward + traffic was run. +
+
+
PAN-279604
+ 		+
+ Fixed an issue where scheduled SaaS application usage reports were + generated incorrectly, and the login page was displayed instead of the + report content. +
+
+
PAN-279176
+ 		+
+ Fixed an issue where the configuration audit displayed inaccurate + information after partially loading the configuration via the CLI, + which caused the audit to flag the configuration as deleted or + changed. +
+
+
PAN-278088
+ 		+
+ Fixed an issue where the + show system resources follow CLI + command was not available. +
+
+
PAN-277235
+ 		+
+ Fixed an issue where the + Migration Configuration dialog box + displayed an incorrect number of virtual routers when enabling + Advanced Routing from Panorama. +
+
+
PAN-277147
+ 		+
+ Fixed an issue where daily scheduled reports were not generated and + emailed. +
+
+
PAN-277000
+ 		+
+ Fixed an issue where the firewall stopped responding after upgrading + to PAN-OS 11.0.2 with lockless-qos enabled. +
+
+
PAN-276795
+ 		+
+ Fixed an issue where the GlobalProtect client displayed an error + message when you clicked + Check Now and + Preferred Releases and + Base Releases were unchecked (Device > Software). +
+
+
PAN-276491
+ 		+
+ (Panorama virtual appliances only) Fixed an + issue where Panorama stopped responding when running reports. +
+
+
PAN-275077
+ 		+
+ Fixed an issue where DNS Security intermittently logs malicious domain + URLs as Alert instead of taking a Sinkhole action, even when + configured to Sinkhole malicious DNS domains. +
+
+
PAN-274797
+ 		+
+ Fixed an issue where a DPC on slot 3 failed intermittently due to the + pktlog_forwarding process + restarting, which resulted in an unexpected HA failover. +
+
+
PAN-274726
+ 		+
+ Fixed an issue where Wildfire signature generation was enabled on all + nodes in a cluster instead of only the active node. +
+
+
PAN-274650
+ 		+
+ Fixed an issue where the firewall did not perform certificate expiry + validation during a commit, which resulted in successful + authentication even when an intermediate certificate had expired. +
+
+
PAN-274611
+ 		+
+ Added a CLI debug command to increase the queue size to address file + transfer errors. +
+
+
PAN-274592
+ 		+
+ (Firewalls in HA configurations only) Fixed an + issue where the firewall did not fail over when the active firewall + experienced data plane issues. +
+
+
PAN-274570
+ 		+
+ Fixed an issue where the + devsrvr + process restarted after a failed commit due to an invalid memory + access. +
+
+
PAN-274557
+ 		+
+ Fixed an issue on PA-5450 in FIPSCC mode where a firewall rebooted + into maintenance mode when it was manually rebooted from the web + interface. +
+
+
PAN-274333
+ 		+
+ Fixed an issue where the Logging Service License Status displayed as + red even though a valid license was installed on the firewall. +
+
+
PAN-274292
+ 		+
+ (M-600 Appliances only) Fixed an issue where + the web interface was slow when logging in and filtering for policies + due to deep search operations taking longer than expected. +
+
+
PAN-273969
+ 		+
+ Fixed an issue where the Panorama interface template did not include + the Forward Error Correction (FEC) setting. +
+
+
PAN-273964
+ 		+
+ Fixed an issue where SNMP scans to a firewall timed out after + upgrading to a PAN-OS 10.2 release. +
+
+
PAN-273949
+ 		+
+ Fixed an issue where the firewall generated the following error + message in the + snmpd + logs: + pan_get_keystr_from_cryptod(pan_snmpinterface.c:181): Key + X2F1dGhfa2V5 import from cryptod failed. +
+
+
PAN-273947
+ 		+
+ Fixed an issue where the displayed group name differed depending on + whether the group was configured locally on the firewall or through + Panorama. +
+
+
PAN-273694
+ 		+
+ Fixed an issue where the firewall rebooted due to an out-of-bounds + memory access that occurred as a result of the SIP content length + value being split across packets. +
+
+
PAN-273597
+ 		+
+ Fixed an issue where logs in the cloud database displayed in the + Not-Resolved category but not in the + local database. +
+
+
PAN-273453
+ 		+
+ Fixed an issue where restarting the firewall did not initiate an + autocommit job, which caused the firewall to stop responding and the + HA interface to go down. +
+
+
PAN-273153
+ 		+
+ Fixed an issue where the Panorama web interface was slower than + expected due to excessive polling of the + MonitorDirect.getTasks API by the + Task Manager. +
+
+
PAN-273129
+ 		+
+ Fixed an issue on the web interface where the + negate option was visible when you + clicked on the rule name, but not when you viewed the target options + from the rulebase attribute. +
+
+
PAN-273021
+ 		+
+ Fixed an issue where 25G port links did not come up due to a change in + the handling of 25G DAC modules. +
+
+
PAN-272998
+ 		+
+ Fixed an issue where commits from Panorama to VM-Series firewalls on + Microsoft Azure environments failed. +
+
+
PAN-272959
+ 		+
+ Fixed an issue where the firewall generated BGP update packets larger + than 1500 bytes when the interface MTU was 1500 bytes and jumbo frames + were enabled globally. +
+
+
PAN-272743
+ 		+
+ Fixed an issue where non-captive portal traffic was not visible under + Traffic Logs when the traffic was + denied by an authentication rule and the session was discarded. +
+
+
PAN-272726
+ 		+
+ Fixed an issue on the web interface where the + URL Filtering change category + feature did not work. +
+
+
PAN-272413
+ 		+
+ Fixed an issue where device telemetry did not generate logs after + upgrading the firewall. +
+
+
PAN-272395
+ 		+
+ Fixed an issue where informational logs caused the + distributord + process log file to be frequently overwritten. +
+
+
PAN-272175
+ 		+
+ Fixed an issue where session rematch caused ACE cloud application + traffic to match the wrong policy. +
+
+
PAN-272172
+ 		+
+ Fixed an issue where + plugin_api_server could + experience a memory leak when using OpenConfig for telemetry. +
+
+
PAN-272171
+ 		+
+ Fixed an issue where the firewall dropped the AAAA DNS server response + and caused delays in traffic from Ubuntu or Linux clients when DNS + Security was enabled. +
+
+
PAN-272006
+ 		+
+ Fixed an issue where the firewall did not trigger a kernel core dump + as a large core when the CPLD (Complex Programmable Logic Device) sent + a Non-Maskable Interrupt (NMI) to the CPU. +
+
+
PAN-271926
+ 		+
+ Fixed an issue where TLS 1.3 decryption failed with a bad record MAC + error when the firewall was configured to decrypt and inspect TLS + traffic. +
+
+
PAN-271828
+ 		+
+ Fixed an issue where, after an accumulation proxy changed to + no-decrypt or no proxy, only the Client Hello was sent to Content + Threat Detection. +
+
+
PAN-271490
+ 		+
+ Fixed an issue on the firewall that caused the following error message + to be displayed: + frr_ns0: failed to stop child frr_ns0_ospf6d. +
+
+
PAN-271436
+ 		+
+ A CLI counter was added to indicate a full suppression queue. +
+
+
PAN-271425
+ 		+
+ (Firewalls in active/active HA configurations only) Fixed an issue with SSL inbound decryption on firewalls on a vwire + setup with asymmetric routing. +
+
+ To use this fix, enter the CLI command + set system setting ssl-decrypt ha-vwire-mac-learn global yes + on both firewalls in an HA pair. +
+
+
PAN-271314
+ 		+
+ Fixed an issue where pushing changes to a prefix list used for BGP + from Panorama affected OSPF routes. +
+
+
PAN-271273
+ 		+
+ Fixed an issue where dynamic update downloads failed when + IPv6 firewalling was enabled on the + firewall and both IPv4 and IPv6 were configured on the management + interface. +
+
+
PAN-271239
+ 		+
+ Fixed an issue where searching for the GlobalProtect client version + browser in Panorama logs returned no results. +
+
+
PAN-271215
+ 		+
+ A fix was made to address + CVE-2025-4230. +
+
+
PAN-271184
+ 		+
+ Fixed an issue where Device Telemetry failed due to an issue with the + encoding of characters in the log file path. +
+
+
PAN-271175
+ 		+
+ Fixed an issue where the *all_task * process stopped responding with a + SIGABRT. +
+
+
PAN-271173
+ 		+
+ Fixed an issue where the firewall displayed an incorrect maximum + translated IP capacity when using DIPP NAT policy rules. +
+
+
PAN-271152
+ 		+
+ (7000-Series firewalls in HA configurations only) Fixed an issue where the firewall failed over into a non-functional + state, and the LFC LED was blinking on the passive firewall. +
+
+
PAN-271115
+ 		+
+ Fixed an issue where SNMP polling timed out on firewalls with + aggregate ethernet (AE) interfaces. +
+
+
PAN-270849
+ 		+
+ Fixed a memory leak issue related to the + configd + process that occurred when running consecutive commits for mulitple + days. +
+
+
PAN-270747
+ 		+
+ Fixed an issue where the + show system statistics application + CLI command failed. +
+
+
PAN-270651
+ 		+
+ Fixed an issue where the firewall didn't restart after applying an + air-gapped license if the firewall capacity was the same as the + license capacity. +
+
+
PAN-270607
+ 		+
+ (Firewalls in active/passive HA configurations only) Fixed an issue where OSPF failed to establish after a failover from + the active firewall to the passive firewall. +
+
+
PAN-270569
+ 		+
+ Fixed an issue where the + userid + process stopped responding due to memory was being reset to NULL when + it was freed. +
+
+
PAN-270323
+ 		+
+ Fixed an issue where the firewall allowed cleartext web-browsing + traffic on port 443 when the Security policy rule was configured to + allow application: web-browsing with service: application-default. +
+
+
PAN-270248
+ 		+
+ Fixed an issue where the firewall failed to forward logs to a SNMP + trap server if the SNMP manager IP address was unable to be resolved. +
+
+
PAN-270193
+ 		+
+ Fixed an issue where the Panorama management server changed its + certificate authority (CA) unexpectedly, which caused managed + firewalls to disconnect. +
+
+
PAN-270192
+ 		+
+ Fixed an issue where Panorama did not display the management IP + address of devices onboard via ZTP. +
+
+
PAN-270077
+ 		+
+ (VM-Series firewalls in Amazon Web Services (AWS) environments + only) Fixed an issue template values were missing in newly spun firewalls + in auto scale deployments without an explicit push with forced + template values from Panorama. +
+
+
PAN-270068
+ 		+
+ Fixed an issue where the firewall attempted to connect to the AppID + cloud using gRPC even when App-ID Cloud Engine was disabled. +
+
+
PAN-269737
+ 		+
+ Fixed an issue where the followig critical error displayed repeatedly: + /mnt/cdrom is mounted as Read-Only. +
+
+
PAN-269716
+ 		+
+ Fixed an issue where half-closed TCP sessions did not refresh the + session timeout when continuously receiving data after setting the + cfg.session.tcp-no-refresh-fin-rst + option toTrue. +
+
+
PAN-269677
+ 		+
+ Fixed an issue where Panorama did not check for a NULL pointer when + querying logs, which caused logs to not display on the web interface. +
+
+
PAN-269557
+ 		+
+ Fixed an issue where the mib ID returned an incorrect value via SNMP. +
+
+
PAN-269535
+ 		+
+ Fixed an issue where the mib ID returned an incorrect value via SNMP. +
+
+
PAN-269499
+ 		+
+ Fixed an issue where the firewall stopped responding when receiving a + high number of logs. +
+
+
PAN-269456
+ 		+
+ Fixed an issue where the firewall rebooted unexpectedly when + configuring the GlobalProtect portal and gateway from Panorama. +
+
+
PAN-269303
+ 		+
+ Fixed an issue where the CSV export of disabled applications included + duplicate entries, which caused the count of disabled applications to + be higher in the CSV export than on the web interface. +
+
+
PAN-269193
+ 		+
+ Fixed an issue where the firewall redirected the user to the first + application instead of the portal page with a list of applications + when multiple applications were configured for GlobalProtect + clientless VPN along with any user match. +
+
+
PAN-269106
+ 		+
+ Fixed an issue where the + wifclient stopped responding + during server certificate verification for MICA gRPC connections and + caused the dataplane to restart when using a cloud-based ML detection + engine (MICA). On certain platforms, this caused the firewall to + reboot periodically. +
+
+
PAN-269052
+ 		+
+ Fixed an issue where traffic was blocked by a URL filtering profile + even though the Security policy rule did not have a URL filtering + profile configured. +
+
+
PAN-269027
+ 		+
+ Fixed an issue related to external dynamic lists that caused commit + times on the firewall to be higher than expected. +
+
+
PAN-268951
+ 		+
+ Fixed a CPS counter query issue that caused SNMP polling timeouts on + the firewall. +
+
+
PAN-268909
+ 		+
+ Fixed an issue where IP address tags were removed from firewalls after + a management server or + useridd + process restart. This occurred when a Panorama serial-number based + configuration was used for User-ID redistribution. +
+
+
PAN-268815
+ 		+
+ Fixed an issue that caused the firewall to reboot due to the wifclient + exiting multiple times when using IoT Security. +
+
+
PAN-268800
+ 		+
+ Fixed an issue where a large number of logs caused the + logrcvr + process to stop responding. +
+
+
PAN-268727
+ 		+
+ Fixed an issue where traffic was dropped when the accumulation proxy + was enabled and header insertion modified packets. +
+
+
PAN-268708
+ 		+
+ Fixed an issue where PDF summary and email reports displayed IPv6 + addresses instead of IPv4 addresses. +
+
+
PAN-268707
+ 		+
+ Fixed an issue where the XML API call to clear rule hit count using + device group syntax failed with an error. +
+
+
PAN-268629
+ 		+
+ Fixed an issue where traffic did not match the correct security policy + when using an application-filter that references a cloud application. + This occurred when a high number of cloud applications were attached + with a custom tag. +
+
+
PAN-268597
+ 		+
+ Fixed an issue where the firewall displayed 0 bytes received for + GlobalProtect SSL sessions in the traffic logs. +
+
+
PAN-268569
+ 		+
+ Fixed an issue where the web interface was slower than expected when + logging in and filtering for policies. +
+
+
PAN-268426
+ 		+
+ Fixed an issue where the firewall was unable to connect to a syslog + server that used a TLS certificate without a subject key identifier. +
+
+
PAN-268308
+ 		+
+ Fixed an issue where the + Push Scope was not automatically + displayed when you selected + Commit and Pushes Changes Made by. +
+
+
PAN-268279
+ 		+
+ Fixed an issue where autocommits failed if the management IPv6 gateway + was the same as the dataplane interface IP address. +
+
+
PAN-268276
+ 		+
+ Fixed an issue where GlobalProtect clients intermittently failed to + connect to the gateway with the error message + could not connect to gateway. +
+
+
PAN-268168
+ 		+
+ Fixed an issue where uploading files that were 5GB or larger to Google + Drive or Youtube failed when a decryption policy rule for http2 was + enabled +
+
+
PAN-268127
+ 		+
+ Fixed an issue where tagging devices in Panorama did not work as + expected. +
+
+
PAN-268118
+ 		+
+ Fixed an issue on firewalls in active/passive HA configurations where, + after a failover, irrelevant routing FIB entries were seen in the + routing table on the newly active firewall. +
+
+
PAN-268002
+ 		+
+ Fixed an issue where URL filtering response pages were not displayed + for sites that were blocked as a result of SSL/TLS handshake + inspection. +
+
+
PAN-267995
+ 		+
+ Fixed an issue where after migrating to a new platform, DLP verdicts + were not displayed in the Cloud Manager or logs. +
+
+
PAN-267936
+ 		+
+ Fixed an issue where commits failed with a validation error when you + changed the encryption level and re-encryption option on a Panorama + managed firewall. +
+
+
PAN-267934
+ 		+
+ Fixed an issue where commits remained at 98%, which resulted in the + BGP connection flapping. +
+
+
PAN-267830
+ 		+
+ Fixed an issue where the snmpd.log.old file continuously increased, + which caused the root partition to become full. +
+
+
PAN-267781
+ 		+
+ Fixed an issue where Panorama did not display the Source Dynamic + Address Group. +
+
+
PAN-267518
+ 		+
+ Fixed an issue where WildFire submission logs incorrectly reported + allowed malicious samples even when they were blocked by threat + prevention profiles. +
+
+
PAN-267328
+ 		+
+ Fixed an issue where the + all_task + process stopped responding, which caused the firewall to stop + processing traffic. +
+
+
PAN-267235
+ 		+
+ Fixed an issue where the firewall did not send User-ID redistribution + messages to Panorama when the firewall had multiple virtual systems + configured and one of the virtual systems had a display name that was + the same as the existing vsys name. +
+
+
PAN-267097
+ 		+
+ Fixed an issue where the replay database size increased significantly + due to local and special configurations not being purged after + commits. +
+
+
PAN-266971
+ 		+
+ Fixed an issue where the firewall generated AAAA DNS queries when IPv6 + firewalling was disabled. +
+
+
PAN-266900
+ 		+
+ Fixed an issue on the Panorama web interface where you were unable to + click OK after selecting an install + package type and file from the dropdown and selecting a firewall. +
+
+
PAN-266769
+ 		+
+ Fixed an issue where the GlobalProtect gateway did not handle IP + address changes of the inner gateway when the NGPA new protocol was + enabled. +
+
+
PAN-266653
+ 		+
+ Fixed an issue where unexpected path monitor failures caused the + firewall to stop responding. +
+
+
PAN-266639
+ 		+
+ Fixed an issue where administrators were unable to edit or add virtual + router configurations when a filter was applied to the viewer. +
+
+
PAN-266574
+ 		+
+ Fixed an issue where users were unable connect to the portal due to + Certificate Revocation List (CRL) checks due to the downloaded CRL + file being expired, which caused the CRL cache to be bypassed. +
+
+
PAN-266462
+ 		+
+ Fixed an issue where selective pushes did not work as expected when + the device group was renamed by a different admin user. +
+
+
PAN-266391
+ 		+
+ Fixed an issue where the number of hints values were not updated even + when there were no hint files on the system. +
+
+
PAN-266302
+ 		+
+ Fixed an issue where OSPFv3 Link State (LS) update packets (type 9) + were not fragmented properly, which caused the OSPF header to have an + incorrect checksum when sent from the firewall. This occurred when the + update packet size exceeded 1514 byte, which resulted in the peer + device rejecting the packet and the neighbor relationship going down. +
+
+
PAN-266279
+ 		+
+ Fixed an issue on Panorama where the default version of IKE gateway + was not set to IKEv2 only mode, which caused VPN establishment issues + if the firewall recognized a new configuration as IKEv1. +
+
+
PAN-266003
+ 		+
+ Fixed an issue on the firewall where a configuration policy push + caused both active and passive firewalls to go down when a high number + of spyware profiles and vulnerability profiles were pushed to the + dataplane. +
+
+
PAN-265931
+ 		+
+ Added debug functionality in the + packet-diag log to address an + issue regarding policy rule matching. +
+
+
PAN-265791
+ 		+
+ Fixed an issue where the + all_task process stopped + responding, which caused the dataplane to go down. +
+
+
PAN-265646
+ 		+
+ Fixed an issue where the config lock icon was not visible for a custom + role-based admin when a Superuser admin had acquired the config lock. +
+
+
PAN-265462
+ 		+
+ Fixed an issue where you were unable to download PDFs when connected + via a Clientless VPN. +
+
+
PAN-265434
+ 		+
+ Fixed an issue where the flow process restarted with the error message + SIGABRT __GI_raise __GI_abort __libc_message malloc_printer. +
+
+
PAN-265344
+ 		+
+ Fixed an issue where + Import GlobalProtect Client Package + did not work after clicking OK after + selecting a valid package under + Device > GlobalProtect Client > Upload). +
+
+
PAN-265179
+ 		+
+ Fixed an issue where a kernel race condition caused the firewall to + reboot with a kernel panic. +
+
+
PAN-265014
+ 		+
+ Fixed an issue where changes made to device groups with the same + prefix name were not visible in the commit scope. +
+
+
PAN-264912
+ 		+
+ Fixed an issue where the firewall did not shut down completely. +
+
+
PAN-264883
+ 		+
+ (PA-7080 appliances with LPCs only) Fixed an + issue where syslog forwarding over TCP stopped after upgrading. +
+
+
PAN-264845
+ 		+
+ Fixed an issue where the Log Forwarding for Security Services feature + did not correctly filter policy rules with log forwarding profiles. +
+
+
PAN-264806
+ 		+
+ (PA-3440 firewalls only) Fixed an issue where + the firewall was unable to validate or commit a configuration when it + was imported from another firewall model. +
+
+
PAN-264762
+ 		+
+ Fixed an issue where the firewall showed the status of SFP+ interfaces + as not up, or up but not configured, when a PAN-SFP-PLUS-SR cable was + connected. +
+
+
PAN-264708
+ 		+
+ Fixed an issue where a selective push was blocked when a configuration + load was done. +
+
+
PAN-264678
+ 		+
+ Fixed an issue where + Preview Changes did not display + configuration changes in + Commit and push > + Push Scope. +
+
+
PAN-264666
+ 		+
+ Fixed an issue where the + configd + process restarted when pushing configurations to multiple device + groups via XML API, which caused the push to fail. +
+
+
PAN-264662
+ 		+
+ Fixed an issue where HTTP POST requests were blocked for URLs that had + the block-continue category + configured. +
+
+
PAN-264538
+ 		+
+ (VM-Series firewalls only) Fixed an issue where + the + all_task + process stopped responding and a reboot was required. +
+
+
PAN-264289
+ 		+
+ Fixed an issue where the CLI and XML API values for the show system + environment command did not match. +
+
+
PAN-264169
+ 		+
+ (PA-5400 Series firewalls only) Fixed an issue + where the firewall sent correlated event logs to the syslog server + using the management interface instead of the log interface. +
+
+
PAN-264053
+ 		+
+ Fixed an issue where the firewall stopped responding after the + all_task + process stopped responding. +
+
+
PAN-264040
+ 		+
+ Fixed an issue where AAAA DNS queries went out even when + IPv6 firewalling was disabled. +
+
+
PAN-263699
+ 		+
+ PA-440 firewalls only) Fixed an issue where the + firewall was unable to create more than 6 GlobalProtect gateways. +
+
+
PAN-263680
+ 		+
+ Fixed an issue where Prisma Access gateways consistently stopped + responding with process restarts. +
+
+
PAN-263654
+ 		+
+ Fixed an issue where multiple DNS responses with different CNAME + values caused evasion false positive alerts. +
+
+
PAN-263559
+ 		+
+ Fixed an issue where the dataplane stopped responding and the firewall + unexpectedly rebooted due to multiple process restarts. +
+
+
PAN-263544
+ 		+
+ Fixed an issue where management plane CPU usage increased after + upgrading when there was a full-mesh User-ID redistribution + configuration between multiple firewalls. +
+
+
PAN-263465
+ 		+
+ Fixed an issue where the + logrcvr + process stopped responding due to a memory leak and buffer overrun. +
+
+
PAN-263369
+ 		+
+ Fixed an issue where commits from Panorama to Panorama virtual + appliances failed with the error message + Internal error during commit processing. Commit/Validate + failed + after upgrading Panorama. +
+
+
PAN-263052
+ 		+
+ Fixed an issue where the + request logdb migrate-to-panorama start end-time <start-time> + <type> + CLI command did not work as expected, and you were unable to resend + logs from a firewall to Panorama or a log collector. +
+
+
PAN-263017
+ 		+
+ Fixed an issue where the firewall was unable to mount a disk partition + due to a corrupted filesystem. +
+
+
PAN-262902
+ 		+
+ Fixed an issue on the web interface where cloning region objects did + not work. +
+
+
PAN-262782
+ 		+
+ Fixed an issue on the firewall where + cfg.developer.tasks had a default + configuration of True, which + capped dataplane CPU performance at 50% in production. +
+
+
PAN-262729
+ 		+
+ (Panorama appliances only) Fixed an issue where + the + configd + process experienced continuous high CPU utilization and repeatedly + restarted. +
+
+
PAN-262540
+ 		+
+ Fixed an issue where application traffic transactions that reused TCP + ports did not work with decryption. +
+
+
PAN-262521
+ 		+
+ Fixed an issue where imported certificates were not visible on + firewalls with multi-vsys disabled. +
+
+
PAN-262511
+ 		+
+ Fixed an issue on firewalls in HA configurations where OSPF neighbors + were not established after an HA failover. +
+
+
PAN-262375
+ 		+
+ (Firewalls in active/active HA configurations only) Fixed an issue where non-tunneled internal GlobalProtect gateway + client information was not synced between firewall peers when using a + floating IP address. +
+
+
PAN-262063
+ 		+
+ Fixed an issue where the firewall did not display the converted + configurations before a commit and reboot, and the commit failed when + attempting to migrate from MS to FRR mode. +
+
+
PAN-261998
+ 		+
+ Fixed an issue where the firewall configuration process restarted + during an External Dynamic List refresh or a commit and push + operation. +
+
+
PAN-261997
+ 		+
+ Fixed an issue where the firewall displayed incorrect statistics for + mac_transmit_err and send_deffered on PA-440 appliances running PAN-OS + 10.1.9-h3. +
+
+
PAN-261935
+ 		+
+ Fixed an issue where the firewall unexpectedly rebooted when replacing + or inserting SFPs from an old firewall into a new RMA firewall. +
+
+
PAN-261824
+ 		+
+ Fixed an issue where frequent + brdagent + errors occurred. +
+
+
PAN-261739
+ 		+
+ (VM-Series firewalls in Microsoft Azure environments only) Fixed an issue where the firewall displayed 0 for the physical port + counters read from MAC. +
+
+
PAN-261677
+ 		+
+ Fixed an issue where multiple + smartctl + processes entered a d state due + to failure to read from the kernel partition, which resulted in high + CPU and management impact. +
+
+
PAN-261597
+ 		+
+ Fixed an issue where the + all_pktproc + process stopped responding, which caused the firewall to become + unavailable. +
+
+
PAN-261570
+ 		+
+ (Firewalls in active/active HA configurations only) Fixed an issue where packet loss occurred when dataport was used + for HA3 for asymmetrically routed traffic during commits and a virtual + wire was configured . +
+
+
PAN-261371
+ 		+
+ (PA-5410 firewalls in active/passive HA configurations only) Fixed an issue where the + reportd + process restarted, which caused the firewall to reboot. +
+
+
PAN-261182
+ 		+
+ Fixed an issue where the firewall dropped a retransmitted SYN packet + when using the TCP Fast Open option. +
+
+
PAN-261074
+ 		+
+ Fixed an issue where the firewall delayed video file transfers over + SMB when Exclude Video Traffic from + the Tunnel feature was enabled and no applications were added to the + list. +
+
+
PAN-260827
+ 		+
+ Fixed an issue where the firewall consumed excessive CPU while + processing traffic for a workload running on a GKE cluster, which + caused reduced throughput. +
+
+
PAN-260720
+ 		+
+ Fixed an issue where the + dsdc + process stopped responding after receiving an unexpected API return + value. +
+
+
PAN-260700
+ 		+
+ Fixed an issue where the firewall was unable to load application + metadata from the chunk files. This occurred when the application + metadata entry was larger than the buffer used to read it, which + resulted in an incomplete entry that caused commit failures. +
+
+
PAN-260581
+ 		+
+ Fixed an issue where Panorama template changes to the zone and virtual + router were not pushed to managed firewalls when the template stack + default virtual system was set to + None. +
+
+
PAN-260540
+ 		+
+ Fixed an issue where task-debug logs remained on the debug level even + after running the + debug dataplane packet-diag set log off + CLI command, which caused high dataplane CPU utilization. +
+
+
PAN-260417
+ 		+
+ Fixed an issue on Panorama where + UpdateLicDB was triggered every + few minutes when firewalls with PAYG licenses were onboarded. +
+
+
PAN-260358
+ 		+
+ Fixed an issue where the firewall did not include the NAS-ID and + NAS-IP attributes in the RADIUS Access-Request message when using + PEAP-MSCHAPv2 authentication. +
+
+
PAN-260330
+ 		+
+ Fixed an issue where Panorama was unable to generate PDF reports when + the footer contained a GIF image. +
+
+
PAN-260300
+ 		+
+ (PA-5410, PA-5420, PA-5430, PA-5440 and PA-5445 firewalls only) Fixed an issue related to the + all_pktproc + process where DPC slot 3 stopped responding. +
+
+
PAN-260235
+ 		+
+ Fixed an issue where the firewall sent Threat logs and URL logs to an + external syslog server without Security profile settings when Enhanced + Application Logging was enabled. +
+
+
PAN-260218
+ 		+
+ Fixed an issue where BGP Aggregate Advertise filters did not work as + expected when the summary option was enabled, and only summarized + routes were advertised. +
+
+
PAN-260131
+ 		+
+ Fixed an issue where the firewall consumed a large amount of memory + when forwarding raw logs. +
+
+
PAN-260114
+ 		+
+ Fixed an issue where the firewall generated a + devsrvr + core file when processes were restarted. +
+
+
PAN-260059
+ 		+
+ Fixed an issue where + Device Telemetry Regions did not + show up with the latest content due to content files not being parsed + for the region list when Telemetry was turned off. +
+
+
PAN-260003
+ 		+
+ Fixed an issue where commits failed when you set + Use Management interface for all and + MGMT was configured for + Data Services. +
+
+
PAN-259998
+ 		+
+ (M-600 Appliances only) Fixed an issue where + log collectors in a cluster stopped responding when running high load + tests. +
+
+
PAN-259865
+ 		+
+ (VM-Series firewalls across all public and private clouds) Fixed an issue where the firewall experienced high dataplane CPU + usage when SSL Decryption was enabled. +
+
+
PAN-259741
+ 		+
+ Fixed an issue where the firewall dropped GRE keepalive packets that + were encapsulated under another GRE tunnel. +
+
+
PAN-259610
+ 		+
+ Fixed an issue where Wildfire content installation failed for WF-500B + clusters when deployed from Panorama using the deployment schedule. +
+
+
PAN-259579
+ 		+
+ Fixed an issue where the URL Filtering settings on a firewall + displayed an override icon even when no settings were overridden. This + occurred due to the + hold-client-request field did not + have a default value and was set to + False. +
+
+
PAN-259370
+ 		+
+ Fixed an issue on the web interface where + Correlation Log Detail > Match Evidence + did not populate. +
+
+
PAN-259078
+ 		+
+ Fixed an issue where WildFire Analysis reports were not generated and + the following error message was displayed: + Error 500: Internal Server Error. +
+
+
PAN-259076
+ 		+
+ Fixed an issue where the firewall displayed an OCSP/CRL check failure + when accessing websites. +
+
+
PAN-258576
+ 		+
+ Fixed an issue on the Panorama web interface where products in HIP + objects were not displayed correctly. +
+
+
PAN-257960
+ 		+
+ Fixed an issue where ICD virtual memory continuously increased due to + an increase in unknown IP addresses, which resulted in high management + plane CPU utilization. +
+
+
PAN-257747
+ 		+
+ Fixed an issue where the firewall incorrectly displayed the error + message + IoT Security license is required for feature to function + even when the firewall had a valid Enterprise IoT security license. +
+
+
PAN-257660
+ 		+
+ Fixed an issue where show commands were hidden for superusers in + read-only roles. +
+
+
PAN-257619
+ 		+
+ Fixed an issue on Panorama where the + Task Manager took longer than + expected to display managed firewall report tasks. +
+
+
PAN-257563
+ 		+
+ Fixed an issue where the + logrcvr + component for SASE and MCW displayed incorrect zones in the traffic + flow. +
+
+
PAN-257362
+ 		+
+ Fixed an issue where GlobalProtect traffic destined for the internet + did not follow the path-based forwarding (PBF) rule and was sent out + the wrong interface. +
+
+
PAN-257195
+ 		+
+ (PA-5400 Series firewalls only) Fixed an issue + where the mp-monitor logs did not print disk SMART data. +
+
+
PAN-257183
+ 		+
+ Fixed an issue where the firewall dropped DNS traffic when using DNS + Security. +
+
+
PAN-257117
+ 		+
+ Fixed an issue where CSV or PDF exports of zones did not contain all + zones. +
+
+
PAN-257028
+ 		+
+ (Firewalls in active/passive HA configurations only) Fixed an issue where firewalls entered a non-functional state and + displayed the error message + Dataplane down: path monitor failure during the fail-over. +
+
+
PAN-256867
+ 		+
+ Fixed an issue where the + logrcvr + process stopped responding while processing session logs for + forwarding to the LFC. +
+
+
PAN-256670
+ 		+
+ Fixed an issue where scheduled email reports were sent without PDF + attachments if the firewall was in FIPS-CC mode. +
+
+
PAN-256652
+ 		+
+ Fixed an issue where content updates were processed incorrectly, which + caused a mismatch between a Threat ID's signature and its + corresponding action. +
+
+
PAN-256518
+ 		+
+ Fixed an issue where Panorama was unable to push firmware updates to a + VM-Series firewall with a PAYG license. +
+
+
PAN-256362
+ 		+
+ Fixed an issue in Panorama where shared address objects used in the + GlobalProtect configuration agents were not considered as used and not + pushed to Firewall that causes commit-all failure error +
+
+
PAN-256138
+ 		+
+ (VM-Series firewalls only) Fixed an issue where + firewalls with a DNS server IP address received by DHCP from Amazon + Web Services (AWS) had a delay in resolving FQDNs after a reboot. +
+
+
PAN-256077
+ 		+
+ Fixed an issue where the GlobalProtect client would disconnect + consistently due to keep-alive timeouts when using an SSL-only tunnel. +
+
+
PAN-256051
+ 		+
+ Fixed an issue on the firewall where enabling flow basic caused the + firewall to stop responding due to a + masterd + process restart. +
+
+
PAN-256048
+ 		+
+ Fixed an issue where GlobalProtect displayed incorrect source region + mapping in the Strata Logging Service. +
+
+
PAN-255915
+ 		+
+ Fixed an issue where a memory leak in the + sslmgr + process caused the firewall to restart. +
+
+
PAN-255860
+ 		+
+ (PA-5200 firewalls only) Fixed an issue where + the + all_pktproc + process stopped responding when the firewall was under a heavy traffic + load. +
+
+
PAN-255773
+ 		+
+ Fixed an issue where errors related to applications in + Content-preview caused commit + failures. +
+
+
PAN-255759
+ 		+
+ Fixed an issue where the firewall was unable to match HIP data with + the correct anti-malware object for Windows Defender. +
+
+
PAN-255619
+ 		+
+ Fixed an intermittent issue where file downloads from websites failed + when decrypting HTTP/2 traffic. +
+
+
PAN-255025
+ 		+
+ Fixed an issue where the + show session cache all CLI + command failed with the error message + Server error : An error occured. See dagger.log for + information. +
+
+
PAN-255020
+ 		+
+ Fixed an issue where the Panorama web interface did not display the + push scope data for custom admin users when performing a partial + commit and push. +
+
+
PAN-254901
+ 		+
+ Fixed an issue where GlobalProtect user-to-IP address mapping was + removed even though the tunnel for the specific user was up and + traffic was being passed. +
+
+
PAN-254612
+ 		+
+ Fixed an issue on Panorama where the device health summary for + firewalls showed 1/1 in the power + supply and fan columns instead of the actual number. +
+
+
PAN-254577
+ 		+
+ Fixed an issue where a core file was created on the Log Forwarding + Card due to a third-party software issue. +
+
+
PAN-254297
+ 		+
+ Fixed an issue where the + show pbf rule name <name> + CLI command failed. +
+
+
PAN-253965
+ 		+
+ Fixed an issue where modifying the IPSec lifesize setting was not + reflected when using Proxy-ID between two VM-Series firewalls. +
+
+
PAN-253963
+ 		+
+ (Panorama appliances in Panorama mode and Log Collector mode + only) Fixed an issue where autocommits took longer than expected to + complete. +
+
+
PAN-253819
+ 		+
+ Fixed an issue where a + User Activity Report was not + generated by Run Now or not emailed + through the Email Schedule when the + locale setting was not English. +
+
+
PAN-253626
+ 		+
+ Fixed an issue on Panorama where unused objects were pushed to the + firewall, which caused the push operations to intermittently fail. +
+
+
PAN-253485
+ 		+
+ (Firewalls in active/passive HA configurations only) Fixed an issue where dataplane packet capture filter configuration + failed on the active firewall with the error + op command for client dagger timed out as client is not + available. +
+
+
PAN-253437
+ 		+
+ Fixed an issue where the firewall did not display the + Intrazone-Default Security policy rule hit count in the web interface + when the rule was overridden by a Panorama configuration. +
+
+
PAN-252978
+ 		+
+ (PA-3200 Series firewalls only) Fixed an issue + where interfaces running at 10 Gbps did not display the speed and + duplex information in the CLI or displayed only as + auto. +
+
+
PAN-252816
+ 		+
+ Fixed an issue where multiple SSHD process restarts triggered a + firewall reboot when the login banner and SSH host keys were updated + at the same time. +
+
+
PAN-252336
+ 		+
+ Fixed an issue where newly added devices or existing deleted devices + on the primary Panorama appliance were not updated on the secondary + Panorama appliance if the secondary Panorama appliance experienced an + HA sync commit failure. +
+
+
PAN-252224
+ 		+
+ Fixed an issue where Panorama did not forward logs to a syslog server + over an SSL connection using CRL as a revocation verification method. +
+
+
PAN-251715
+ 		+
+ Fixed an issue where the firewall closed the SSL connection to the + user ID agent. +
+
+
PAN-251533
+ 		+
+ (PA-450 firewalls only) Fixed an issue on the + web interface where the DHCPv6 client was not available for VLAN + interfaces. +
+
+
PAN-251442
+ 		+
+ Fixed an issue where the firewall rebooted into maintenance mode if + the authentication process restarted repeatedly. +
+
+
PAN-251038
+ 		+
+ Fixed an issue where the selective push scope did not load the scope + details when performing a commit and push operation when launched + directly. +
+
+
PAN-250443
+ 		+
+ (VM-Series firewalls only) Fixed an issue where + multiple processes exited due to an OOM condition and caused a network + outage. +
+
+
PAN-250146
+ 		+
+ Fixed an issue on the web interface where templates incorrectly showed + that telemetry was enabled when it was not enabled. With this fix, the + telemetry setting is not displayed in the template on the web + interface. +
+
+
PAN-250082
+ 		+
+ Fixed an issue where the traffic filter query operator did not work + for sanctioned_state_of_app (Monitor > Logs > Traffic). +
+
+
PAN-249748
+ 		+
+ Fixed an issue where, when a dynamic address group with more than + 500,000 addresses was created, the firewall displayed the error + message + pan_cfg_addresses_from_xmlhash failed. +
+
+
PAN-249597
+ 		+
+ Fixed an issue where the Policy page + on the Panorama web interface was slower than expected when a device + group had a large number of managed devices. +
+
+
PAN-249581
+ 		+
+ Fixed an issue where stale BGP routes were advertised to peers even + when they were not present in the local RIB table. +
+
+
PAN-249194
+ 		+
+ Fixed an issue where SaaS quality profile probes were dropped on the + SD-WAN hub. +
+
+
PAN-249132
+ 		+
+ Fixed an issue on Panorama DG where the address group object created + with Disable Override property in + Parent DG was overridden by child DG via CLI. +
+
+
PAN-248945
+ 		+
+ Fixed an issue where commits failed when you committed a configuration + to advertise the default route (0.0.0.0/0) as a BGP network statement + (Advanced Routing > BGP settings). +
+
+
PAN-248748
+ 		+
+ Fixed an issue that caused the dataplane to stop responding when + running a packet diagnostic with Jumbo frames enabled. +
+
+
PAN-248390
+ 		+
+ (PA-5450 firewalls only) Fixed an issue on the + web interface where unused log interfaces were incorrectly displayed + on the dashboard as configured and down. +
+
+
PAN-248221
+ 		+
+ (PA-220 firewalls only) Fixed an issue where + the firewall returned dedicated HA1 and HA2 even when the firewall did + not have a dedicated HA port. +
+
+
PAN-247907
+ 		+
+ (Panorama Virtual Appliances only) Fixed an + issue where the root partition became full. +
+
+
PAN-247575
+ 		+
+ Fixed an issue where the error message + import of <issuecert> failed. Please check the validity of + the key pair and try again + for unmatched keys for EC certificates. +
+
+
PAN-247052
+ 		+
+ Fixed an intermittent issue where the OSPF ABR option was disabled + when a static route was added. +
+
+
PAN-246567
+ 		+
+ Fixed an issue where a firewall with a copper SFP transceiver + (PAN-SFP-CG) flapped during a commit. +
+
+
PAN-246304
+ 		+
+ Fixed an issue on Panorama where commits failed due to a timeout in + the + sysd + process during decryption. +
+
+
PAN-245683
+ 		+
+ Fixed an issue where committing a configuration change on a Panorama + managed firewall caused a short outage for GlobalProtect clients. +
+
+
PAN-244743
+ 		+
+ Fixed an issue where intermittent 500 errors occurred when making API + calls to the firewall. +
+
+
PAN-244035
+ 		+
+ (PA-5220 firewalls only) Fixed an issue on the + web interface where the displayed dataplane CPU usage was up to 20% + less than the correct CPU usage. +
+
+
PAN-243787
+ 		+
+ Fixed an issue where the CLI command + delete user-file ssh-known-hosts + did not remove the SSH host keys. +
+
+
PAN-243223
+ 		+
+ Fixed an issue where authentication to the GlobalProtect gateway + failed due to an invalid Satellite certificate. +
+
+
PAN-243190
+ 		+
+ Fixed an issue where the show commands for HSCI ports did not provide + information about optics and light levels. +
+
+
PAN-242960
+ 		+
+ Fixed an issue where the firewall did not honor the peer + Desired Minimum Tx Interval when in + a BFD INIT state. +
+
+
PAN-242957
+ 		+
+ Fixed an issue where the + Rule usage columns of overridden + default policy rules on the Security policy page stopped responding. +
+
+
PAN-242826
+ 		+
+ Fixed an issue with the REST API syntax when creating a DHCP server + configuration for an existing subinterface. +
+
+
PAN-242431
+ 		+
+ Fixed an issue where the BGP timer setting was in read-only mode for + custom admin users when Advanced Routing was enabled. +
+
+
PAN-241953
+ 		+
+ Fixed an issue where the firewall did not have a heartbeat mechanism + for the + authd + process, which caused the firewall to become unresponsive if the + authd + process stopped responding. +
+
+
PAN-241772
+ 		+
+ Fixed an issue where, when TLSv1.3 was used, an incorrect error + message invalid padding was + displayed instead of the expected error message + Invalid server certificate. +
+
+
PAN-241474
+ 		+
+ (PA-5200 Series firewalls only) Fixed an issue + where the firewall did not increment the flow_parse_ip_cksm counter + when traffic with an IP address checksum error was received. +
+
+
PAN-241126
+ 		+
+ Fixed an issue where the client IP address was incorrect in the + authentication logs for Captive Portal authentication events when the + client used IPv6. +
+
+
PAN-239470
+ 		+
+ Fixed an issue where the CLI command + device-telemetry reload-config-now + did not work as expected on firewall. +
+
+
PAN-239252
+ 		+
+ Fixed an issue where GlobalProtect connections failed with the error + message: + Disconnect(Lifetime expired) called + before the lifetime expired. +
+
+
PAN-238594
+ 		+
+ Fixed an issue where the firewall rebooted when a QSFP28 cable was + removed from the port while the port was passing traffic. +
+
+
PAN-238303
+ 		+
+ (PA-5220 firewalls only) Fixed an issue where + multicast streaming did not recover when multicast traffic was + offloaded. +
+
+
PAN-238266
+ 		+
+ Fixed an issue where the default + lag-flow-key-type was different + between the dataplane and the forwarding engine. +
+
+
PAN-238183
+ 		+
+ Fixed an issue where Panorama displayed deviating device system logs + for non-connected interfaces. +
+
+
PAN-237819
+ 		+
+ Fixed an issue where Panorama was unable to establish netstat + connectivity with the syslog server when the password for an HTTPS + server profile had more than 128 characters. +
+
+
PAN-237109
+ 		+
+ Fixed an issue where the application page was not launched directly + after the login page when only one application was configured. +
+
+
PAN-237010
+ 		+
+ Fixed an issue on Panorama where local commits took longer than + expected after an upgrade. +
+
+
PAN-235976
+ 		+
+ Fixed an issue where the LDAP server profile created was created with + an empty password. +
+
+
PAN-235808
+ 		+
+ (Panorama appliances in Log Collector mode only) Fixed an issue where an unnamed core file was generated after a + reboot. +
+
+
PAN-235733
+ 		+
+ Fixed an issue where the displayed NTP information was incorrect if + the DNS servers timed out. +
+
+
PAN-235475
+ 		+
+ Fixed an issue where firewall sinkhole functionality was disrupted + when a domain entry in an external dynamic list started with a period + (.) character. +
+
+
PAN-234272
+ 		+
+ Fixed an issue where scheduled device group reports included data from + other device groups. +
+
+
PAN-233868
+ 		+
+ Fixed an issue where the firewall took an incorrect action for + overlapping custom and edl-url-categories in a policy rule. +
+
+
PAN-233815
+ 		+
+ Fixed an issue where syslog-ng restarted after commits when multiple + syslog servers were configured. +
+
+
PAN-233647
+ 		+
+ Fixed an issue where Panorama management servers generated duplicate + configuration logs. +
+
+
PAN-233581
+ 		+
+ Fixed an issue on firewalls in active/active HA configurations where + SYN+ACK packets of asymmetric TCP sessions were dropped because of a + session synchronization issue. +
+
+
PAN-232594
+ 		+
+ (Panorama managed CN-Series firewalls in HA configurations only) Fixed an issue where an error occurred while adding tags. +
+
+
PAN-232268
+ 		+
+ Fixed an issue on the firewall where enabling the + SSL Decryption Opt-out caused all + SSL sessions to fail. +
+
+
PAN-230934
+ 		+
+ Fixed an issue where HTTPS, SSH, and PING were enabled on the AUX port + by default even when these administrative management services were not + enabled on the interface. +
+
+
PAN-228555
+ 		+
+ Fixed an issue where GlobalProtect logs returned no data when using + the filter + ( private_ip eq 0.0.0.0 ). +
+
+
PAN-227165
+ 		+
+ Fixed an issue where the + snmpd + process stopped responding due to a double free during data collection + on active sessions. +
+
+
PAN-225213
+ 		+
+ Fixed an issue where + Push All Changes displayed changes + that were already committed in the push scope for another device group + after performing a selective commit and selective push to the first + device group. +
+
+
PAN-224833
+ 		+
+ Fixed an issue where the firewall dropped DHCPv6 relay packets if + there were duplicate link-local addresses on different sub-interfaces. +
+
+
PAN-224272
+ 		+
+ (PA-7500 Series firewalls only) Fixed an issue + where the L3 subinterface was grayed out and displayed the status + ethernet1/12.1082: unknown. +
+
+
PAN-224152
+ 		+
+ Fixed an issue where device tags for devices in a child device group + were not available in the the parent shared device group. +
+
+
PAN-223172
+ 		+
+ Fixed an issue on Panorama where host IDs manually added to the device + quarantine list were unexpectedly removed. +
+
+
PAN-222542
+ 		+
+ (PA-7000 Series firewalls only) Fixed an issue + where Log Forward Cards (LFC) were incorrectly identified as + distribution policies, which caused packet loss due to traffic, BFD, + and other control packets being forwarded to the LFC. +
+
+
PAN-222307
+ 		+
+ (M-600 appliances only) Fixed an issue where + the + reportd + process stopped responding. +
+
+
PAN-221021
+ 		+
+ Fixed an issue where managed DLCs were out of sync after changing the + Panorama mode to Management Only mode. +
+
+
PAN-220619
+ 		+
+ Fixed an issue where the correct device filter did not apply when + filtering Targets and + Target/Tags (Device Group > Policies). +
+
+
PAN-220227
+ 		+
+ Fixed an issue where High Availability Path Monitoring did not work + with Advanced Routing Mode when the type was set to + Logical Router. +
+
+
PAN-216688
+ 		+
+ Fixed an issue where the configurations exported by a role-based admin + user via the web interface were not sanitized. +
+
+
PAN-212889
+ 		+
+ Fixed an issue on Panorama where different threat names were used when + querying a threat under + Threat Monitor (Monitor > App Scope) and the ACC. This resulted in the ACC displaying no data after + clicking a threat name in + Threat Monitor and filtering it in + the global filters. +
+
+
PAN-212735
+ 		+
+ Fixed an issue where sessions that were previously in sw-cut-through + mode (software fast forwarding) and persisted after an HA failover + were no longer subject to software fast forwarding, which led to + increased dataplane CPU load after HA failover. +
+
+
PAN-212182
+ 		+
+ Fixed an issue where TLS 1.3 connections failed if the server sent a + certificate request after sending its certificate. +
+
+
PAN-209844
+ 		+
+ Fixed an issue where the firewall logged duplicate events for + portal-gen-cookie, gateway-gen-cookie, and gateway-auth when the + authentication was successful. +
+
+
PAN-202095
+ 		+
+ Fixed an issue on the web interface where the language setting was not + retained. +
+
+
PAN-201548
+ 		+
+ Fixed an issue where the firewall did not provision host ID entries + when the number of open file descriptors (FDS) for redis_iotd reached + the maximum allowed value. +
+
+
PAN-180513
+ 		+
+ Fixed an issue where the Source Translation section of the NAT rule + did not provide an option to check the value for an object. +
+
diff --git a/reference/PAN-OS/addressed/10.2.15.html b/reference/PAN-OS/addressed/10.2.15.html new file mode 100644 index 0000000..ffab06e --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.15.html @@ -0,0 +1,613 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-288930
+ 		+
+ Fixed an issue where, when ACE was enabled, traffic from cloud + applications randomly matched an incorrect + cloud-apps policy rule. +
+
+
PAN-287765
+ 		+
+ Fixed an issue where SAML authentication failed, which caused the + GlobalProtect client to repeatedly attempted to reconnect. +
+
+
PAN-284116
+ 		+
+ Fixed an issue where mTLS decryption bypass did not work when the + decryption profile was configured with the maximum TLS version as TLS + 1.3. +
+
+
PAN-283813
+ 		+
+ Fixed an issue on Panorama where the web interface performance was + slower than usual when retrieving read-only configurations from + Panorama. +
+
+
PAN-283467
+ 		+
+ (PA-3400 Series firewalls only) Fixed an issue + where the firewall unexpectedly rebooted and entered maintenance mode + due to a ctd-agent out-of-memory (OOM) condition. This occurred during + advanced services load testing and a high volume of IoT EAL log + forwarding. +
+
+
PAN-283331
+ 		+
+ Fixed an issue where selective pushes to managed devices failed when + the User ID Master Device was + configured. +
+
+
PAN-282633
+ 		+
+ Fixed an issue where the interface statistic counters were reset, + which caused negative values to be reported. +
+
+
PAN-282607
+ 		+
+ Fixed an issue where the DHCP process stopped responding when the + firewall was configured as a DHCP relay agent. +
+
+
PAN-282394
+ 		+
+ Fixed an issue where a firewall was only able to display a maximum of + 14 permitted IP addresses from a Panorama Template Variable. +
+
+
PAN-282391
+ 		+
+ Fixed an issue on Panorama where a memory leak occurred after cloning + a template, resulting in an increase in memory use, which caused OOM + errors. +
+
+
PAN-282359
+ 		+
+ Fixed an issue where the Panorama web interface was slower than + expected. +
+
+
PAN-280698
+ 		+
+ Fixed an issue where the firewall removed the TCP timestamp from + client hello messages that did not fit in a single packet, which + resulted in connection issues. +
+
+
PAN-279495
+ 		+
+ Fixed an issue where accessing a URL from the browser returned the + error message + ERR_RESPONSE_HEADERS_TRUNCATED + when the firewall was configured with TLS 1.3. +
+
+
PAN-279400
+ 		+
+ Fixed an issue where, when + Restrict Certificate Extensions was + enabled on decryption profiles, the basic constraints extension was + overwritten incorrectly. +
+
+
PAN-279336
+ 		+
+ Fixed an issue where the CLI did not display a message to commit prior + changes before loading a partial configuration. +
+
+
PAN-278190
+ 		+
+ Fixed an issue on Panorama where a scheduled report with SLS data had + an invalid translated-query. +
+
+
PAN-278150
+ 		+
+ Fixed an issue where the firewall removed the Authentication Key + Identifier (AKID) from the certificate during SSL decryption, which + caused Python 3.13 to fail with a certificate verification error. +
+
+
PAN-277755
+ 		+
+ Fixed an issue that caused the + request system private-data-reset + CLI command to fail. +
+
+
PAN-277417
+ 		+
+ Fixed an memory leak issue related to TLS inbound decryption. +
+
+
PAN-276964
+ 		+
+ Fixed an issue where the + logrcvr + process stopped responding when the firewall was booted up. +
+
+
PAN-276678
+ 		+
+ Fixed an issue where Panorama became unresponsive while performing a + dynamic address update without a lock. +
+
+
PAN-274697
+ 		+
+ Fixed an issue where push operations from Panorama failed on passive + firewalls when an application was removed from a Security policy rule + and the policy rule was referenced in a device group. +
+
+
PAN-274569
+ 		+
+ Fixed an issue where the QSPF transceiver interface displayed an + incorrect range figure on the temperature alarm. +
+
+
PAN-274496
+ 		+
+ Fixed an issue where the root partition reached 100% which caused the + system to become non-functional and failover even when aggressive + cleaning was enabled. +
+
+
PAN-273141
+ 		+
+ Fixed an issue where GlobalProtect clients experienced slow file + transfer download throughput when passing through an IPSec tunnel. +
+
+
PAN-273008
+ 		+
+ (PA-5400 firewalls only) Fixed an issue where + frequent BGP/BFD flaps occurred and HA2 keep-alives went down. +
+
+
PAN-272812
+ 		+
+ Fixed an issue where SNMP monitoring of tunnel interfaces displayed + zero values for received bytes and packets. +
+
+
PAN-272505
+ 		+
+ Fixed an issue where GlobalProtect cookie authentication failed with + the error + User is not in allow list. +
+
+
PAN-269956
+ 		+
+ Fixed an issue where the + all_pktproc + process stopped responding, which caused internal path monitor + failures. +
+
+
PAN-269700
+ 		+
+ Fixed an issue where commits to service connection firewalls from + Panorama failed. +
+
+
PAN-268465
+ 		+
+ Fixed an issue with firewalls in active/passive HA configurations + where the total user count in the registered users was different + between the active and passive firewall. +
+
+
PAN-267580
+ 		+
+ Fixed an issue where an External Dynamic List (EDL) IP address in an + unsupported format was recognized as valid on the firewall. +
+
+
PAN-267444
+ 		+
+ Fixed an issue where large file downloads or uploads failed or + remained in an incomplete state when using DLP HTTP2 mirror mode. +
+
+
PAN-262372
+ 		+
+ Fixed an issue where the firewall generated the error message + Successfully generating a new set of config files + in the system logs even when device telemetry was not enabled. +
+
+
PAN-261429
+ 		+
+ Fixed an issue where the + show auth radius-require-msg-authentic + command CLI displayed no output. +
+
+
PAN-255914
+ 		+
+ (VM-Series firewalls on Amazon Web Services (AWS) environments + only) Fixed an issue where a newly bootstrapped firewall required a + management server restart, relicensing, or license push from Panorama + to invoke the device certificate. +
+
+
PAN-255547
+ 		+
+ Fixed an issue where commits failed when importing configurations to a + device with a non-default master key. +
+
+
PAN-252370
+ 		+
+ Fixed an issue where services with the reserved keyword + application-default were allowed. +
+
+
PAN-241295
+ 		+
+ Fixed an issue where Panorama pushed permitted IP address lists were + editable on the firewall. +
+
+
PAN-241230
+ 		+
+ Fixed an issue where the SNMP get request status value for Panorama + connections was incorrect. +
+
+
PAN-237294
+ 		+
+ Fixed an issue where the interface rate counter intermittently went to + zero frequently. +
+
+
PAN-236672
+ 		+
+ The automated commit recovery feature default iteration and timeout + values have changed. The default iteration value has changed from 1 to + 5 seconds, and the timeout value has changed from 10 to 30 seconds. +
+
+
PAN-215232
+ 		+
+ Fixed an issue on Panorama where the GlobalProtect app version was + displayed incorrectly in the + ACC tab. +
+
+
PAN-206158
+ 		+
+ Fixed an issue on the web interface where the + OK button was enabled when + Region > Address had an invalid + value. +
+
+
PAN-201298
+ 		+
+ Fixed an issue where unknown TCP traffic caused errors and high shared + memory usage. +
+
diff --git a/reference/PAN-OS/addressed/10.2.16-h10.html b/reference/PAN-OS/addressed/10.2.16-h10.html new file mode 100644 index 0000000..05823a5 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.16-h10.html @@ -0,0 +1,60 @@ + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
—
+ 		+
+ Fixes were made to address the following CVEs: + +
+
diff --git a/reference/PAN-OS/addressed/10.2.17.html b/reference/PAN-OS/addressed/10.2.17.html new file mode 100644 index 0000000..17b3330 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.17.html @@ -0,0 +1,3915 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-304021
+ 		+
+ Fixed an issue where PA-3420 firewalls experienced unexpected reboots + due to the + all_task_7 + process crashing with signal 6, leading to a non-functional state. +
+
+
PAN-301580
+ 		+
+ Fixed an issue where the CRL file was not updated as scheduled, + causing PAN-OS to treat the CRL as expired. This resulted in the + firewall displaying an + Unknown CRL + verification result, which could disconnect the firewall from Panorama + or impact other features that rely on CRL checks, such as SSL + decryption or GlobalProtect connections. +
+
+
PAN-300906
+ 		+
+ Fixed an issue where XML API commands failed with a + Method not found (policy_xml) + error in dagger.log. The issue was due to missing XML-related + functions for inline-cloud-proxy. +
+
+
PAN-299228
+ 		+
+ Fixed an issue where a session process consumed excessive CPU + resources, even when Data Loss Prevention (DLP) was not enabled. This + occurred due to the active threat list being iterated twice when + active threats were present in the session. +
+
+
PAN-298907
+ 		+
+ Fixed an issue on PA-VM in AWS where, in a two-arm deployment + integrated with Gateway Load Balancer (GWLB), the firewall did not + preserve the GENEVE source port for internet traffic, resulting in + increased latency. The fix ensures the firewall preserves the outer + UDP source port of GENEVE encapsulation when sending traffic back to + GWLB. +
+
+
PAN-298505
+ 		+
+ Fixed an issue where, after upgrading an HA pair of PA-7050 firewalls, + the vsys ID changed in sequence, causing autocommit failures with + validation errors. This occurred when the multi-vsys firewall had + virtual systems created and pushed from Panorama, and the vsys ID was + not in a correct sequence because the unused vsys was deleted from + Panorama and pushed to devices. +
+
+
PAN-297963
+ 		+
+ Fixed an issue where PA-400 Series firewalls were not properly caching + DNS responses for FQDN objects. The firewall was observed to + repeatedly send DNS requests for the same FQDN objects every 10-15 + seconds, even after receiving valid responses, despite the minimum + FQDN refresh interval being set to a much higher value. This resulted + in excessive DNS queries originating from the firewall's management + interface. +
+
+
PAN-297349
+ 		+
+ Fixed an issue where the MIB ID returned an incorrect value via SNMP. +
+
+
PAN-296635
+ 		+
+ Fixed an issue where the + reportd + process on passive Panorama management servers leaked memory due to + scheduled report handling from the Strata Logging Service (SLS). This + memory leak occurred daily, consuming available memory until the + process was restarted. +
+
+
PAN-296519
+ 		+
+ Fixed an issue where a stream receiving a reconnect signal with an + associated error in + Wifclient + caused the entire pool to close, which resulted in a complete + disconnection. +
+
+
PAN-296478
+ 		+
+ Fixed an issue where, after upgrading to PAN-OS 10.2.13-h10, + GlobalProtect Clientless VPN on PA-3250 firewalls failed to execute + JavaScript links, resulting in an authorization error. This occurred + because the firewall was incorrectly injecting text into URLs when + JavaScript buttons or dropdown menus were clicked within the + Clientless VPN portal. +
+
+
PAN-296452
+ 		+
+ Fixed an issue where, when Panorama managed Prisma Access, filtering + GlobalProtect logs by IPv6 subnets displayed all logs, including IPv4 + logs. +
+
+
PAN-295957
+ 		+
+ Fixed an issue where, after upgrading the firewall, the Direct + Internet Access (DIA) Any Path probing feature stopped functioning, + causing traffic to not failover to the hub when the local internet + connection failed. This issue affects branch firewalls in a + hub-and-spoke setup. +
+
+
PAN-295400
+ 		+
+ Fixed an issue where the CRL file was not updated as scheduled, + causing PAN-OS to treat the CRL as expired. This resulted in the + firewall displaying an + Unknown CRL + verification result, which could disconnect the firewall from Panorama + or impact other features that rely on CRL checks, such as SSL + decryption or GlobalProtect connections. +
+
+
PAN-295342
+ 		+
+ Fixed an issue where the + pan_comm + process stopped responding due to insufficient time allocated to read + file descriptors when processing long messages. +
+
+
PAN-294770
+ 		+
+ (Firewalls in active/passive HA configurations) + Fixed an issue on firewalls where, after failover, certain subnets + were missing from the Link State Database, which prevented OSPF routes + from being immediately learned due to a Type-7 to Type-5 LSA + translation conflict in the ABR when the same LSA was advertised by + two peers in the NSSA area. +
+
+
PAN-294488
+ 		+
+ Fixed an issue where certificate data was missing in decryption logs + for No decrypt policy rules and + TLS1.2 traffic after upgrading, and the + Subject Common Name, + Issuer Common Name, + Certificate Start Date, + Certificate End Date, + Certificate Serial Number, and + Certificate Fingerprint fields were + blank in the decryption logs. +
+
+
PAN-294115
+ 		+
+ Fixed an Issue where commits failed with the error + invalid IPv6 x:x - must be global/link-local unicast + when the management IPv6 address had a specific value. +
+
+
PAN-293879
+ 		+
+ Fixed an issue on the firewall where the VM monitor source remained in + the Getting All status, which + prevented dynamic address groups from updating IP addresses for new + EC2 instances. This issue occurred due to a race condition where two + threads that simultaneously retrieved IP address tag information from + AWS VM monitoring sources became stuck while reading the XML file. +
+
+
PAN-293848
+ 		+
+ Fixed an issue where Panorama failed to push the default value of + None for the secondary NTP server + address to managed firewalls, resulting in a commit validation error. + This occurred even when configuring the secondary NTP server address + as None in Panorama's web interface, + and affected both newly deployed and long-standing production + firewalls after upgrading. +
+
+
PAN-293707
+ 		+
+ Fixed an issue where the + iotd + process failed to install DPI Cloud server FQDN due to a configuration + parsing failure caused by the configuration XML memory buffer not + being NULL terminated. This resulted in the accumulation of EAL logs + and DLP forwarding being stopped. +
+
+
PAN-293673
+ 		+
+ Fixed an issue where the firewall stopped all tasks due to an OOM + condition caused by a scheduled log export using FTP to an external + FTP server. +
+
+
PAN-293511
+ 		+
+ Fixed an issue where renaming a BGP filtering profile in Panorama did + not update the corresponding BGP peer group in the virtual router, + leading to commit failures. +
+
+
PAN-292980
+ 		+
+ Fixed an issue on the web interface where the + Connected status for a User-ID agent + in a non-User-ID Hub vsys displayed as blank if the same agent was + also configured in a User-ID Hub vsys. +
+
+
PAN-292770
+ 		+
+ Fixed an issue where, after reinstalling the device certificate, + delayed telemetry data was displayed in AIOPS. +
+
+
PAN-292539
+ 		+
+ (CN-Series firewalls only) Fixed an issue where + the firewall generated incomplete or corrupted tech support files + (TSF) due to high disk usage on the management plane. +
+
+
PAN-292393
+ 		+
+ Fixed an issue where TFTP file transfers intermittently timed out in + active-active HA pairs when the TFTP control channel was processed by + one firewall and the data channel was processed by the other. This + occurred because the firewall receiving the data channel failed to + match the predicted session due to asynchronous processing of HA + messages. +
+
+
PAN-292344
+ 		+
+ Fixed an issue where, when upgrading from PAN-OS 10.2.9-h1 to PAN-OS + 10.2.13-h5, the firewall rebooted repeatedly and entered maintenance + mode. +
+
+
PAN-292202
+ 		+
+ Fixed an issue where the system logs repeatedly displayed the alert + Clearing snmpd.log due to log overflow + due to the SNMP counters rolling over. +
+
+
PAN-291973
+ 		+
+ Fixed an issue where the Advanced Routing Engine stopped responding + when a route-map was configured to match on a metric with a value of + 0. +
+
+
PAN-291945
+ 		+
+ Fixed an issue on PA-5220 firewalls where denied traffic logs + incorrectly displayed a byte count of 0. This occurred because the + bytes_sent value was stored in the most significant bits of + u_bytes_sent, resulting in a zero value when a small value was + assigned to u_bytes_sent. +
+
+
PAN-291824
+ 		+
+ Fixed an issue where the firewall_action was incorrectly set to '1' in + DNS Security request telemetry, causing a mismatch between the DNS + Security dashboard in AIOps and the threat logs on the firewall. This + resulted in inaccurate reporting of allowed DNS requests for Malware, + C2, Dynamic DNS, Parked, and Proxy categories in AIOps. +
+
+
PAN-291716
+ 		+
+ Fixed an issue where, during a commit, the firewall experienced an + out-of-memory (OOM) condition due to a memory leak and displayed an + error message. This issue caused the device to crash and reboot + unexpectedly. +
+
+
PAN-291631
+ 		+
+ (VM-Series firewalls only) Fixed an issue where + the firewall frequently rebooted. +
+
+
PAN-291593
+ 		+
+ (Firewalls in active/passive HA configurations only) Fixed an issue where, when the passive firewall was down and the + idmr + process was reset, the firewall generated the system log + User-ID manager was reset. Commit is not required to reinitialize + User-ID, even though the + idmr + process restart was not successful. +
+
+
PAN-291499
+ 		+
+ ( + VM-Series firewalls on Amazon Web Services (AWS) environments + only) Fixed an issue where newly deployed firewalls were unable to + connect to the Strata Logging Service (SLS) until after a reboot, + license fetch, or management server restart. +
+
+
PAN-291456
+ 		+
+ Fixed an issue where the custom completer for device groups and + templates received the device group name and template name from the + running configuration instead of the candidate configuration. +
+
+
PAN-291288
+ 		+
+ Fixed an issue where the firewall rebooted unexpectedly due to a + pan_task + process restart related to page allocation failures. +
+
+
PAN-291174
+ 		+
+ Fixed an issue where Real Time Streaming Protocol (RTSP) video streams + did not work when connected through GlobalProtect due to the firewall + blocking 200 OK responses. This occurred because of incorrect NAT + translations for the 200 OK message from the server. +
+
+
PAN-291124
+ 		+
+ (Firewalls with multi-vsys enabled only) Fixed + an issue where an XML API call to get the running Security policies + returned only the first Security policy. +
+
+
PAN-290996
+ 		+
+ Fixed an issue where SNMP walks returned a value of 0 for the CPS + (Connections Per Second) per vsys on firewalls after upgrading to + PAN-OS 11.1.6-h3, even when active connections were present. +
+
+
PAN-290803
+ 		+
+ (VM-Series firewalls on Microsoft Azure environments only) Fixed an issue where firewall failed to bootstrap with a custom + image, and VM-Series plugin information was not displayed in the + system information. +
+
+
PAN-290449
+ 		+
+ Fixed an issue where, when multiple scheduled vulnerability reports + were sent in the same email, only the first attached report was + displayed. +
+
+
PAN-290455
+ 		+
+ Fixed an issue where the + Pprof + path was missing in the + logrcvr + script, which prevented the conversion and decoding of addresses in + the resulting stack when running + Pprof + against + Logrcvr. +
+
+
PAN-290191
+ 		+
+ Fixed an issue where BGP learned routes were not advertised when + Legacy Routing was used and an + export policy was configured to match the next hop of the learned + route. +
+
+
PAN-290117
+ 		+
+ (Firewalls in active/passive HA configurations only) Fixed an issue with high dataplane CPU utilization on both active + and passive firewalls. +
+
+
PAN-290088
+ 		+
+ Fixed an issue where a memory leak occurred related to the + configd + process when pushing configurations from Panorama to a firewall. This + occurred when the configurations contained shared policy rules. +
+
+
PAN-290074
+ 		+
+ Fixed an issue where IPv6 URLs were incorrectly categorized as + private-ip-addresses even if the + URL had a valid category. This occurred because the firewall did not + check for IPv6 addresses when determining if an IP address was + private. +
+
+
PAN-289895
+ 		+
+ Fixed an issue where, when SSL decryption was enabled, traffic + matching a deny rule was incorrectly allowed until the SSL handshake + was complete. +
+
+
PAN-289763
+ 		+
+ (PA-5400f firewalls only) Fixed an issue where + SD-WAN SaaS monitoring did not work with URL monitoring. +
+
+
PAN-289714
+ 		+
+ (Prisma Access only) Fixed an issue where + persistent commit failures occurred due to a missing transformation + script when downgrading from PAN-OS 10.2.0 to PAN-OS 10.1.0. +
+
+
PAN-289706
+ 		+
+ Fixed an issue where the + authd + process crashed intermittently on VM-Series firewalls due to + authentication sequence failures. The crashes occurred during memory + management operations within a library while releasing memory to its + central cache. +
+
+
PAN-289573
+ 		+
+ Fixed an issue on Panorama where the web interface became unresponsive + when attempting to edit the + Allow traffic to specified FQDN when Enforce GlobalProtect + Connection for Network Access + setting in a GlobalProtect portal configuration after adding 40 or + more FQDN entries. +
+
+
PAN-289405
+ 		+
+ (VM-Series firewalls only) Added the CLI + command + no-refresh-discard-session to + address an issue where the discarded session time to live (TTL) did + not refresh at the default value. +
+
+
PAN-289320
+ 		+
+ Fixed an issue where External Dynamic List (EDL) entries for + predefined lists were not visible in Panorama when logged in with a + SuperUser Read-Only role. +
+
+
PAN-289301
+ 		+
+ Fixed an issue on the Panorama web interface where a template name or + device group name displayed invalid text. +
+
+
PAN-289268
+ 		+
+ Fixed an issue where internet access through Secure Web Gateway (SWG) + proxy nodes did not work when the default internet access policy rule + source user was not known-user. +
+
+
PAN-289239
+ 		+
+ Fixed an issue on Panorama where a new virtual system (vsys) was + automatically created with the name of a device group. +
+
+
PAN-289226
+ 		+
+ (Firewalls in HA active/passive configurations only) Fixed an issue where the firewalls experienced high dataplane CPU + use when NAT64 was enabled. This occurred due to NAT64 traffic not + being offloaded and unnecessary HA session updates being sent for + every NAT64 packet. +
+
+
PAN-288929
+ 		+
+ Fixed an issue where the + preferred_wnd value provided by + CTD (Content Threat Detection) was disregarded due to TCP bandwidth + estimation, which prevented the window from closing. +
+
+
PAN-288893
+ 		+
+ (Firewalls in multi-vsys configurations only) + Fixed an issue where HTTP/2 traffic failed due when one virtual system + (vsys) had a decryption policy rule enabled and another vsys had a + no-decrypt policy rule for the same session. +
+
+
PAN-288768
+ 		+
+ Fixed an issue where the PA-5450 firewall did not set the Restart Bit + (R-bit) in the BGP OPEN message when graceful restart was enabled. + This caused BGP sessions with Cisco Nexus devices to fail to restart, + which resulted in the TCP connection being closed. +
+
+
PAN-288731
+ 		+
+ Fixed an issue where the firewall incorrectly allowed traffic for + certain applications when no decryption policy rule was configured. +
+
+
PAN-288726
+ 		+
+ Fixed an issue where the + useridd + process stopped responding due to a Security policy rule ID being set + to 0, which caused the last configuration retrieval to fail. +
+
+
PAN-288598
+ 		+
+ Fixed an issue where Panorama exported the serial number of a managed + collector instead of the collector name when exporting a PDF or CSV + file. +
+
+
PAN-288432
+ 		+
+ Fixed an issue where, when Advanced Routing Engine was enabled + firewalls configured with multiple logical routers, static routes were + preferred over eBGP routes even though the static routes had a higher + administrative distance. +
+
+
PAN-288427
+ 		+
+ Fixed an issue on Panorama where commit jobs were not queued and the + system reported that the + useridd + was not connected. +
+
+
PAN-288363
+ 		+
+ Fixed an issue where the MIB ID returned an incorrect value via SNMP. +
+
+
PAN-288254
+ 		+
+ Fixed an issue where the dataplane CPU usage percentage was displayed + as lower than it was on the firewall web interface, SCM, and other + monitoring tools. +
+
+
PAN-288158
+ 		+
+ (VM-Series firewalls only) Fixed an issue where + the firewall became inaccessible via the web interface and SSH and + remained in an initializing state. +
+
+
PAN-287936
+ 		+
+ Fixed an issue where the Panorama web interface incorrectly displayed + the checkbox as enabled for SHA1. +
+
+
PAN-287921
+ 		+
+ (VM-Series firewalls only) Fixed an issue where + the maximum registered IP address for was incorrectly set to 100,000 + instead of the expected 500,000. +
+
+
PAN-287842
+ 		+
+ Fixed an issue where the + comm process stopped responding due + to missing heartbeats, which resulted in a system alert and HA + communication loss on slot1. +
+
+
PAN-287838
+ 		+
+ (Panorama appliances only) Fixed an issue on + the web interface where resetting the rule hit counter for multiple + policy rules failed with the error message + Failed to reset rule-hit job. +
+
+
PAN-287818
+ 		+
+ Fixed an issue where sessions timed out sooner than expected due to + the + pan_proxy_accumulation_restore_timeout + not initiating when the accumulation + session_init failed. +
+
+
PAN-287734
+ 		+
+ Fixed an issue where the error message + Scan ERR: Internal Err 1002 was + generated unexpectedly when WIF shared memory use was high. +
+
+
PAN-287601
+ 		+
+ Fixed an issue on Panorama where commits took longer than expected. +
+
+
PAN-287392
+ 		+
+ Fixed the issue on the web interface where + ACC graphs displayed + No data to display when a filter was + applied to Source IP or + Destination IP. +
+
+
PAN-287314
+ 		+
+ Fixed an issue with firewalls in active/passive HA configurations + where an OOM condition occurred and caused a failover due to a memory + leak associated with the + logrcvr + process. +
+
+
PAN-287154
+ 		+
+ Fixed an issue on the firewall where the + show advanced-routing bgp loc-rib-detail + CLI command incorrectly displayed + no BGP route" when multiple BGP + peers were enabled. With this fix, the CLI command requires a peer + name to be specified to display local RIB details. +
+
+
PAN-287086
+ 		+
+ Fixed an issue where PA-3420 firewalls experienced unexpected reboots + due to the + all_task_7 + process crashing with signal 6, leading to a non-functional state. +
+
+
PAN-287056
+ 		+
+ Fixed an issue where BGP export policy rules with next-hop matching + failed to block the advertisement of static routes, and the firewall + incorrectly matched the egress interface IP address instead of the + original next-hop IP address of the static route, which caused the + deny rule to fail. +
+
+
PAN-287035
+ 		+
+ Fixed an issue where, when an application stopped responding, a large + file was created in the /opt/panlogs directory, which caused the + partition to fill up. +
+
+
PAN-287034
+ 		+
+ Fixed an issue where sequence numbers were skipped for all types of + logs on the firewall due to audit logs being generated but not written + to disk when Audit Tracking was enabled. +
+
+
PAN-287023
+ 		+
+ Fixed an issue where a large number of logs caused the + logrcvr + process to stop responding. +
+
+
PAN-286922
+ 		+
+ Fixed an issue where user-to-IP address mappings were not available on + the dataplane for User-ID, which prevented the enforcement of + user-based Security policy rules. This was due to the firewall not + validating the timestamp of mappings received from certain User + Identification Agent (UIA) agents before adding them to the dataplane. +
+
+
PAN-286899
+ 		+
+ Fixed an issue where the + device-group-tags CLI command + used an unnecessary configuration read lock. +
+
+
PAN-286832
+ 		+
+ (VM-Series firewalls only AWS environments only) Fixed an issue where the firewall did not send + ICMP unreachable - Fragmentation Needed + message when it received packets larger than the MTU. +
+
+
PAN-286818
+ 		+
+ Fixed an issue where closing an SSH session to a Panorama using Ctrl+D + did not generate a log message in the system logs, and the session + remained in an idle state for 60 minutes before being automatically + terminated. +
+
+
PAN-286735
+ 		+
+ Fixed an issue where the firewall did not automatically enable the + telemetry feature. +
+
+
PAN-286734
+ 		+
+ (PA-5450 firewalls only) Added uplink counters + to enhance debug capability for traffic drops. +
+
+
PAN-286615
+ 		+
+ Fixed an issue where the firewall double-freed shared memory when the + shared memory usage reached 100% when sending large payloads. This + occurred when DLP, Advanced Advanced Threat Protection (ATP), Advanced + WildFire (AWF), or Advanced URL Filtering were enabled. +
+
+
PAN-286555
+ 		+
+ Fixed an issue where PA-VM-Flex firewalls bootstrapped in an + air-gapped environment did not display premium partner and threat + prevention licenses. +
+
+
PAN-286534
+ 		+
+ Fixed an issue where a multi-vsys firewall was unable to retrieve + address groups and address objects pushed from Panorama as shared + objects when using the REST API. +
+
+
PAN-286492
+ 		+
+ Fixed an issue on Panorama where logs were not forwarded to syslog + servers due to missing CLI options to configure the syslog queue size + and threads. +
+
+
PAN-286306
+ 		+
+ Fixed an issue where, when getting transceiver information from ESCC + for SFP 25G modules, the transceiver code was incorrectly updated with + Unknown instead of + 25GBase-SR. +
+
+
PAN-286299
+ 		+
+ Fixed an issue on firewalls running PAN-OS 11.1 releases where, after + being offboarded from Panorama, the firewall XML configuration file + retained template information from the previous Panorama + configuration. As a result, when the firewall and its configuration + were imported to another Panorama appliance, all configurations in the + Network and + Device tabs became read-only. +
+
+
PAN-286297
+ 		+
+ Fixed an issue where the firewall did not respond to ARP requests when + a subinterface was configured with source address translation using + the Translated Address option. +
+
+
PAN-286296
+ 		+
+ Fixed an issue where the Prisma Access gateway experienced process + restarts and system reboots. +
+
+
PAN-286231
+ 		+
+ Fixed an issue where a simultaneous selective push from Panorama to + multiple firewalls with different base configurations resulted in + configuration corruption, which caused the firewall to go down. +
+
+
PAN-286180
+ 		+
+ (Firewalls in HA configurations only) Fixed an + issue where, after a failover, an SSH decryption caused a mismatch in + the host key, which resulted in a warning message. This issue occurred + because the SSH tunnel keys were not synchronized between the active + and passive firewalls. +
+
+
PAN-286094
+ 		+
+ Fixed an issue where the firewall did not forward logs to SLS when + using a proxy server configuration due to an OCSP validation failure. +
+
+
PAN-285623
+ 		+
+ Fixed an issue where the + configd + process restarted and generated a core file during an HA sync commit + job. This occurred when the firewall was in the HA passive state. +
+
+
PAN-285298
+ 		+
+ Fixed an issue where the firewall became unresponsive when the + show user user-ids user all CLI + command was executed repeatedly on large scale LDAP group mappings, + and you were unable to connect to the gateways with the error message + The network connection is unreachable or the gateway is + unresponsive. Check the network connection and reconnect. +
+
+
PAN-285285
+ 		+
+ Fixed an issue where commits remained at 98% completion when static + route configuration cleanup was in progress. +
+
+
PAN-284968
+ 		+
+ Fixed an issue where the + dnsproxy + process stopped responding when enabling the AutoVPN feature from the + Software-Defined Cloud Management (SD-WAN) console. +
+
+
PAN-284907
+ 		+
+ Fixed an issue where the Panorama web interface displayed + No Data when viewing configuration + logs to see changes before and after a configuration change. +
+
+
PAN-284801
+ 		+
+ Fixed an issue where the OpenConfig plugin was automatically installed + on VM Panorama and firewalls after upgrading. +
+
+
PAN-284717
+ 		+
+ Fixed an issue where a PBF (Policy Based Forwarding) policy rule using + an AE (Aggregate Ethernet) interface configured with DHCP as the + egress interface incorrectly transitioned to an active state after a + commit operation, even when the DHCP lease had expired and the + interface had no assigned IP address. +
+
+
PAN-284380
+ 		+
+ Fixed an issue where committing a custom report in Panorama + incorrectly generated a pending push to devices. +
+
+
PAN-284184
+ 		+
+ (VM-Series firewalls with Advanced Routing Engine enabled only) Fixed an issue where where the + frr_ns2_bgpd + process repeatedly restarted after committing a configuration that + included the same route-map in both the exist and non-exist clauses of + a conditional advertisement or when the same route-map was used in + both the Advertise-out and conditional exist out map configurations. +
+
+
PAN-284117
+ 		+
+ (Panorama appliances in Log Collector mode only) Fixed an issue where the + vm_agent + process restarted after an upgrade. +
+
+
PAN-284090
+ 		+
+ Fixed an issue where GlobalProtect (GP) portal authentication for + satellites using RADIUS authentication failed due to the + authentication timeout value being set to 0. +
+
+
PAN-284073
+ 		+
+ Fixed an issue on the firewall that caused commits to fail and the web + interface to become inaccessible. +
+
+
PAN-284003
+ 		+
+ Fixed an issue where clients did not receive a valid response when + when searching a website due to a compression error. +
+
+
PAN-283864
+ 		+
+ Fixed an issue where DNS Security Category exceptions created with DNS + category UTID were not ignored. +
+
+
PAN-283644
+ 		+
+ (Prisma Access only) Fixed an issue where URL + log ingestion decreased after an upgrade, and secondary connections + were lost. +
+
+
PAN-283613
+ 		+
+ Fixed an issue on the web interface where the + IP Tag + Quota(%) value displayed as 2 even + when changed. +
+
+
PAN-283333
+ 		+
+ Fixed an issue where threat logs displayed logs from the + N/A threat category when a random + string was used for the + category-of-threatid filter in + threat logs. +
+
+
PAN-283316
+ 		+
+ Fixed an issue where a software download job reported a completion + timestamp that occurred before the software loading process was + finished. +
+
+
PAN-283304
+ 		+
+ Fixed an issue where the OSPFv3 area nssa + default-information-originate CLI + command was not applied due to a configuration error in the backend + advanced-routing stack. +
+
+
PAN-283206
+ 		+
+ Fixed an issue where configuring an HTTP profile to send Webhook + alerts to Microsoft Teams failed with a 400 Bad request error when + clicking Send Test Log . +
+
+
PAN-282961
+ 		+
+ Fixed an issue where the firewall rebooted unexpectedly after a commit + due to a memory leak related to the + rasmgr + process and displayed the error message + Management server failed to send phase 1 to client l2ctrld before rebooting. +
+
+
PAN-282578
+ 		+
+ Fixed an issue where ping commands from both the management plane and + dataplane interfaces incorrectly prioritized IPv6 addresses over IPv4 + addresses, even when IPv6 was disabled. This caused connectivity + issues when pinging FQDNs that resolved to IPv6 addresses. +
+
+
PAN-282571
+ 		+
+ Fixed an issue where the Border Gateway Protocol (BGP) established + time was displayed inaccurately due to a 32-bit counter wrapping + issue. +
+
+
PAN-282554
+ 		+
+ Fixed an issue where GlobalProtect clients on macOS devices failed to + connect when device name used newline character. +
+
+
PAN-282533
+ 		+
+ Fixed an issue where firewalls in air-gapped environments attempted to + connect to a Google IP address for Machine Learning AV (MLAV) + functionality, even when MLAV was not licensed or configured. +
+
+
PAN-282277
+ 		+
+ Fixed an issue where an OOM condition on the + logrcvr + process caused interface flapping, and the interface unexpectedly went + down and then recovered without intervention. +
+
+
PAN-281882
+ 		+
+ Fixed an issue where OSPF redistributed connected routes beyond the + intended loopback IP address. +
+
+
PAN-281725
+ 		+
+ Fixed an issue where, after upgrading to a higher version of PAN-OS + 10.2, the + devsrvr + process crashed during autocommit on both PA-Series and VM-Series + firewalls. This occurred specifically when parsing an SSL/TLS service + profile for a captive portal that was missing the + max-version configuration, + leading to a null pointer dereference. The firewall would attempt four + autocommits, all of which would fail with a + Client device registered in the middle of a commit/validate + error before the + devsrvr + process crashed and the firewall rebooted into maintenance mode. +
+
+
PAN-281681
+ 		+
+ Fixed a rare issue where the + logrcvr + process stopped responding, which caused the + devsrvr + process to restart. +
+
+
PAN-281540
+ 		+
+ Fixed an issue where the + logd + process repeatedly restarted when the SD-WAN site name was over 31 + characters and contained certain XML escape characters. +
+
+
PAN-281509
+ 		+
+ (Panorama appliances only) Fixed an issue where + log exports were slower than expected or failed when filtering logs + after an upgrade, which resulted in timeouts or delays in displaying + logs on the web interface. +
+
+
PAN-281488
+ 		+
+ Fixed an issue where searching configuration logs for an + audit_uuid did not return a + result if the rule was created with a clone operation. +
+
+
PAN-281294
+ 		+
+ Fixed an issue where, after an + authd + process restart, the username, password, and source IP address + displayed in plain text on the console when attempting to log in via + the web interface. +
+
+
PAN-281269
+ 		+
+ (PA-5420 firewalls) Fixed an issue where the + firewall management server memory usage continuously increased. +
+
+
PAN-281264
+ 		+
+ Fixed an issue where the + routed + process memory usage continuously increased when Advanced Routing was + enabled. +
+
+
PAN-281198
+ 		+
+ Fixed an issue on Panorama managed firewalls where, when the service + route configuration was set to VLAN as the source, attempting to + import the variable CSV into the template resulted in the validation + error + Failed to parse variable configuration file. This issue occurred because the system incorrectly validated the + VLAN interface name in the service route configuration within the + template. +
+
+
PAN-281017
+ 		+
+ Fixed an issue where shared objects were displayed in the + Push Scope after pushing the + configuration from Panorama to managed firewalls. +
+
+
PAN-280725
+ 		+
+ Fixed an issue where + all_pktproc + process repeatedly restarted, which caused dataplane failure and loss + of connectivity, including PAN-DB URL resolution. This occurred after + a commit push from Panorama and resulted in the firewall becoming + non-functional due to internal path monitoring failure and + configuration memory exhaustion. +
+
+
PAN-280700
+ 		+
+ Fixed an Issue where commits failed with the error + invalid IPv6 x:x - must be global/link-local unicast + when the management IPv6 address had a specific value. +
+
+
PAN-280695
+ 		+
+ Fixed an issue where all data interfaces went down due to a Forward + Error Correction (FEC) mode mismatch. The firewall defaulted to FEC + Auto mode, while the peer Cisco switch was configured for FC-FEC. +
+
+
PAN-280536
+ 		+
+ Fixed an issue where firewalls that were connected to the same Cloud + Identity Engine displayed inconsistent group membership information, + with some firewalls showing only a subset of users belonging to a + group. +
+
+
PAN-280013
+ 		+
+ Fixed an issue where User-ID custom reports were unable to exclude IP + address 0.0.0.0 when using the filter + ip notin 0.0.0.0. +
+
+
PAN-279901
+ 		+
+ An issue was fixed where the firewall dropped fragmented TLS + ClientHello packets, which blocked access to certain websites. This + occurred because the packets arrived truncated, in varying sizes and + orders, and the firewall's heuristics failed to handle them correctly. +
+
+ To enable this fix, run: + debug dataplane set ssl-decrypt accumulate-client-hello disjoined + yes +
+
+
PAN-279647
+ 		+
+ Fixed an issue where threat names were displayed differently on the + web interface and the exported CSV file. +
+
+
PAN-279584
+ 		+
+ Fixed an issue where, during software deployment from Panorama to + multiple firewalls, some firewalls did not automatically reboot after + the upgrade, even when + Reboot device after install was + selected. This was due to the Panorama timing out before the software + deployment completed on the affected firewalls, which prevented the + reboot request from being sent. +
+
+
PAN-279500
+ 		+
+ Fixed an issue where TLS connections failed to establish in asymmetric + routing environments if the firewall did not see server-to-client + (s2c) packets of the TLS handshake. +
+
+ To use this fix, run the following CLI command: + debug dataplane set ssl-decrypt accumulate-client-hello + asym-disable yes. +
+
+
PAN-279195
+ 		+
+ Fixed an issue on Panorama where + Device Health displayed the device + memory as 0%. +
+
+
PAN-279191
+ 		+
+ Fixed an issue where a GlobalProtect gateway stopped responding when + handling HTTP/1.1 traffic with web inspection enabled. +
+
+
PAN-278981
+ 		+
+ Fixed an issue where DNS domain resolutions experienced intermittent + delays due to the firewall not connecting to the DNS Security cloud. +
+
+ To use this fix, enable DNS monitoring on the dataplane via the CLI + command + debug dnsproxyd enable-rtsig-health-monitor yes. +
+
+ To show the current setting, run the CLI command + debug dnsproxyd enable-rtsig-health-monitor show. If the + cfg.general.dns-rtsig-monitor-interval + shows a non-zero value, DNS monitoring is enabled. +
+
+
PAN-278812
+ 		+
+ Fixed an issue where authentication to GlobalProtect failed with the + error message + User not in allowed list. +
+
+
PAN-278288
+ 		+
+ Fixed an issue where IPv6 BGP peering established between virtual + routers even without dataplane connectivity. This occurred because the + firewall used the kernel for lookups instead of the dataplane. +
+
+
PAN-277987
+ 		+
+ (VM-Series firewalls in AWS environments only) + Fixed an issue where HA failover mode incorrectly changed from + interface move to + secondary IP move after a reboot. +
+
+
PAN-277971
+ 		+
+ Fixed an issue where the PA-5220 firewall reports inaccurate NetFlow + statistics for DNS flows after upgrading to PAN-OS 10.2.13. +
+
+
PAN-277629
+ 		+
+ Fixed an issue where the firewall did not match the correct policy for + SSL forward decrypted HTTP/2 traffic when upgrading from PAN-OS + 10.2.9-h1 to PAN-OS 11.2.3. +
+
+
PAN-277162
+ 		+
+ Fixed an issue where random characters were added to the + proxy_authorization in HTTP + messages when the firewall accessed certain services through a + configured proxy server. This caused proxy server authentication to + intermittently fail. +
+
+
PAN-277135
+ 		+
+ Fixed an issue where the firewall stopped responding when a DNS client + closed or reset a TCP connection while the firewall was sending a + response. +
+
+
PAN-277086
+ 		+
+ Fixed an issue where the CLI output in JSON format displayed incorrect + bracket patterns. +
+
+
PAN-277034
+ 		+
+ Fixed an issue where WildFire reports were not fully displayed and + were not downloadable due to static resources not being found. +
+
+
PAN-277018
+ 		+
+ Fixed an issue where FTP data connections did not work for EPRT with + Source IP + Port translation enabled on the firewall. +
+
+
PAN-276961
+ 		+
+ Fixed an issue where adding an SD-WAN interface profile to an + overridden interface on a template stack failed with an + sdwan-interface-profile is invalid + error. +
+
+
PAN-276936
+ 		+
+ Fixed an issue where the CLI command syntax was incorrect when + configuring the + deviceconfig values from the + Template Stack. +
+
+
PAN-276862
+ 		+
+ Fixed an issue on Panorama where the + logd + process stopped responding unexpectedly. +
+
+
PAN-276607
+ 		+
+ Fixed an issue where GlobalProtect users experienced DNS resolution + timeouts when using Prisma Access. +
+
+
PAN-276484
+ 		+
+ Fixed an issue where Panorama did not display license information for + Cloud NGFW firewalls under (Device Deployment > Licenses) due to the inability to perform batch-license refreshes. +
+
+
PAN-276276
+ 		+
+ (PA-450 firewalls only) Fixed an issue where, + after an upgrade, data that was excluded using the query builder in a + custom report was still visible in the report, and the logs displayed + errors related to invalid threat names being queried. +
+
+
PAN-276000
+ 		+
+ (Firewalls in HA configurations only) Fixed an + issue where the + confgid + process and + mgmtsrvr + process restarted daily when processing a + show rule-hit-count CLI command + when retrieving Security policy rules for vsys1. +
+
+
PAN-275272
+ 		+
+ Fixed an issue where a dataplane restart was not triggered as expected + when internal packet path monitoring failure occurred. +
+
+
PAN-275026
+ 		+
+ Fixed an issue where you were unable to to adjust the frequency of the + Advanced Cloud Explorer (ACE) cloud fetch via the CLI. +
+
+
PAN-274207
+ 		+
+ Fixed an issue where Global Search did not redirect correctly to + routing profiles when searching for their names. +
+
+
PAN-274086
+ 		+
+ Fixed an issue where the firewall incorrectly assembled SIP NOTIFY and + REFER messages when processing SIP TCP packets that contained a + partial content-body from a previous SIP message and a complete header + and content-body from the next SIP message. +
+
+
PAN-274064
+ 		+
+ Fixed an issue on Panorama where the + request batch license info CLI + command displayed entries for devices that were no longer attached to + Panorama. +
+
+
PAN-274038
+ 		+
+ Fixed an issue where you were unable to use the + s_encrypted field in custom reports + for the Panorama threat log database. +
+
+
PAN-273991
+ 		+
+ Fixed an issue where the transmit power for a cable that was used on + port 44 displayed as N/A. +
+
+
PAN-273028
+ 		+
+ Fixed an issue where manual SCP exports from firewalls in FIPS mode + were successful to SCP servers that were not FIPS-compliant. This + occurred because the manual SCP process did not enforce FIPS security + checks. +
+
+
PAN-273010
+ 		+
+ Fixed an issue where the configuration version did not increment in + the Audit Comment Archive after making changes to the Security policy + rule with an audit comment and performing a commit. As a result, all + subsequent changes were grouped under the same configuration version, + which prevented the comparison of changes in the + Rule Changes field of the Security + policy rule. +
+
+
PAN-272731
+ 		+
+ Fixed an issue on Panorama where commits took longer than expected due + to the + show object dynamic-address-group all + CLI command holding the devicetable lock for an extended period. +
+
+
PAN-272539
+ 		+
+ (Panorama appliances on Microsoft Azure environments only) Fixed an issue where user to IP address mapping was missing for + some users connected to specific Prisma Access gateways, which caused + the collection layer Azure firewall to not form the mapping. +
+
+
PAN-272245
+ 		+
+ Fixed an issue where the + dnsproxy + process crashed due to memory corruption caused by a race condition + when the allow list downloading was impacted by config change. +
+
+
PAN-271637
+ 		+
+ Fixed an issue where the firewall did not increase the metric of the + default route when redistributed into OSPF when the firewall was + configured as an NSSA ABR. +
+
+
PAN-271560
+ 		+
+ Fixed an issue where DNS requests to malware sites were not blocked as + expected, and the + dns-security-categories log-level + and action displayed default values instead of + unavailable. +
+
+
PAN-271498
+ 		+
+ (PA-7000 Series firewalls, PA-5200 firewalls, and PA-5400f firewalls + in FIPS mode only) Fixed an issue where decrypted traffic repeatedly failed and + frequent reboots were required. +
+
+
PAN-271440
+ 		+
+ Fixed an issue where + PublicCloud Server certificate validation failed. Dest Addr: + (null), Reason: self signed certificate in certificate chain + generated as a high alert in the system log every 5 minutes. +
+
+
PAN-271412
+ 		+
+ Fixed an issue where the character ( + ) in the authentication message + prompt displayed incorrectly as + #43; on the GlobalProtect client + after upgrading to a PAN-OS 10.2 release. +
+
+
PAN-271345
+ 		+
+ Fixed an issue where the byte size reported in traffic logs differed + from the byte size reported in Enhanced Application Logs (EAL) logs. +
+
+
PAN-271204
+ 		+
+ Fixed an issue where performing a factory reset caused the firewall to + enter a continuous boot loop due to a failure in generating the + global.xml configuration file. +
+
+
PAN-271181
+ 		+
+ Fixed an issue where committing changes to Advanced Routing and + redistribution profiles failed while pushing the configuration from + SCM. +
+
+
PAN-271151
+ 		+
+ Fixed an issue where the GlobalProtect client did not automatically + initiate a Kerberos SSO connection after logging in to Windows. +
+
+
PAN-270744
+ 		+
+ Fixed an issue where API calls to Panorama failed with the error + Server error : Timed out while getting config lock. Please try + again. +
+
+
PAN-269843
+ 		+
+ Fixed an issue where the firewall dropped non-SYN TCP packets even + when the Reject non-SYN TCP option + was set to No when a session rematch + was triggered. +
+
+
PAN-269812
+ 		+
+ Fixed an issue where the + devsrvr + process stopped responding, which caused the firewall to restart + repeatedly. +
+
+
PAN-269445
+ 		+
+ Fixed an issue where the + show user ip-user-mapping all option detail + XML API command did not show the complete output. +
+
+
PAN-269342
+ 		+
+ Fixed an issue where BGP aggregate routes with the AS-SET option + enabled had incorrect AS paths. +
+
+
PAN-269191
+ 		+
+ (VM-Series firewalls only) Fixed an issue where + the aggressive clean-up threshold for disk space was set to 95% in + system monitor. +
+
+
PAN-269176
+ 		+
+ Fixed an issue where the + domain-edl column was empty in the + threat log even when a threat was detected as a DNS alert. +
+
+
PAN-269155
+ 		+
+ Fixed an issue where an OOM condition occurred, which caused processes + to stop responding. +
+
+
PAN-269057
+ 		+
+ Fixed an issue where the + routed + process stopped responding due to accessing freed memory from a hash + table when the route vectors were resized. This occurred when a large + number of static routes were configured. +
+
+
PAN-269051
+ 		+
+ Fixed an issue where, when using WildFire Private Cloud, the system + log displayed the error message + tls-X509-validation. +
+
+
PAN-268787
+ 		+
+ Fixed an issue where users were unable to log in to Panorama and the + following error message was displayed: + Timed out while getting config lock. Please try again. This occurred when pushing configurations to a large number of + devices. +
+
+
PAN-268425
+ 		+
+ Fixed an issue where the + execute show transceiver-detail all + XML API command returned an incorrect value for the low temperature + alarm threshold. +
+
+
PAN-267614
+ 		+
+ Fixed an issue where the Panorama web interface was slower than + expected due to high CPU utilization on the + mongodb + process. +
+
+
PAN-267450
+ 		+
+ Fixed an issue where the + reportd + process stopped responding with a SIGSEGV at + schedule_report_es_response. +
+
+
PAN-267330
+ 		+
+ Fixed an issue where the firewall dropped inbount RTP traffic after + using Webex Screen Sharing due to the firewall removing the NAT cache + when the predict timed out, which caused a new NAT to be established + that conflicted with existing sessions. To use this fix, run the CLI + command + set system setting ctd h323_rtp_predict timeout + <120-3600> + to increase the timeout limit. +
+
+
PAN-266776
+ 		+
+ Fixed an issue where virtual machine interfaces displayed + unknown for speed and duplex in the + CLI and web interface. +
+
+
PAN-266569
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where + the + useridd + process repeatedly restarted. +
+
+
PAN-266116
+ 		+
+ Fixed an issue where URLs did not work due to certificate revocation + list (CRL) requests failing. +
+
+
PAN-265140
+ 		+
+ (PA-7000B Series firewalls with NPCs only) + Fixed an issue where the gearbox on the NPC took multiple retries to + get the NIF link up. +
+
+
PAN-264982
+ 		+
+ (VM-Series firewalls on Kernel-based Virtual Machine (KVM) only) Fixed an issue where the firewall entered maintenance mode after an + auto-commit when sending an ARP packet through the loopback interface + using an IPv6 address. +
+
+
PAN-264725
+ 		+
+ Fixed an issue where Auto Quarantine did not work when simplified + logging was enabled. +
+
+
PAN-264131
+ 		+
+ Fixed an issue where the + routed + process core failed the automation run. +
+
+
PAN-263691
+ 		+
+ Fixed an issue where the firewall rebooted unexpectedly due to a + memory leak in the + all_task + process. +
+
+
PAN-263504
+ 		+
+ Fixed an issue where exporting managed device information from + Panorama in CSV format included extraneous characters. +
+
+
PAN-262373
+ 		+
+ Fixed an issue where the error message + Failed to reload config files + displayed in the system logs even when device telemetry was not + enabled. +
+
+
PAN-260790
+ 		+
+ Fixed an issue where the bytes transmitted and packet transmitted + counters for hardware interfaces incorrectly displayed as 0 after a + restart of slot-1. +
+
+
PAN-260661
+ 		+
+ Fixed an issue where daily email reports generated from the custom + report did not display the report details in PDF or CSV files. +
+
+
PAN-260186
+ 		+
+ Fixed an issue where Panorama pushed content to devices that did not + have a Threat Prevention license. +
+
+
PAN-259343
+ 		+
+ Fixed an issue on the Panorama web interface where the + Configuration tab did not accurately + display changes made to URL filtering profiles. +
+
+
PAN-259284
+ 		+
+ Fixed an issue where IPv4 BGP routes were not included in the routing + table or FIB of a virtual router when ECMP was configured with more + than two next hops. +
+
+
PAN-257616
+ 		+
+ Fixed an issue where selective push operations from Panorama to + managed firewalls failed with the error message + Failed to generate selective push configuration. Schema validation + failed. Please try a full push. +
+
+
PAN-257074
+ 		+
+ Fixed an issue on the Panorama web interface where the template sync + status showed Out-of-Sync for + managed devices after a combined commit-all operation. This occurred + due to Panorama sending the default MD5 sum of the template to the + firewall instead of the correct MD5 sum. +
+
+
PAN-255790
+ 		+
+ Enabled crash kernel to capture the PAN-OS state when a kernel panic + occurred. +
+
+
PAN-254904
+ 		+
+ Fixed an issue on Panorama where a core file was generated by + /usr/local/bin/logd during a restart. +
+
+
PAN-252706
+ 		+
+ Fixed an issue where the URL filtering response page for + Continue and + Override did not work with IPv6 + Router Advertisement (RA) or Multicast Listener Query (MLQ) for + IPv6-to-IPv6 and IPv6-to-IPv4 traffic. +
+
+
PAN-252699
+ 		+
+ Fixed an issue where frequent session failures occurred due to CTD + resource exhaustion. +
+
+
PAN-246945
+ 		+
+ Fixed an issue where a static route was removed from the route table + when path monitoring was enabled. +
+
+
PAN-245064
+ 		+
+ (Multi-vsys firewalls only) Fixed an issue + where commits failed on the firewall after selecting + Export or push device config bundle + on Panorama and a force push was required. +
+
+
PAN-244901
+ 		+
+ Fixed an issue where multi-download operations failed. +
+
+
PAN-244628
+ 		+
+ (Panorama virtual appliances in Microsoft Azure environments + only) Fixed an issue where where, when a VM-Series firewall was + registered to Panorama, the Panorama server failed to re-attempt + pushing Dynamic Address Groups updates to the firewall if the initial + push failed due to a temporary disconnection, which resulted in + blocked traffic. +
+
+
PAN-243773
+ 		+
+ Fixed an issue where the DHCP server stopped responding with the error + IP address is already in use. +
+
+
PAN-242602
+ 		+
+ Fixed an issue where GlobalProtect clients experienced slow SMB-V3 + download throughput when passing through a Prisma IPSec tunnel and the + firewall and the SMB-V3 session owner dataplane was the same as the + IPSec-ESP tunnel on the multi-dataplane firewall. +
+
+
PAN-241887
+ 		+
+ Fixed an issue where log usernames were truncated, which caused users + to be identified improperly on predefined SaaS reports. +
+
+
PAN-241536
+ 		+
+ Fixed an issue on Panorama where admin users with the Custom Panorama + Admin role were unable to add, edit, or delete route filters under + Routing Profiles +
+
+
PAN-239012
+ 		+
+ Fixed an issue where deleting a route entry from Advanced Routing + using the gRPC API could unintentionally delete other routes. Running + multiple attempts with broad XPATH queries could potentially match and + delete unintended route records. +
+
+
PAN-232802
+ 		+
+ Fixed an issue where the + all_task + process repeatedly restarted, which caused dataplane restarts on + traffic disruption. +
+
+
PAN-231386
+ 		+
+ Fixed an issue where the + configd + process stopped responding during certificate verification. +
+
+
PAN-222938
+ 		+
+ Fixed an issue where no default route was installed on the firewall + because a static IPv6 default gateway was specified on the management + interface with a dynamic IPv6 address. +
+
+
PAN-221137
+ 		+
+ Fixed an issue where the CLI command to set the target virtual system + accepted a non-existent virtual system name, and the CLI prompt + incorrectly changed to the non-existent virtual system. +
+
+
PAN-220293
+ 		+
+ Fixed an issue where the firewall management plane could not display + BGP peer details when using the CLI command + show advanced-routing bgp peer detail logical-router + <LR>. This was due to the + bgp_frr.py script failing to + parse the IPv6 address family section of the + show ip bgp neighbors json + output. +
+
+
PAN-210828
+ 		+
+ Fixed an issue where using XML API to create Security policy rules + with an incorrectly set parameter caused the firewall + dha + and + devsrvr + processes to stop responding. +
+
+
PAN-210501
+ 		+
+ Fixed an issue where hardware interface counters read from the CPU did + not incrementing for member interfaces after a Link Aggregation + Control Protocol (LACP) bundle was formed in an aggregate ethernet + interface. +
+
+
PAN-202905
+ 		+
+ Fixed an issue on the firewall web interface where the + Next Hop value was not displayed in + the static route configuration, the + admin-dist values were empty, and + the path-monitor parameters were not listed in the management server + web interface when the firewall was configured in FRR mode. +
+
+
PAN-191026
+ 		+
+ Fixed an issue where the + debug log receiver statistics CLI + command did not display entries for hipmatch logs. +
+
+
PAN-174038
+ 		+
+ Fixed an issue with firewalls with SD-WAN policy rules and + GlobalProtect gateway configurations where enabling GlobalProtect on a + loopback interface caused an issue where IPSec tunnel traffic from the + gateway to the client dropped intermittently. +
+
diff --git a/reference/PAN-OS/addressed/10.2.18-h10.html b/reference/PAN-OS/addressed/10.2.18-h10.html new file mode 100644 index 0000000..49c67be --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.18-h10.html @@ -0,0 +1,82 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
—
+ 		+
+ Fixes were made to address the following CVEs: + +
+
PAN-321937
 +
+ Fixed an issue where an expired SD-WAN license caused SD-WAN tunnels + to become unavailable, which resulted in traffic interruptions. With + this fix, the device provides logs and commit messages about expired + licenses. +
+
PAN-294001
 + Fixed an issue where Panorama®-managed firewalls logged + Failed in get_pwchange_required error + messages in the authd logs when locally + defined administrators authenticated. +
diff --git a/reference/PAN-OS/addressed/10.2.8-h10.html b/reference/PAN-OS/addressed/10.2.8-h10.html new file mode 100644 index 0000000..f17d57d --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.8-h10.html @@ -0,0 +1,501 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-263226
+ 		+
+ Fixed an issue where decryption based traffic failed on Explicit Proxy + nodes. +
+
+
PAN-261917
+ 		+
+ Fixed an issue where websites with a no-decrypt policy rule were + decrypted in traffic logs when using a Google Chrome browser with PQC + enabled. +
+
+
PAN-257624
+ 		+
+ Fixed an issue where the firewall web interface was blank after + logging in. +
+
+
PAN-256738
+ 		+
+ (VM-Series firewalls in HA configurations only) + Fixed an issue where BGP routes from the active firewall were lost + when the passive firewall was rebooted. +
+
+
PAN-255868
+ 		+
+ (PA-3400 Series firewalls only) Fixed an issue + where the firewall entered maintenance mode after enabling kernel data + collection during the silent reboot. +
+
+
PAN-254826
+ 		+
+ Fixed an issue where the firewall stopped responding when processing + traffic. +
+
+
PAN-254524
+ 		+
+ Fixed an issue on Panorama where, when the + Commit and Push button was clicked + during a selective + Commit and Push operation, the + window stopped responding, which caused the operation to be delayed. +
+
+
+ PAN-253584 +
+ 		+
+ Fixed an issue fixed where a process unexpectedly stopped due to a + memory mapping in an incorrect location. +
+
+
PAN-253546
+ 		+
+ Fixed an issue where a TLS client hello was split into multiple + packets and arrived out of order, so the packets were dropped and the + session terminated. +
+
+
PAN-251047
+ 		+
+ Fixed an issue where the + useridd + process logs were flooded with an error message related to service + profiles. +
+
+
PAN-250686
+ 		+
+ Fixed an issue where selective push operations did not work when more + than one admin user simultaneously performed changes and partial + commits on Panorama. +
+
+
PAN-250083
+ 		+
+ Fixed an issue on firewalls in HA configurations where packets were + dropped over HA3 HSCI due to the default MRU being incorrect. +
+
+
PAN-250062
+ 		+
+ Fixed an issue where device telemetry failed after upgrading due to + bundle generation failure. +
+
+
PAN-249814
+ 		+
+ Fixed an issue where multiple + all_task + processes stopped responding, which caused the dataplane to fail. +
+
+
PAN-249292
+ 		+
+ (VM-Series firewalls on Microsoft Azure environments only) Fixed an issue where CPU usage was higher than expected after a + hotplug event when Accelerated Networking was enabled for the + management interface. +
+
+
PAN-248975
+ 		+
+ Fixed an issue on the Panorama web interface where no content was + displayed after logging in. +
+
+
PAN-247496
+ 		+
+ Fixed an issue where the + snmpd + process stopped responding. +
+
+
PAN-247099
+ 		+
+ Fixed an issue where the firewall decrypted traffic unexpectedly when + the client hello was spread across multiple packets. +
+
+
PAN-246772
+ 		+
+ Fixed an issue on the firewall where the dataplane went down due to a + path monitor failure caused by an out-of-memory (OOM) condition + related to the + pan_task + process. +
+
+
PAN-246431
+ 		+
+ Fixed an issue where a + Push to Device operation remained at + the state None when performing a + selective push to device groups and templates that included both + connected and disconnected firewalls. +
+
+
PAN-244907
+ 		+
+ (PA-3400, PA-5400, and PA-1400 Series firewalls only) Fixed an issue where virtual wire ports did not go down when moving + from an active state to a suspended state. +
+
+
PAN-244746
+ 		+
+ Fixed an issue where changes committed on Panorama were not reflected + on the firewall after a successful push. +
+
+
PAN-243814
+ 		+
+ Fixed an issue related to continuous interface flapping. +
+
+
PAN-243333
+ 		+
+ Fixed an issue where selective push operations failed with the + following error message + SelPush:Base config is invalid! invalid configuration. Schema + verification failed. This occurred when a policy rule was moved from the post-rule base + to the pre-rule base. +
+
+
PAN-243240
+ 		+
+ Fixed an issue where the using QoS caused packet buffer utilization to + increase exponentially and the + PKI POOL DFLT pool depleted until + a reboot was performed. +
+
+
PAN-241022
+ 		+
+ Fixed an issue where rib-out routes were not displayed due to the next + hop of BGP local routes not getting matched with export filters. +
+
+
PAN-241018
+ 		+
+ (VM-Series firewalls in Microsoft Azure environments only) Fixed a Dataplane Development Kit (DPDK) issue where interfaces + remained in a link-down stage after an Azure hot plug event. +
+
+
PAN-239256
+ 		+
+ Fixed an issue where ARP entries were unable to be completed for + subinterfaces with SNAT configured. +
+
+
PAN-224195
+ 		+
+ Fixed an issue where Authentication Portal redirects failed with a 500 + Internal error when the Authentication Portal token was disabled. +
+
+
PAN-223418
+ 		+
+ Fixed an issue where heartbeats to the + brdagent + process were lost and the process stopped responding, which caused the + firewall to reboot. +
+
+
PAN-217198
+ 		+
+ Fixed an issue where Security policy rules did not display values for + FQDN. +
+
+
PAN-214177
+ 		+
+ Fixed an issue where template configurations were not properly pushed + to the firewall during an export or push of the device configuration + bundle. +
+
+
PAN-164885
+ 		+
+ Fixed an issue on Panorama where + Commit and Push or + Push to Devices operations failed + when an external dynamic list was configured to check for updates + every 5 minutes due to the commit and external dynamic fetch processes + overlapping. +
+
diff --git a/reference/PAN-OS/addressed/10.2.8-h13.html b/reference/PAN-OS/addressed/10.2.8-h13.html new file mode 100644 index 0000000..85fa864 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.8-h13.html @@ -0,0 +1,355 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-264883
+ 		+
+ (PA-7080 appliances with LPCs only) Fixed an + issue where syslog forwarding over TCP stopped after upgrading. +
+
+
PAN-262946
+ 		+
+ Fixed an issue on the firewall where logging in via the CLI or web + interface did not work due to increased memory usage. +
+
+
PAN-262340
+ 		+
+ Fixed an issue where FQDN resolution failed for address objects, and + all FQDN traffic was denied by the interzone-default policy rule. +
+
+
PAN-262287
+ 		+
+ Fixed an issue where dereferencing a NULL pointer that occurred caused + pan_task + processes to stop responding. +
+
+
PAN-261484
+ 		+
+ Fixed an issue on the firewall where DPDK allocated twice the amount + of memory as requested for pre-allocation. +
+
+
PAN-259727
+ 		+
+ (Panorama appliances in HA configurations only) + Fixed an issue where Panorama became unresponsive and displayed a 504 + gateway timeout error when accessing the web interface or the CLI. +
+
+
PAN-257736
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where + traffic to benign applications was was impacted by holding TCP + sequential segments for MLC inspection and not releasing the full + chain after a benign verdict was received. +
+
+
PAN-257462
+ 		+
+ Fixed an issue related to the + varrcvr + process where the management plane CPU was higher than expected. +
+
+
PAN-255509
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where + BFD sessions flapped intermittently. +
+
+
PAN-253829
+ 		+
+ Fixed an issue where the CLI command + show running security-policy + timed out when the Security policy was large. +
+
+
PAN-252270
+ 		+
+ Fixed an issue on the firewall where changes were incorrectly applied + after a reboot or a restart of the + configd + process. +
+
+
PAN-252036
+ 		+
+ Fixed an issue where, when the GlobalProtect portal was not + configured, accessing the GlobalProtect gateway still loaded a portal + malformed page. +
+
+
PAN-250787
+ 		+
+ Fixed an issue where network issues between the firewall and the log + collector caused + logrcvr + process memory exhaustion. +
+
+
PAN-246708
+ 		+
+ Fixed an issue where the firewall stopped responding when the + all_pktproc + repeatedly restarted. +
+
+
PAN-242910
+ 		+
+ Fixed an issue where a custom based non Superuser was unable to push + to firewalls. +
+
+
PAN-241044
+ 		+
+ Fixed an issue where traffic was denied by the interzone-default + policy rule when a Security policy rule with an FQDN destination was + configured. +
+
+
PAN-240066
+ 		+
+ Fixed a duplicate MAC address issue where an ethernet interface sent + out Gratuitous ARP (GARP) messages for an IP address that was not + configured on it. +
+
+
PAN-240001
+ 		+
+ Fixed an issue where the + pan_task + process restarted due to + configd + and + devsrvr + process memory requirements. +
+
+
PAN-239354
+ 		+
+ Fixed an issue where DNS resolution was delayed when an Antispyware + policy rule was applied to both client to firewall and firewall to + internal DNS server legs of a connection. +
+
+
PAN-226361
+ 		+
+ Fixed an issue where sessions bypassed L7 inspection or ended + unexpectedly with the error + resources unavailable when the + firewall incorrectly interpreted the Content and Threat Detection + (CTD) global packet queue as being full. +
+
diff --git a/reference/PAN-OS/addressed/10.2.8-h15.html b/reference/PAN-OS/addressed/10.2.8-h15.html new file mode 100644 index 0000000..571f87d --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.8-h15.html @@ -0,0 +1,184 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-272809
+ 		+
+ A fix was made to address + CVE-2024-0012 + (PAN-SA-2024-0015) and + CVE-2024-9474. +
+
+
PAN-268823
+ 		+
+ Fixed an issue where + MonitorLog Display + did not display all logs when you applied a filter. +
+
+
PAN-262287
+ 		+
+ Fixed an issue where dereferencing a NULL pointer that occurred caused + pan_task + processes to stop responding. +
+
+
PAN-244894
+ 		+
+ Fixed an issue where turning off + mprelay + logging caused + mprelay + heartbeat failure. +
+
+
PAN-244227
+ 		+
+ Fixed an issue where inconsistent FIB entries across the dataplane + were not detected. +
+
+
PAN-238610
+ 		+
+ Fixed an issue with the Panorama Virtual Appliance where, after the + mgmtsrvr + restarted on the passive appliance, stale IP address tags were pushed + to the connected firewalls with the message + clear all registered ip addresses. +
+
+
PAN-226361
+ 		+
+ Fixed an issue where sessions bypassed L7 inspection or ended + unexpectedly with the error + resources unavailable when the + firewall incorrectly interpreted the Content and Threat Detection + (CTD) global packet queue as being full. +
+
diff --git a/reference/PAN-OS/addressed/10.2.8-h18.html b/reference/PAN-OS/addressed/10.2.8-h18.html new file mode 100644 index 0000000..aa65704 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.8-h18.html @@ -0,0 +1,316 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-273215
+ 		+
+ Fixed an issue where a syntax error in the index generation script + caused a high management plane CPU load after upgrading. +
+
+
PAN-272809
+ 		+
+ A fix was made to address + CVE-2024-0012 + (PAN-SA-2024-0015) and + CVE-2024-9474. +
+
+
PAN-269624
+ 		+
+ Fixed an issue where GlobalProtect clients failed to connect with the + error message + The device or feature requires a GlobalProtect subscription + license. +
+
+
PAN-268909
+ 		+
+ Fixed an issue where IP address tags were removed from firewalls after + a management server or + useridd + process restart. This occurred when a Panorama serial-number based + configuration was used for User-ID redistribution. +
+
+
PAN-264249
+ 		+
+ Fixed an issue on the firewall where SNMP queries timed out when using + SNMP. +
+
+
PAN-263973
+ 		+
+ Fixed an issue where log collectors had a low incoming log rate. +
+
+
PAN-261673
+ 		+
+ (VM-Series firewalls on Microsoft Azure environments only) Fixed an issue where, when Accelerated Networking was enabled, + traffic was dropped because of the + flow_parse_ip_hdr counter related + to an Nvidia driver issue. +
+
+
PAN-257601
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where + Networking Cards (NC) experienced an internal link fault which caused + path monitoring failure on the Dataplane Processing Card (DPC). +
+
+
PAN-252974
+ 		+
+ (PA-450 firewalls only) Fixed an issue where + specific routes were not advertised when BGP Aggregate was configured + with the advertise filter. +
+
+
PAN-246699
+ 		+
+ Fixed an issue on Panorama where + Rule Usage and + Apps Seen under Security policy + rules stopped incrementing. +
+
+
PAN-246420
+ 		+
+ (PA-5450 Series firewalls only) Fixed an issue + where the firewall rebooted unexpectedly during an upgrade. +
+
+
PAN-244950 and PAN-221352
+ 		+
+ A fix was made to address + CVE-2024-2550. +
+
+
PAN-240251
+ 		+
+ Fixed an issue where the + vldmgr + process incorrectly restarted during an Elasticsearch restart. +
+
+
PAN-230825
+ 		+
+ Fixed an issue where link flaps occurred on Panorama appliances in + high availability (HA) configurations. +
+
+
PAN-228515
+ 		+
+ Fixed an issue where the Elasticsearch cluster health status displayed + as yellow or red due to Elasticsearch SSH tunnel flaps. +
+
+
PAN-222579
+ 		+
+ Fixed an issue where the + useridd + and + distd + process restarted, which resulted in missing mappings. +
+
+
PAN-216941
+ 		+
+ (Panorama appliances in Log Collector mode only) Fixed an issue where Panorama stopped processing and saving logs. +
+
diff --git a/reference/PAN-OS/addressed/10.2.8-h19.html b/reference/PAN-OS/addressed/10.2.8-h19.html new file mode 100644 index 0000000..0b0f4b5 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.8-h19.html @@ -0,0 +1,41 @@ + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-259351
+ 		+
+ A fix was made to address + CVE-2024-3393. +
+
diff --git a/reference/PAN-OS/addressed/10.2.8-h3.html b/reference/PAN-OS/addressed/10.2.8-h3.html new file mode 100644 index 0000000..fbf13b0 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.8-h3.html @@ -0,0 +1,41 @@ + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-252214
+ 		+
+ A fix was made to address + CVE-2024-3400. +
+
diff --git a/reference/PAN-OS/addressed/10.2.8-h4.html b/reference/PAN-OS/addressed/10.2.8-h4.html new file mode 100644 index 0000000..d30e0f9 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.8-h4.html @@ -0,0 +1,219 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-253317
+ 		+
+ (VM-Series firewalls on Microsoft Azure environments only) Fixed an issue where you were unable to log in to the firewall + after a private data reset. +
+
+
PAN-251895
+ 		+
+ Fixed an issue where enabling Inline Cloud Analysis features caused a + slow packet buffer leak, which resulted in performance issues and + dropped traffic. +
+
+
PAN-251563
+ 		+
+ Added CPLD enhancement to capture external power issues. +
+
+
PAN-251013
+ 		+
+ Fixed an issue on the web interface where the + Virtual Router and + Virtual System + configurations for the template incorrectly showed as + none. +
+
+
PAN-250020
+ 		+
+ Fixed an issue where MLC2 verdict retrieval failed due to a regression + in loopback data flag handling. +
+
+
PAN-248105
+ 		+
+ Fixed an issue where the GlobalProtect SSL VPN tunnel immediately + disconnected due to a keep-alive timeout. +
+
+
PAN-246976
+ 		+
+ Fixed an issue with unbalanced NAT session distribution with + multi-dataplane firewalls when persistent-dipp was enabled. +
+
+
PAN-244648
+ 		+
+ Fixed an issue where, when FIPS was enabled in maintenance mode, the + firewall rebooted and returned to maintenance mode. +
+
+
PAN-244622
+ 		+
+ Fixed an issue where FIB re-push did not work with Advanced Routing + enabled. +
+
+
PAN-244548
+ 		+
+ Fixed an issue where ECMP sessions changed destination MAC addresses + mid-session, which caused connections to be reset. +
+
+
PAN-242309
+ 		+
+ Fixed an issue where a higher byte count (s2c) was observed for + DNS-Base application. +
+
+
PAN-240612
+ 		+
Fixed a kernel panic caused by a third-party issue
+
+
PAN-240308
+ 		+
+ Fixed an issue where ElasticSearch did not work as expected when + raid-mounts were not fully ready after a reboot. +
+
+
PAN-236133
+ 		+
+ Fixed an issue where SSL traffic was impacted when + SSL Command and Control detector or + Incline Cloud Analysis was set to + reset-both, + reset-client, + reset-server, or + drop. +
+
+
PAN-225394
+ 		+
+ Fixed an issue on the firewall where SNMP incorrectly reported high + packet descriptor usage. +
+
+
PAN-203981
+ 		+
+ Fixed an issue where usernames with only numeric characters were not + valid. +
+
diff --git a/reference/PAN-OS/addressed/10.2.8.html b/reference/PAN-OS/addressed/10.2.8.html new file mode 100644 index 0000000..af8768e --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.8.html @@ -0,0 +1,2791 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
—
+ 		+
+ A fix was made to address + CVE-2026-0301. +
+
+
PAN-240596
+ 		+
+ Fixed an issue where + all_task + stopped responding due to an invalid memory address. +
+
+
PAN-242561
+ 		+
+ Fixed an issue where GlobalProtect tunnels disconnected shortly after + being established when SSL was used as the transfer protocol. +
+
+
PAN-240197
+ 		+
+ Fixed an issue where configuration changes made in Panorama and pushed + to the firewall weren’t reflected on the firewall. +
+
+
PAN-240174
+ 		+
+ Fixed an issue where, when LSVPN serial numbers and IP address + authentication were enabled, IPv6 address ranges and complete IPv6 + addresses that were manually added to the IP address allow or exclude + list were not usable after a restart of the + gp_broker + process or the firewall. +
+
+
PAN-239241
+ 		+
+ Extended the root certificate for WildFire appliances to December 31, + 2032. +
+
+
PAN-239144
+ 		+
+ Fixed an issue where the web interface was slower than expected when + logging in, committing, and pushing changes after upgrading to PAN-OS + 10.2.7. +
+
+
PAN-237876
+ 		+
+ Extended the firewall Panorama root CA certificate which was + previously set to expire on April 7th, 2024. +
+
+
PAN-237871
+ 		+
+ (WF-500 appliances and PAN-DB private cloud deployments only) Fixed an issue where the + root-cert was set to expire on + December 31, 2023. With this fix, the expiration date has been + extended. +
+
+
PAN-237454
+ 		+
+ Fixed an issue where Panorama stopped redistributing IP + address-to-username mappings when packet loss occurred between the + distributor and the client. +
+
+
PAN-236244
+ 		+
+ Fixed an issue where you were unable to select authentication profiles + via the web interface. +
+
+
PAN-236233
+ 		+
+ Fixed an issue where SNMP reports displayed incorrect values for SSL + Proxy sessions and SSL Proxy utilization. +
+
+
PAN-235741
+ 		+
+ Fixed an issue where DNS resolution failed for Panorama and firewall + plugins if the DNS Server IP address was obtained through DHCP. +
+
+
PAN-235737
+ 		+
+ Fixed an issue where the + brdagent + process stopped responding due to a sudden increase in logging to the + bcm.log. +
+
+
PAN-235628
+ 		+
+ Fixed an issue where you weren’t prompted for login credentials when + you disconnected and connected back to the GlobalProtect portal when + SAML authentication was selected along with single sign-on (SSO) and + Single Log Out (SLO). +
+
+
PAN-235557
+ 		+
+ Fixed an issue where uploads from tunnels, including GlobalProtect, + were slower than expected when the inner and outer sessions were on + different dataplanes. +
+
+
PAN-234852
+ 		+
+ Fixed an issue where DLP logs for the Salesforce application had a + report ID of 0 and did not include missing information such as file + type, file hash, and the reason for data filtering. +
+
+
PAN-234279
+ 		+
+ Fixed an issue where the + ikemgr + process crashed due to an IKEv1 timing issue, which caused commits to + fail with the following error message: + Client ikemgr requesting last config in the middle of a + commit/validate, aborting current commit. +
+
+
PAN-233954
+ 		+
+ Fixed an issue where the firewall was unable to retrieve correct + groups from the LDAP server. +
+
+
PAN-233207
+ 		+
+ Fixed an issue where the + configd + process stopped responding when a partial configuration revert + operation was performed. +
+
+
PAN-233191
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where + the Data Processing Card (DPC) restarted due to path monitor failure + after QSFP28 disconnected from the Network Processing Card (NPC). +
+
+
PAN-232377
+ 		+
+ Fixed an issue where the + AddrObjRefresh job failed when + the + useridd + process restarted. +
+
+
PAN-232358
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where + the interface on QSFP28 ports did not go down when the Tx cable was + removed from the QSFP28 module. +
+
+
PAN-232250
+ 		+
+ Fixed an issue where, when SSH service profiles for management access + was set to None, the reported output + was incorrect. +
+
+
PAN-231771
+ 		+
+ Fixed an issue where the firewall issued /box/getserv/ requests with + PAN-OS 7.1.0 and did not take device certificates. +
+
+
PAN-231698
+ 		+
+ Fixed an issue where you were unable to set the Dynamic Updates + schedule threshold to an empty value. +
+
+
PAN-231658
+ 		+
+ Fixed an issue where DNS resolution failed when interfaces were + configured as DHCP and a DNS server was provided via DHCP while also + statically configured with DNS servers. +
+
+
PAN-231552
+ 		+
+ Fixed an issue where traffic returning from a third-party Security + chain was dropped. +
+
+
PAN-231459
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where a + large number of invalid source MAC addresses were shown in drop-stage + packet captures. +
+
+
PAN-231422
+ 		+
+ Fixed an issue where you were unable to configure more than 256 + scheduled objects on the firewall. +
+
+
PAN-231329
+ 		+
+ Fixed an issue where the + logrcvr + process stopped responding due to a corrupt log in the forwarding + pipeline. +
+
+
PAN-230813
+ 		+
+ Fixed an issue where flex memory leak caused decryption failure and + commit failure with the error message + Error preparing global objects failed to handle + CONFIG_UPDATE_START. +
+
+
PAN-230656
+ 		+
+ (Firewalls in HA configurations only) Fixed an + issue where a split brain condition occurred on both firewalls after + booting up any firewall, and an HA switchover occurred after booting + up a firewall with a higher HA priority even when no preemptive option + was enabled on the firewall. +
+
+
PAN-230377
+ 		+
+ Fixed an issue where FEC support was not enabled by default for + PAN-SFP28-25GBASE-LR modules. +
+
+
PAN-230362
+ 		+
+ Fixed an issue where the firewall truncated the payload of a TCP Out + of Order segment with a FIN flag. +
+
+
PAN-230359
+ 		+
+ Fixed an issue where SAML authentication failed with the error message + Failed to verify signature against certificate + when ds:KeyName was in the IdP + metadata. +
+
+
PAN-230106
+ 		+
+ Fixed an issue where the firewall was unable to retrieve the most + current external dynamic list information from the server due to + hostname resolution failure. +
+
+
PAN-230092
+ 		+
+ Fixed an issue where the + routed + process stopped responding when committing routing-related changes if + Advanced Routing was enabled. +
+
+
PAN-230039
+ 		+
+ Fixed an issue where migrating from an Enterprise License Agreement + (ELA) to a Flexible VM-Series License failed with a deactivation error + message. +
+
+
PAN-229952
+ 		+
+ Fixed an issue where the the + print PDF option did not work (Panorama > Managed Devices > Health). +
+
+
PAN-229315
+ 		+
+ Fixed an issue where Octets in NetFlow records were always reported to + be 0 despite having a non-zero packet count. +
+
+
PAN-229307
+ 		+
+ Fixed an issue where half closed SSL decryption sessions stayed + active, which caused software packet buffer depletion. +
+
+
PAN-229080
+ 		+
+ Fixed an issue where the new management IP address on the interface + did not take effect. +
+
+
PAN-229069
+ 		+
+ Fixed an issue where clientless VPN portal users were unable to access + clientless applications due to an SSL renegotiation being triggered. +
+
+
PAN-228820
+ 		+
+ A CLI command was added to address an issue where long-lived sessions + aged out even when there was ongoing traffic. +
+
+
PAN-228442
+ 		+
+ Fixed an issue on firewalls in active/passive HA configurations where + sessions did not fail over from the active firewall to the passive + firewall when upgrading PAN-OS. +
+
+
PAN-228342
+ 		+
+ Fixed an issue where objects in the running configuration appeared to + be deleted under the push scope preview. +
+
+
PAN-228323
+ 		+
+ Fixed an issue where a large number of Panorama management server + cookies were created in the Redis database when the Cloud-Service + plugin sent an authentication request every second, and logging in to + or using Panorama was slower than expected. +
+
+
PAN-228277
+ 		+
+ Fixed an issue where commits took longer than expected. +
+
+
PAN-228273
+ 		+
+ (Panorama appliances in FIPS-CC mode only) + Fixed an issue where the Elasticsearch cluster did not come up, and + the + show log-collector-es-cluster health + CLI command displayed the status as red. This caused log ingestion + issues for Panorama appliances in Panorama mode or Log Collector mode. +
+
+
PAN-227804
+ 		+
+ Fixed an issue where memory corruption caused the + comm + process to stop responding. +
+
+
PAN-227774
+ 		+
+ Fixed an issue where commits failed with the error message + Management server failed to send phase 1 to client logrcvr. +
+
+
PAN-227641
+ 		+
+ Fixed an issue where + Preview Changes and + Change Summary when saving changes + did not open a new window when clicked. +
+
+
PAN-227522
+ 		+
+ Fixed an issue where + shared application filters that had + application object overrides were overwritten by predefined + applications. +
+
+
PAN-227397
+ 		+
+ Fixed an issue where selective pushes on Panorama removed a previously + pushed configuration from the firewalls. +
+
+
PAN-227233
+ 		+
+ Fixed an issue where the combination signature aggregation criteria in + a Vulnerability Protection profile was incorrectly blank even though a + value was set. +
+
+
PAN-227058
+ 		+
+ Fixed an issue where traffic did not match Security policy rules with + the destination as FQDN and instead hit the default deny rule. +
+
+
PAN-226935
+ 		+
+ Fixed an issue where autocommits failed due to duplicate application + name entries. +
+
+
PAN-226860
+ 		+
+ Fixed an issue where macOS X-Auth clients disconnected prematurely + from the GlobalProtect gateway during a Phase 2 re-key event. +
+
+
PAN-226768
+ 		+
+ Fixed an issue where, when the GlobalProtect app was installed on iOS + endpoints and the gateway was configured to accept cookies, the app + remained in the Connecting stage + after authentication, and the GlobalProtect log displayed the error + message `User is not in allow list`. This occurred when the app was + restarted or when the app attempted to reconnect after disconnection. +
+
+
PAN-226769
+ 		+
+ Fixed an issue where ElasticSearch used more memory than expected. +
+
+
PAN-226489
+ 		+
+ Fixed an issue where Panorama was unable to push scheduled Dynamic + Updates to firewalls with the error message + Failed to add deploy job. Too many (30) deploy jobs pending for + device. +
+
+
PAN-226418
+ 		+
+ A CLI command was added to address an issue where long-lived sessions + aged out even when there was ongoing traffic. +
+
+
PAN-226260
+ 		+
+ Fixed an issue where support for CBC ciphers with some authentication + algorithms was only available in FIPS mode. +
+
+
PAN-225920
+ 		+
+ Fixed an issue where duplicate predict sessions did not release NAT + resources. +
+
+
PAN-225228
+ 		+
+ Fixed an issue where filtering Threat logs using any value under + THREAT ID/NAME displayed the error + Invalid term. +
+
+
PAN-225169
+ 		+
+ Added a CLI command to view + Strata Logging Service queue usage. +
+
+
PAN-225110
+ 		+
+ Fixed an issue with firewalls in HA configurations where HA + configuration syncs did not complete or logging data was missing until + firewall processes were manually restarted or the firewalls were + rebooted. +
+
+
PAN-225094
+ 		+
+ Fixed an issue where performing a commit operation failed and the + following error message was displayed: + failed to handle CUSTOM_UPDATE. +
+
+
PAN-225082
+ 		+
+ Fixed an issue where GlobalProtect quarantine-delete logs were + incorrectly shown on passive firewalls. +
+
+
PAN-225013
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where + the firewall rebooted unexpectedly when a Network Card was on Slot 2 + instead of a DPC. +
+
+
PAN-224955
+ 		+
+ Fixed an issue where the + devsrvr + process stopped responding when zone protection had more than 255 + profiles. +
+
+
PAN-224772
+ 		+
+ Fixed a high memory usage issue with the + mongodb + process that caused an OOM condition. +
+
+
PAN-224656
+ 		+
+ Fixed an issue where the + devsrvr + process caused delays when Dynamic Address Groups with large entry + lists were being processed during a commit, which caused commits to + take longer than expected. +
+
+
PAN-224405
+ 		+
+ Fixed an issue where the + distributord + process repeatedly stopped responding. +
+
+
PAN-224354
+ 		+
+ Fixed an issue where a memory leak related to the + distributord + process occurred when connections flapped for IP address-to-username + mapping redistribution. +
+
+
PAN-224036
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where a + firewall with QoS configured wasn't able to send packets out of its + interfaces after a reboot. +
+
+
PAN-223855
+ 		+
+ Fixed an issue where the + show running ippool CLI command + output displayed incorrect used and available NAT IP address pools on + DIPP NAT policy rules in multidataplane firewalls. +
+
+
PAN-223852
+ 		+
+ Fixed an issue where + all_pktproc + stopped responding when network packet broker or decryption broker + chains failed. +
+
+
PAN-223741
+ 		+
+ Fixed an issue where the + mprelay + process stopped responding, which caused a slot restart when another + slot rebooted. +
+
+
PAN-223481
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where + the + all_pktproc + process stopped responding when the firewall was on PAN-OS 10.1.9-h3 + or a later release. +
+
+
PAN-223457
+ 		+
+ Fixed an issue where, if the number of group queries exceeded the Okta + rate limit threshold, the firewall cleared the cache for the groups. +
+
+
PAN-223271
+ 		+
+ Fixed an issue where the file transfer of large zipped and compressed + files had the App-ID unknown-tcp. +
+
+
PAN-223263
+ 		+
+ Fixed an issue on the web interface where the system clock for + Mexico_city was displayed in CDT + instead of CST on the management dashboard. +
+
+
PAN-223259
+ 		+
+ Fixed an issue where selective pushes failed with the error + Failed to generate selective push configuration. Unable to retrieve + last in-sync configuration for the device, either a push was never + done or version is too old. Please try a full push. +
+
+
PAN-223094
+ 		+
+ Fixed an issue where fragmented TCP traffic was dropped due to an IP + address ID conflict over the SD-WAN tunnel. +
+
+
PAN-222941
+ 		+
+ Fixed an issue where viewing the latest logs took longer than expected + due to log indexer failures. +
+
+
PAN-222533
+ 		+
+ (VM-Series firewalls on Microsoft Azure and Amazon Web Services + (AWS) environments) Added support for HA link monitoring and path monitoring. +
+
+
PAN-222500
+ 		+
+ Fixed an issue where an old configuration unexpectedly merged during a + push from Panorama. +
+
+
PAN-222418
+ 		+
+ Fixed an issue where the firewall intermittently recorded a + reconnection message to the authentication server as an error, even if + no disconnection occurred. +
+
+
PAN-222253
+ 		+
+ Fixed an issue on Panorama where policy rulebase reordering under + View Rulebase by Groups (Policy<policy-rulebase>) did not persist if you reordered the policy rulebase by dragging + and dropping individual policy rules and then moved the entire tag + group. +
+
+
PAN-222089
+ 		+
+ Fixed an issue where you were unable to context switch from Panorama + to the managed device. +
+
+
PAN-221938
+ 		+
+ Fixed an issue with network packet broker sessions where the broker + session and primary session timeouts were out of sync, which caused + traffic drops if the broker session timed out when the primary session + was still active. +
+
+
PAN-221857
+ 		+
+ Fixed an issue where users were unable to log in to the GlobalProtect + app using SAML authentication after upgrading to PAN-OS 10.2.3-h4, and + the GlobalProtect logs displayed the following error message: + Username from SAML SSO response is different from the input. +
+
+
PAN-221763
+ 		+
+ Fixed an issue on the web interface where text overlapped when editing + address and prefix values using Firefox. +
+
+
PAN-221577
+ 		+
+ Fixed an issue where a static route for a branch or hub over the + respective virtual interface wasn't installed in the routing table + even when the tunnel to the branch or hub was active. +
+
+
PAN-221316
+ 		+
+ Fixed an issue where the + useridd + process memory consumption increased significantly, which caused the + process to stop responding and the device to restart. +
+
+
PAN-221208
+ 		+
+ Fixed an issue where the tunnel monitor was unable to remain up when + zone protection with Strict IP was enabled and NAT Traversal was + applied. +
+
+
PAN-221033
+ 		+
+ Fixed an issue where the firewall responded to an ARP request for an + IP address in the firewall's NAT address pool when the IP address + wasn't in the same subnet as the IP address of the ingress interface. + With this fix, the firewall won't send unintended GARP responses. +
+
+
PAN-221003
+ 		+
+ Fixed an issue where you were unable to uncheck firewalls in HA + configurations from the device group when + Group HA Peers was enabled. +
+
+
PAN-220790
+ 		+
+ Fixed an issue where the + reportd + process stopped responding, which caused Panorama to restart. +
+
+
PAN-220659
+ 		+
+ Fixed an issue on the firewall where scheduled antivirus updates + failed when external dynamic lists were configured on the firewall. +
+
+
PAN-220640
+ 		+
+ (PA-220 firewalls only) Fixed an issue where + the firewall CPU percentage was miscalculated, and the values that + were displayed were incorrect. +
+
+
PAN-220180
+ 		+
+ Fixed an issue where configured botnet reports (Monitor > Botnet) weren’t generated. +
+
+
PAN-219813
+ 		+
+ Fixed an issue where the configuration log displayed incorrect + information after a multi-device group + Validate-all operation. +
+
+
PAN-219768
+ 		+
+ Fixed an issue where you were unable to filter data filtering logs + with Threat ID/NAME for custom data + patterns created over Panorama. +
+
+
PAN-219644
+ 		+
+ Fixed an issue where firewalls that forwarded logs to a syslog server + over TLS (Objects > Log Forwarding) used the default Palo Alto Networks certificate instead of the + configured custom certificate. +
+
+
PAN-219585
+ 		+
+ Fixed an issue where enabling + syslog-ng debugs from the root + caused 100% disk utilization. +
+
+
PAN-219415
+ 		+
+ Fixed an issue where BGP routes were installed in the routing table + even when the option to install routes was disabled in the + configuration. +
+
+
PAN-219300
+ 		+
+ Fixed an issue where the task manager displayed only limited data. +
+
+
PAN-219260
+ 		+
+ (M-Series appliances only) Fixed an issue where + the management interface flapped due to low memory reserved for kernel + space. +
+
+
PAN-219241
+ 		+
+ Fixed an issue where web content for a failed SAML login had + readability and functionality issues for the GlobalProtect app. +
+
+
PAN-219137
+ 		+
+ (CN-Series firewalls only) Fixed an issue where + firewalls did not upload files to the WildFire public cloud. +
+
+
PAN-218928
+ 		+
+ Fixed an issue where the + reportd + process stopped responding after querying logs or generating ACC + reports with some filters. +
+
+
PAN-218671
+ 		+
+ Fixed an issue on Panorama where commits failed after downgrading the + SD-WAN plugin. +
+
+
+ PAN-218663 and PAN-181876 +
+ 		+ A fix was made to address + CVE-2024-2433. +
+
PAN-218611
+ 		+
+ Fixed an issue where the device telemetry region wasn't updated on the + firewall when pushed from the Panorama template stack. +
+
+
PAN-218555
+ 		+
+ Fixed an issue where the firewall did not receive dynamic address + updates pushed from Panorama during initial registration to Panorama. +
+
+
PAN-218352
+ 		+
+ Fixed an issue where Panorama was slower than expected when WildFire + deployment was scheduled every minute to a large number of devices. +
+
+
PAN-218331
+ 		+
+ Fixed an issue where you were unable to export or download packet + captures from the firewall when context switching from Panorama. +
+
+
PAN-218273
+ 		+
+ Fixed an issue where TCP keepalive packets from the client to the + server weren't forwarded when SSL decryption was enabled. +
+
+
PAN-218238
+ 		+
+ Fixed an issue where you were unable to create a file exception (Monitor > Threat Log > Detailed Log view > Create + Exception), and the following error message was displayed: + no antivirus profile corresponding to threat log. +
+
+
PAN-218119
+ 		+
+ Fixed an issue where the firewall transmitted packets with an + incorrect source MAC address during commit operations. +
+
+
PAN-217831
+ 		+
+ Fixed an issue memory leak issue related to the + logd + process that occurred due to a sysd object not being released. +
+
+
PAN-217728
+ 		+
+ Fixed an issue where uploading a certificate in a manual configuration + option for SafenetHSM failed. +
+
+
PAN-217674
+ 		+
+ Fixed an issue where RADIUS authentication failed when the destination + route of the service route was configured with an IPv4 address with + more than 14 characters. +
+
+
PAN-217541
+ 		+
+ Fixed an issue where the + useridd + process stopped responding after a restart when HIP redistribution was + enabled. +
+
+
PAN-217510
+ 		+
+ Fixed an issue where inbound DHCP packets received by a DHCP client + interface that weren’t addressed to itself were silently dropped + instead of forwarded. +
+
+
PAN-217493
+ 		+
+ Fixed an issue where superusers with read-only privileges were unable + to view SCEP object configurations. +
+
+
PAN-217280
+ 		+
+ Fixed an issue where, when Advanced Routing was enabled, the + routed + process stopped responding during booting up. +
+
+
PAN-217272
+ 		+
+ Fixed an issue where the DNS proxy log included an excessive number of + the following error message: + Warning: pan_dnsproxy_log_resolve_fail: Failed to resolve domain + name ** AAAA after trying all attempts to name servers +
+
+
PAN-217241
+ 		+
+ Fixed an issue where predict session conversion failed for RTP and + RTCP traffic. +
+
+
PAN-217064
+ 		+
+ Fixed an issue where commits took longer than expected when the DLP + plugin was configured. +
+
+
PAN-217024
+ 		+
+ Fixed an issue where fetching device certificates failed for internal + DNS servers with the error message + ERROR Error: Could not resolve host: + certificate.paloaltonetworks.com. +
+
+
PAN-216647
+ 		+
+ Fixed an issue where the + sysd node was updated at + incorrect times. +
+
+
PAN-216214
+ 		+
+ (Panorama managed firewalls in active/active HA configurations + only) Fixed an issue where the HA status displayed as + Out of Sync (Panorama > Managed Devices > Health) if local firewall configurations were made on one of the HA peers. + This caused the next HA configuration sync to overwrite the local + firewall configuration made on the HA peer. +
+
+
PAN-216101
+ 		+
+ Fixed an issue where a memory leak related to a process and LLDP + packet processing caused an OOM condition on the firewall. +
+
+
PAN-215857
+ 		+
+ Fixed an issue where the option to reboot the entire firewall was + visible to vsys admins. +
+
+
PAN-215583
+ 		+
+ Fixed an issue on firewalls in HA configurations where the primary + firewall went into a non-functional state due to a timeout in the + pan_comm logs during the + policy-based forwarding (PBF) parse, which caused an HA failover. +
+
+
PAN-215576
+ 		+
+ Fixed an issue where the + userID-Agent and + TS-Agent certificates were set to + expire on November 18, 2024. With this fix, the expiration date has + been extended to January 2032. +
+
+
PAN-215436
+ 		+
+ Fixed an issue with the web interface where the latest logs took + longer than expected to display under + Monitor. +
+
+
PAN-215223
+ 		+
+ A fix was made to address + CVE-2025-4231. +
+
+
PAN-215082
+ 		+
+ (M-300 and M-700 appliances only) Fixed an + issue where Panorama generated erroneous system logs (MonitorLogsSystem) to alert that the appliance memory usage limit was reached. +
+
+
PAN-214987
+ 		+
+ Fixed an issue where + Application Filter names weren’t + random, and they matched or included internal protocol names. +
+
+
PAN-214942
+ 		+
+ Fixed an issue where SD-WAN UDP traffic failed over to a non-member + path after a flap of an SD-WAN virtual interface. +
+
+
PAN-214847
+ 		+
+ Fixed an issue where, when certificate authentication for admin user + authentication was enabled, vulnerability scans that used usernames or + passwords against the management interface reported a vulnerability + due to a missing HSTS header in the + Access Denied response page. +
+
+
PAN-214773
+ 		+
+ Fixed an issue where RTP packets traversing intervsys were dropped on + the outgoing vsys. +
+
+
PAN-214558
+ 		+
+ Fixed an issue where overriding a Layer2/vwire subinterface on + Panorama caused other subinterfaces to disappear. +
+
+
PAN-214336
+ 		+
+ Fixed an issue where ICMPv6 unreachable messages were sent with an + unspecified source address ( :: ) for VLAN interfaces. +
+
+
PAN-213956
+ 		+
+ Fixed an issue where the firewall interface did not go down even after + the peer link/switch port went down. +
+
+
PAN-213918
+ 		+
+ Fixed an issue where mlav-test-pe-file.exe was not detected by + WildFire Inline ML. +
+
+
PAN-213491
+ 		+
+ Fixed an issue where the management CPU was high, which caused the web + interface to be slower than expected. +
+
+
PAN-213173
+ 		+
+ Fixed an issue where + Preview Changes under + Scheduled Pushes did not launch the + Change Preview window. +
+
+
PAN-213112
+ 		+
+ Fixed an issue where executing the + show report directory-listing CLI + command resulted in no output after upgrading to a PAN-OS 10.1 + release. +
+
+
PAN-213103
+ 		+
+ Fixed an issue where Clientless VPN access failed with the error + message + temporarily unavailable when + accessing the Clientless VPN bookmarked application from the identity + provider application portal. +
+
+
PAN-212932
+ 		+
+ Fixed an issue where the firewall went into a restart loop with the + following error message: + failed to get mgt settings candidate: configured traffic quota of 0 + MB is less than the minimum 32 MB. +
+
+
PAN-212877
+ 		+
+ Fixed an issue where a race condition caused log flooding, which + caused the firewall to go into an unresponsive state. +
+
+
PAN-212770
+ 		+
+ Fixed an issue on the firewall where the WildFire file size limit + value did not match on the web interface and the CLI. +
+
+
PAN-212580
+ 		+
+ (PA-7050 firewalls only) Fixed an issue where + disk space filled up due to files under + /opt/var/s8/lp/log/pan/ not being + properly deleted. +
+
+
PAN-211945
+ 		+
+ Fixed an issue where URL Filtering system logs showed the error + message + CURL ERROR: bind failed with errno 124: Address family not + supported by protocol + even though the PAN-DB cloud was connected. +
+
+
PAN-211827
+ 		+
+ Fixed an issue where Dynamic Updates failed with the following error + message: + CONFIG_UPDATE_INC: Incremental update to DP failed please try to + commit force the latest config. +
+
+
PAN-211821
+ 		+
+ Fixed an issue on firewalls in HA configurations where committing + changes after disabling the QoS feature on multiple Aggregate Ethernet + (AE) interfaces caused the dataplane to go down. +
+
+
PAN-211384
+ 		+
+ Fixed an issue where the size of the + redisthost_1 in the Redis + database continuously increased, which caused an OOM condition. +
+
+
PAN-210234
+ 		+
+ Fixed a REST API call to query the template stack configuration did + not return the template stack variables or device variables. +
+
+
PAN-208438
+ 		+
+ Fixed an issue on Panorama where Security policy rules incorrectly + displayed as disabled. +
+
+
PAN-208395
+ 		+
+ Fixed an issue where user authentication failed in multi-vsys + environments with the error message + User is not in allowlist when an + authentication profile was created in a shared configuration space. +
+
+
PAN-208085
+ 		+
+ Fixed an issue where the BFD peers were deleted during a commit from + Panorama. This occurred because the + pan_comm + thread became deadlocked due to the same + sysd + object was handled during the commit. +
+
+
PAN-207577
+ 		+
+ Fixed an issue where + Panorama > Setup > Interfaces + wasn't accessible for users with custom admin roles even when the + interface option was selected for the custom admin roles. +
+
+
PAN-207003
+ 		+
+ Fixed an issue where the + logrcvr + process NetFlow buffer wasn't reset which resulted in duplicate + NetFlow records. +
+
+
PAN-206325
+ 		+
+ Fixed an issue where a renamed object was still referenced with the + previous name in a Security policy rule, which caused commit failures + when using edit API to create the + rule. +
+
+
PAN-206041
+ 		+
+ (PA-7050 firewalls only) Fixed an issue where + the + ikemgr + process stopped responding. +
+
+
PAN-204808
+ 		+
+ (PA-400 Series, PA-1400 Series, PA-3400 Series, and PA-5400 Series + firewalls only) Fixed an issue where executing the CLI command + show running resource-monitor ingress-backlogs + displayed the error message + Server error : Dataplane is not up or invalid + target-dp(*.dp*) +
+
+
PAN-204663
+ 		+
+ Fixed an issue on Panorama where you were unable to context switch + from one managed firewall to another. +
+
+
PAN-202008
+ 		+
+ Fixed an issue where Traffic logs exported to CSV files contained + inaccuracies and weren’t complete. +
+
+
PAN-201269
+ 		+
+ Fixed an issue where commits failed with the error message + IPv6 addresses are not allowed because IPv6-firewalling is + disabled + when Security policy rules had an address group with more than 1000 + FQDN address objects. +
+
+
PAN-198190
+ 		+
+ (VM-Series firewalls only) Fixed an issue where + the MTU on the management interface couldn’t be configured to a value + greater than 1500. +
+
+
PAN-197189
+ 		+
+ Fixed an issue where the RST packet wasn't sent to the client when + decrypted HTTP/2 traffic was detected by custom vulnerability + signatures with action reset-both. +
+
+
PAN-196146
+ 		+
+ (VM-Series firewalls only) Fixed an issue where + hostname validation failed due to the firewall not taking the hostname + provided in init.cfg. +
+
+
PAN-193484
+ 		+
+ Fixed an issue where DNS failed if the domain name started with a + period. +
+
+
PAN-192318
+ 		+
+ Fixed an issue where executing the CLI command + show rule-hit-count device-group + displayed the error message + Server error : show rule hit count op-command failed. +
+
+
PAN-186957
+ 		+
+ Fixed an issue where, in + SAML Metadata Export, a drop-down + did not appear in the input field when + IP or Hostname was selected for + Type. +
+
+
PAN-185286
+ 		+
+ (PA-5400 Series firewalls only) Fixed an issue + on Panorama where device health resources did not populate. +
+
+
PAN-181706
+ 		+
+ Fixed an issue where the + logrcvr + process stopped responding after upgrading to PAN-OS 10.1. +
+
+
PAN-179952
+ 		+
+ Fixed an issue on Panorama where not all categories were displayed + under Log settings. +
+
+
PAN-179260
+ 		+
+ Fixed an issue where admins and other superusers were unable to remove + a commit lock that was taken by another admin user with the format + <domain/user>. As a result, deleting the commit lock failed. +
+
+
PAN-175642
+ 		+
+ Fixed an issue where system logs to alert for support license expiry + weren’t generated. +
+
+
PAN-98605
+ 		+
+ Fixed an issue where audit comments did not appear in the audit + comments archive. +
+
diff --git a/reference/PAN-OS/addressed/10.2.9-h1.html b/reference/PAN-OS/addressed/10.2.9-h1.html new file mode 100644 index 0000000..fbf13b0 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.9-h1.html @@ -0,0 +1,41 @@ + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-252214
+ 		+
+ A fix was made to address + CVE-2024-3400. +
+
diff --git a/reference/PAN-OS/addressed/10.2.9-h11.html b/reference/PAN-OS/addressed/10.2.9-h11.html new file mode 100644 index 0000000..55cdb01 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.9-h11.html @@ -0,0 +1,147 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-263226
+ 		+
+ Fixed an issue where decryption based traffic failed on Explicit Proxy + nodes. +
+
+
PAN-261917
+ 		+
+ Fixed an issue where websites with a no-decrypt policy rule were + decrypted in traffic log when using a Google Chrome browser with PQC + enabled +
+
+
PAN-260662
+ 		+
+ Fixed an issue where large file downloads were slower than expected + when private IP address visibility was enabled. +
+
+
PAN-260218
+ 		+
+ Fixed an issue where BGP Aggregate Advertise filters did not work as + expected when the summary option was enabled, and only summarized + routes were advertised. +
+
+
PAN-258996
+ 		+
+ Fixed an issue where the firewall displayed the SFP ports as + PowerDown when the SFP + transceiver was removed and reinserted or the port was shut down and + brought back up on the peer device. +
+
+
PAN-251661
+ 		+
+ Fixed an issue where a memory overwrite occurred during HTTP/2 header + inflation. +
+
+
PAN-251563
+ 		+
+ Added CPLD enhancement to capture external power issues. +
+
+
PAN-240612
+ 		+
Fixed a kernel panic caused by a third-party issue.
+
+
PAN-233191
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where + the Data Processing Card (DPC) restarted due to path monitor failure + after QSFP28 disconnected from the Network Processing Card (NPC). +
+
+
PAN-226768
+ 		+
+ Fixed an issue where, when the GlobalProtect app was installed on iOS + endpoints and the gateway was configured to accept cookies, the app + remained in the Connecting stage + after authentication, and the GlobalProtect log displayed the error + message + User is not in allow list. This + occurred when the app was restarted or when the app attempted to + reconnect after disconnection. +
+
diff --git a/reference/PAN-OS/addressed/10.2.9-h14.html b/reference/PAN-OS/addressed/10.2.9-h14.html new file mode 100644 index 0000000..8494ad2 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.9-h14.html @@ -0,0 +1,356 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-264871
+ 		+
+ Fixed an issue on Panorama where the + configd + process stopped responding when viewing IP addresses on dynamic + address groups with a large number of IP addresses. +
+
+
PAN-263226
+ 		+
+ Fixed an issue where decryption based traffic failed on Explicit Proxy + nodes. +
+
+
PAN-262340
+ 		+
+ Fixed an issue where FQDN resolution failed for address objects, and + all FQDN traffic was denied by the interzone-default policy rule. +
+
+
PAN-262287
+ 		+
+ Fixed an issue where dereferencing a NULL pointer that occurred caused + pan_task + processes to stop responding. +
+
+
PAN-260928
+ 		+
+ Fixed an issue where GlobalProtect failed to connect when using LDAP + authentication with machine certificates with the error message + You are not authorized to connect to GlobalProtect portal. +
+
+
PAN-260512
+ 		+
+ Fixed an issue where accessing the IP address of the device address + group objects from the user interface caused the + configd + process to stop responding. +
+
+
PAN-259769
+ 		+
+ Fixed an issue where the GlobalProtect portal was not accessible via a + web browser and displayed the error + ERR_EMPTY_RESPONSE. +
+
+
PAN-259002
+ 		+
+ Fixed an issue where frequent external dynamic list updates caused the + configd + process to restart. +
+
+
PAN-256077
+ 		+
+ Fixed an issue where the GlobalProtect client would disconnect + consistently due to keep-alive timeouts when using an SSL-only tunnel. +
+
+
PAN-255619
+ 		+
+ Fixed an intermittent issue where file downloads from websites failed. +
+
+
PAN-255323
+ 		+
+ (PA-7050 firewalls only) Fixed an issue where + the Network Processing Card (NPC), Data Processing Card (DPC), and Log + forwarding Card (LFC) remained in a starting state after an unexpected + power cycle. +
+
+
PAN-252669
+ 		+
+ Fixed an issue where the + ikemgr + process stopped responding with a + SIGSEGV error. +
+
+
PAN-251929
+ 		+
+ Fixed an issue where inbound decryption did not work when FIPS self + tests were turned on. +
+
+
PAN-250020
+ 		+
+ Fixed an issue where MLC2 verdict retrieval failed due to a regression + in loopback data flag handling. +
+
+
PAN-248130
+ 		+
+ Fixed an issue where the + AND operation under a Dynamic + Address Group comparison did not work after upgrading the AWS plugin + to 3.0.1. +
+
+
PAN-241044
+ 		+
+ Fixed an issue where traffic was denied by the interzone-default + policy rule when a Security policy rule with an FQDN destination was + configured. +
+
+
PAN-236133
+ 		+
+ Fixed an issue where SSL traffic was impacted when + SSL Command and Control detector + for Incline Cloud Analysis was set to + reset-both, + reset-client, + reset-server, or + drop. +
+
+
PAN-233681
+ 		+
+ Fixed an issue where the + authd + process on Prisma Access firewalls stopped responding after receiving + the SIGUSR1 signal. +
+
+
PAN-226361
+ 		+
+ Fixed an issue where sessions bypassed L7 inspection or ended + unexpectedly with the error + resources unavailable when the + firewall incorrectly interpreted the Content and Threat Detection + (CTD) global packet queue as being full. +
+
+
PAN-222590
+ 		+
+ Fixed an issue where a semicolon appeared at the end of file names of + data filtering logs. +
+
+
PAN-217198
+ 		+
+ Fixed an issue where Security policy rules did not display values for + FQDN. +
+
diff --git a/reference/PAN-OS/addressed/10.2.9-h16.html b/reference/PAN-OS/addressed/10.2.9-h16.html new file mode 100644 index 0000000..207fd59 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.9-h16.html @@ -0,0 +1,235 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-272809
+ 		+
+ A fix was made to address + CVE-2024-0012 + (PAN-SA-2024-0015) and + CVE-2024-9474. +
+
+
PAN-268314
+ 		+
+ Fixed an issue where new files were not sent to WildFire. With this + fix, the WildFire reserved drive space has been increased for greater + session caching capability. +
+
+
PAN-268002
+ 		+
+ Fixed an issue where URL filtering response pages were not displayed + for sites that were blocked as a result of SSL/TLS handshake + inspection. +
+
+
PAN-267535
+ 		+
+ Fixed an issue on the firewall where DPDK allocated twice the amount + of memory as requested for pre-allocation. +
+
+
PAN-257736
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where + traffic to benign applications was was impacted by holding TCP + sequential segments for MLC inspection and not releasing the full + chain after a benign verdict was received. +
+
+
PAN-252036
+ 		+
+ Fixed an issue where, when the GlobalProtect portal was not + configured, accessing the GlobalProtect gateway still loaded a portal + malformed page. +
+
+
PAN-250787
+ 		+
+ Fixed an issue where network issues between the firewall and the log + collector caused + logrcvr + process memory exhaustion. +
+
+
PAN-250394
+ 		+
+ Fixed an issue where a large amount of group data caused serialization + errors and prevented synchronization. +
+
+
PAN-240251
+ 		+
+ Fixed an issue where the + vldmgr + process incorrectly restarted during an Elasticsearch restart. +
+
+
PAN-237010
+ 		+
+ Fixed an issue on Panorama where local commits took longer than + expected after an upgrade. +
+
+
PAN-229686
+ 		+
+ Fixed an issue where eBGP remained in an idle state after disabling + and enabling BGP configurations. +
+
+
PAN-226361
+ 		+
+ an issue where sessions bypassed L7 inspection or ended unexpectedly + with the error + resources unavailable when the + firewall incorrectly interpreted the Content and Threat Detection + (CTD) global packet queue as being full. +
+
+
PAN-193285
+ 		+
+ Fixed an issue where the policy optimizer feature did not add entries + back to the mongodb database + after removing them during an upgrade or downgrade. +
+
diff --git a/reference/PAN-OS/addressed/10.2.9-h18.html b/reference/PAN-OS/addressed/10.2.9-h18.html new file mode 100644 index 0000000..8f9fd5f --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.9-h18.html @@ -0,0 +1,333 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Issue IDDescription
+
PAN-268727
+ 		+
+ Fixed an issue where traffic was dropped when the accumulation proxy + was enabled and header insertion modified packets. +
+
+
PAN-268314
+ 		+
+ Fixed an issue where new files were not sent to WildFire. With this + fix, the WildFire reserved drive space has been increased for greater + session caching capability. +
+
+
PAN-267704
+ 		+
+ Fixed an issue where the firewall did not send an ICMP error packet to + Envoy when the MSS was exceeded. +
+
+
PAN-266427
+ 		+
+ Fixed an issue on the firewall where, when a high number of SD-WAN + branch sites or interfaces were not connected, SD-WAN processes and + tund + processes stopped responding due to a high probing rate. +
+
+
PAN-265900
+ 		+
+ Fixed an issue where the firewall stopped responding due to a + tund + process or SD-WAN process restart. +
+
+
PAN-265742
+ 		+
+ Fixed an issue on the Panorama web interface where the + OK button on the GlobalProtect + gateway configuration dialog box was not clickable. +
+
+
PAN-265111
+ 		+
+ Fixed an issue where fragmented SSL hello packets were reordered when + going out of the SC/ZTT towards the datacenter. +
+
+
PAN-264169
+ 		+
+ (PA-5400 Series firewalls only) Fixed an issue + where the firewall sent correlated event logs to the syslog server + using the management interface instead of the log interface. +
+
+
PAN-263973
+ 		+
+ Fixed an issue where log collectors had a low incoming log rate. +
+
+
PAN-262383
+ 		+
+ Fixed an issue where the firewall was unable to decompress the HTTP2 + header, which caused the session to be classified as unknown-tcp + instead of web-browsing. +
+
+
PAN-261673
+ 		+
+ (VM-Series firewalls on Microsoft Azure environments only) Fixed an issue where, when Accelerated Networking was enabled, + traffic was dropped because of the + flow_parse_ip_hdr counter related + to an Nvidia driver issue. +
+
+
PAN-260564
+ 		+
+ Fixed an issue on firewalls in HA configurations where a network loop + was detected by switches after suspending HA on the active firewall. +
+
+
PAN-257601
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where + Networking Cards (NC) experienced an internal link fault which caused + path monitoring failure on the Dataplane Processing Card (DPC). +
+
+
PAN-253213
+ 		+
+ Fixed an issue where the firewall sent HIP notifications every time it + received a HIP report instead of every two hours. +
+
+
PAN-252730
+ 		+
+ Fixed an issue where the Elasticsearch status for a log collector + group changed to red or yellow after performing a collector group + push. +
+
+
PAN-246699
+ 		+
+ Fixed an issue on Panorama where the + Rule Usage and + Apps Seen under Security policy + rules stopped incrementing. +
+
+
PAN-246420
+ 		+
+ (PA-5450 Series firewalls only) Fixed an issue + where the firewall rebooted unexpectedly during an upgrade. +
+
+
PAN-244950 and PAN-221352
+ 		+
+ A fix was made to address + CVE-2024-2550. +
+
+
PAN-235877
+ 		+
+ (PA-400 Series firewalls only) Fixed an issue + where the firewall failed to start up after upgrading PAN-OS due to + system file corruption. +
+
+
PAN-226184
+ 		+
+ Fixed an issue where push operations from Panorama were slow due to + the + rasmgr + process taking longer than expected. +
+
+
PAN-224833
+ 		+
+ Fixed an issue where the firewall dropped DHCPv6 relay packets if + there were duplicate link-local addresses on different subinterfaces. +
+
+
PAN-216941
+ 		+
+ (Panorama appliances in Log Collector mode only) Fixed an issue where Panorama stopped processing and saving logs. +
+
diff --git a/reference/PAN-OS/addressed/10.2.9-h19.html b/reference/PAN-OS/addressed/10.2.9-h19.html new file mode 100644 index 0000000..0b0f4b5 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.9-h19.html @@ -0,0 +1,41 @@ + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-259351
+ 		+
+ A fix was made to address + CVE-2024-3393. +
+
diff --git a/reference/PAN-OS/addressed/10.2.9-h21.html b/reference/PAN-OS/addressed/10.2.9-h21.html new file mode 100644 index 0000000..bb6ffa0 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.9-h21.html @@ -0,0 +1,241 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-279604
+ 		+
+ Fixed an issue where scheduled SaaS application usage reports were + generated incorrectly, and the login page was displayed instead of the + report content. +
+
+
PAN-274726
+ 		+
+ Fixed an issue where Wildfire signature generation was enabled on all + nodes in a cluster instead of only the active node. +
+
+
PAN-273994
+ 		+
+ A fix was made to address + CVE-2025-0111. +
+
+
PAN-273971
+ 		+
+ A fix was made to address + CVE-2025-0108. +
+
+
PAN-273278
+ 		+
+ A fix was made to address + CVE-2025-0109. +
+
+
PAN-271926
+ 		+
+ Fixed an issue where TLS 1.3 decryption failed with a bad record MAC + error when the firewall was configured to decrypt and inspect TLS + traffic. +
+
+
PAN-270549
+ 		+
+ Fixed an issue where some TLS connections were not handled correctly, + which led to instability in the dataplane. +
+
+
PAN-268501
+ 		+
+ Fixed an issue where the firewall was unable to generate a TSF file + due to a full root partition +
+
+
PAN-268260
+ 		+
+ Fixed an issue on hardware firewalls where, when SSL decryption was + enabled and Client Hello messages spanned multiple TCP segments, some + SSL decrypted sessions failed. +
+
+
PAN-267781
+ 		+
+ Fixed an issue where Panorama did not display the Source Dynamic + Address Group. +
+
+
PAN-267671
+ 		+
+ Fixed an issue where the firewall rebooted unexpectedly due to the + all_task + process restarting and repeated OOM conditions occurring on the + pan_task + process. +
+
+
PAN-261739
+ 		+
+ (VM-Series firewalls in Microsoft Azure environments only) Fixed an issue where the firewall displayed 0 for the physical port + counters read from MAC. +
+
+
PAN-259610
+ 		+
+ Fixed an issue where Wildfire content installation failed for WF-500B + clusters when deployed from Panorama using the deployment schedule. +
+
+
PAN-255820
+ 		+
+ Fixed an issue where the WildFire signature generation check box in + Panorama did not register a change in the configuration. +
+
diff --git a/reference/PAN-OS/addressed/10.2.9-h9.html b/reference/PAN-OS/addressed/10.2.9-h9.html new file mode 100644 index 0000000..38ab77f --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.9-h9.html @@ -0,0 +1,445 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-259480
+ 		+
+ Fixed an issue where the + varrcvr + process stopped responding after running out of memory due to how the + process queued and dequeued files for WildFire file forwarding when a + WildFire Analysis Security profile was enabled. +
+
+
PAN-259344
+ 		+
+ Fixed an issue where performing a configuration commit on a firewall + locally or from Panorama caused a memory leak related to the + configd + process and resulted in a out-of-memory (OOM) condition. +
+
+
PAN-258941
+ 		+
+ Fixed an issue where some URLs were not accessible when connected to + Prisma Access explicit proxy. +
+
+
PAN-258442
+ 		+
+ Fixed an issue where changes made to the split tunnel configuration on + the Prisma Access gateway were not reflected on the GlobalProtect + client. +
+
+
PAN-257919
+ 		+
+ Fixed an issue where, when using explicit proxy with SAML + authentication, initiating SAML authentication with a non-GET request + resulted in a 302 redirect response + instead of the expected + 200 ok response. +
+
+
PAN-257515
+ 		+
+ Fixed an issue where Possible Domain Fronting Detection for HTTP/2 + generated false positives. With this change, domain fronting is + limited to HTTP/1. +
+
+
PAN-257355
+ 		+
+ Fixed an issue where a false positive HTTP/TLS evasion alert was + generated when the domain had DNS load balance. +
+
+
PAN-257197
+ 		+
+ Fixed an issue where ifType and + ifSpeed were not populated in + asynchronous mode of SNMP operations. +
+
+
PAN-256181
+ 		+
+ Fixed an issue where the management interface and front panel port + interface statistics were not populated in asynchronous mode of SNMP + operations. +
+
+
PAN-254422
+ 		+
+ Fixed an issue where the firewall required a restart when an SD-WAN + policy rule was pushed from Panorama. +
+
+
PAN-254241
+ 		+
+ Fixed an issue where the firewall stopped responding due to a high + number of SD-WAN probes being sent. +
+
+
PAN-252517
+ 		+
+ Fixed an issue where SNMP failed to respond to multiple Object + Identifier (OID) queries in a single SNMP GET request. +
+
+
PAN-252214
+ 		+
+ A fix was made to address + CVE-2024-3400. +
+
+
PAN-251639
+ 		+
+ Fixed acn issue where an out-of-memory condition occurred due to a + memory leak related to the + varrvcr + process when a WildFire Analysis security profile was enabled. +
+
+
PAN-251013
+ 		+ Fixed an issue on the web interface where the + Virtual Router and + Virtual System + configurations for the template incorrectly showed as + none. +
+
PAN-250062
+ 		+
+ Fixed an issue where device telemetry failed after upgrading due to + bundle generation failure. +
+
+
PAN-249814
+ 		+
+ Fixed an issue where multiple + all_task + processes stopped responding, which caused the dataplane to fail. +
+
+
PAN-247099
+ 		+
+ Fixed an issue where the firewall decrypted traffic unexpectedly when + the client hello was spread across multiple packets. +
+
+
PAN-246960
+ 		+
+ Fixed an issue where firewalls failed to fetch content updates from + the Wildfire Private Cloud due to an + Unsupported protocol error. +
+
+
PAN-245125
+ 		+
+ (VM-Series firewalls in Microsoft Azure environments only) Fixed an issue where file descriptors were not closed due to + invalid configurations. +
+
+
PAN-244013
+ 		+
+ Fixed an issue where the web interface did not display newly added + Anti-Spyware signatures or Vulnerability Signatures until you + refreshed the browser or logged out or in via the web interface. +
+
+
PAN-242309
+ 		+
+ Fixed an issue where a higher byte count (s2c) was observed for + DNS-Base application. +
+
+
PAN-239662
+ 		+
+ Fixed an issue with firewalls in active/passive high availability (HA) + configurations where the NSSA default route from the active firewall + was not generated to advertise even though the backbone area default + route was advertised during a graceful restart. +
+
+
PAN-239143
+ 		+
+ Fixed an issue with accessing websites when URL filtering profiles + were configured with the + block-continue action and the server + used HTTP/2. +
+
+
PAN-236909
+ 		+
+ Fixed an issue where, when you committed the first configuration + change after booting up the firewall, the external dynamic list file + download failed until the list was refreshed. This occurred when the + configuration was pushed with a certificate profile. +
+
+
PAN-231440
+ 		+
+ Fixed an issue where, when a certificate profile was configured on an + external dynamic list object but the profile had been deleted or did + not exist, commits silently failed with the error + Failed to refresh EDL config + instead of showing the correct validation error message +
+
+
PAN-223418
+ 		+
+ Fixed an issue where heartbeats to the + brdagent + process were lost, resultng in the process not responding, which + caused the firewall to reboot. +
+
+
PAN-164885
+ 		+
+ Fixed an issue on Panorama where + Commit and Push or + Push to Devices operations failed + when an external dynamic list was configured to check for updates + every 5 minutes due to the commit and external dynamic fetch processes + overlapping. +
+
diff --git a/reference/PAN-OS/addressed/10.2.9.html b/reference/PAN-OS/addressed/10.2.9.html new file mode 100644 index 0000000..0dfba45 --- /dev/null +++ b/reference/PAN-OS/addressed/10.2.9.html @@ -0,0 +1,365 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-250686
+ 		+
+ Fixed an issue where selective push operations did not work when more + than one admin user simultaneously performed changes and partial + commits on Panorama. +
+
+
PAN-247403
+ 		+
+ (VM-Series firewalls only) Fixed an issue where + the push scope CLI command took longer than expected, which caused the + web interface to be slow. +
+
+
PAN-246431
+ 		+
+ Fixed an issue where a + Push to Device operation remained at + the state None when performing a + selective push to device groups and templates that included both + connected and disconnected firewalls. +
+
+
PAN-245701
+ 		+
+ Fixed an issue where the returned values to SNMP requests for data + port statistics were incorrect. +
+
+
PAN-244836
+ 		+
+ A knob was introduced to toggle the default behavior of BGP in the + Advanced Routing stack to not suppress duplicate updates. By default, + the prefix updates are suppressed for optimization. +
+
+
PAN-244548
+ 		+
+ Fixed an issue where ECMP sessions changed destination MAC addresses + mid-session, which caused connections to be reset. +
+
+
PAN-244493
+ 		+
+ Fixed a memory limitation with mapping subinterfaces to VPCE endpoints + for GCP IPS, Amazon Web Services (AWS) integration with GWLB, and NSX + service chain mapping. +
+
+
PAN-243463
+ 		+
+ Fixed an issue where high Enhanced Application Log traffic used excess + system resources and caused processes to not work. +
+
+
PAN-242910
+ 		+
+ Fixed an issue where a custom based non-Superuser was unable to push + to firewalls. +
+
+
PAN-242627
+ 		+
Fixed an issue where selective push did not work.
+
+
PAN-241018
+ 		+ (VM-Series firewalls in Microsoft Azure environments only) Fixed a Dataplane Development Kit (DPDK) issue where interfaces + remained in a link-down stage after an Azure hot plug event. +
+
PAN-240477
+ 		+
+ Fixed a temporary hardware issue that caused PAN-SFP-PLUS-CU-5M to not + be able to link up on PA-5400 Series, PA-3400 Series, and PA-1400 + Series firewalls. +
+
+
PAN-240066
+ 		+
+ Fixed a duplicate MAC address issue where an ethernet interface sent + out Gratuitous ARP (GARP) messages for an IP address that was not + configured on it. +
+
+
PAN-239722
+ 		+
+ Fixed an issue where SNMP scans to the firewall took longer than + expected and intermittently timed out. +
+
+
PAN-238643
+ 		+
+ Fixed an issue where a memory leak caused multiple processes to stop + responding when VM Information Sources was configured. +
+
+
PAN-237991
+ 		+
+ Fixed an issue where the log collector sent fewer logs than expected + to the syslog server. +
+
+
PAN-233692
+ 		+
+ Fixed an issue on Panorama where the + configd + process stopped, which caused performance issues. +
+
+
PAN-233684
+ 		+
+ Fixed an issue on Panorama where + Push to Devices or + Commit and Push operations took + longer than expected on the web interface. +
+
+
PAN-231439
+ 		+
+ Fixed an issue where, when a VoIP call using dynamic IP and NAT was + put on hold, the audio became one-way due to early termination of NAT + ports. +
+
+
PAN-230746
+ 		+
+ Fixed an issue on the web interface where device groups with a large + number of managed firewalls displayed the + Policy page more slowly than + expected. +
+
+
PAN-228515
+ 		+
+ Fixed an issue where the Elasticsearch cluster health status displayed + as yellow or red due to Elasticsearch SSH tunnel flaps. +
+
+
PAN-224500
+ 		+
+ Fixed an issue where IPv6 addresses in XFF were displayed in Traffic + logs. +
+
+
PAN-222188
+ 		+
+ A CLI command was introduced to address an issue where SNMP monitoring + performance was slower than expected, which resulted in + snmpwalk timeouts. +
+
+
PAN-215430
+ 		+
+ Fixed an issue where dynamic IP address NAT with SIP intermittently + failed to convert RTP Predict sessions. +
+
+
PAN-212553
+ 		+
+ Fixed an issue where the + ikemgr + process stopped responding due to memory corruption, which caused VPN + tunnels to go down. +
+
+
PAN-207092
+ 		+
+ Fixed an issue where logging in using default credentials after + changing to FIPS-CC for NSX-T firewalls did not work. +
+