diff --git a/reference/PAN-OS/addressed/11.1.14.html b/reference/PAN-OS/addressed/11.1.14.html new file mode 100644 index 0000000..8311090 --- /dev/null +++ b/reference/PAN-OS/addressed/11.1.14.html @@ -0,0 +1,5525 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-317215
+ 		+
+ (VM-Series firewalls on ESXi with Intel E810 NICs using PCI + passthrough) Fixed an issue where the + brdagent process became + unresponsive during data port initialization, which resulted in system + instability, interface outages, HA split-brain conditions, and + unexpected reboots during failover. +
+
+
PAN-317177
+ 		+
+ Fixed an issue on firewalls in DHCP Client mode where, after upgrading + to an affected release, the SNMP process unexpectedly restarted after + a commit, which led to false interface flap notifications on SNMP + managers. +
+
+
PAN-316911
+ 		+
+ (VM-Series firewalls on Amazon Web Services (AWS) environments + only) Fixed an issue where a newly bootstrapped firewall required a + management server restart, relicensing, or license push from Panorama + to invoke the device certificate. +
+
+
PAN-315958
+ 		+
+ (PA-1410 firewalls only) Fixed an issue where + the SaaS Quality Profile HTTP/HTTPS monitoring feature failed to send + probes due to the firewall being unable to determine the correct + egress interface and source IP address for the monitoring probes. +
+
+
PAN-315927
+ 		+
+ (VM-Series firewalls only) Fixed an issue where + the firewall took longer than expected to connect to the Strata + Logging Service (SLS) after bootstrapping. +
+
+
PAN-314712
+ 		+
+ (PA-7500 Series firewalls only) Fixed an issue + where the source IP Dynamic Address Group mappings were intermittently + not displayed under + Monitor > Traffic logs. This + occurred even when dynamic address groups were updated via XML API + without an expiry time and no unregister requests were observed. +
+
+
PAN-314142
+ 		+
+ Fixed an issue where establishing log forwarding connections to the + Strata Logging Service (SLS) took longer than expected, which resulted + in delayed log visibility on SLS. +
+
+
PAN-314061
+ 		+
+ Fixed an issue where traffic was disrupted during IPSec rekey + operations due to a 2 second delay in sending the DELETE message for + the previous Security Association (SA) to the peer gateway after a new + SA was negotiated. +
+
+
PAN-313850
+ 		+
+ (PA-1400 Series firewalls in HA configurations only) Fixed an issue where a split-brain condition occurred and HA1/HA2 + links went down while upgrading when the HA configuration used + dataplane interfaces for HA1 and a combination of HSCI and Ethernet + interfaces for HA2. +
+
+
PAN-313623
+ 		+
+ Fixed an issue where the + /opt/pancfg/mgmt/ssl/private/ + directory on Palo Alto Networks devices with TPM support became 100% + utilized due to an accumulation of undeleted + .pub_pem files. This occurred + because executing the + show device-certificate status + CLI command initiated a process that generated these files but failed + to remove them, which prevented the fetching of new device + certificates. +
+
+
PAN-313572
+ 		+
+ VM-Series firewalls only) Fixed an issue where + the dataplane restarted due to a segmentation fault. +
+
+
PAN-312706
+ 		+
+ Fixed an issue where the firewalls restarted due to a function lacking + a NULL-pointer sanity check. +
+
+
PAN-312514
+ 		+
+ Fixed an issue where correlation logs were not forwarded via syslog or + email. +
+
+
PAN-312354
+ 		+
+ Fixed an issue where Captive Portal authentication redirects failed + for HTTPS traffic when a user attempted to access internal HTTPS + websites via URL, which led to + ERR_CONNECTION_RESET error messages + in the browser with SSL decryption and CTD handshake inspection + enabled. +
+
+
PAN-312156
+ 		+
+ Fixed an issue where firewalls did not correctly apply SD-WAN policy + rules, which caused traffic to be incorrectly routed via local + breakout instead of VPN backhaul. +
+
+
PAN-311624
+ 		+
+ Fixed an issue on Panorama where, when an Aggregate Ethernet interface + was configured in override mode within a template stack, changing its + management profile unexpectedly overrode other interface-specific + variables. +
+
+
PAN-311456
+ 		+
+ Enhanced the SCP-based export script by adding comprehensive logging + to identify and diagnose the root cause for failed or incomplete + traffic log exports. +
+
+
PAN-311412
+ 		+
+ Fixed an issue where the + show advanced-routing resource + CLI command failed to execute successfully when invoked through the + XML API and returned an error message. +
+
+
PAN-311285
+ 		+
+ (Firewalls in HA conditions only) Fixed an + issue where a memory leak occurred related to the + ospfd + process, which caused RAM usage to continuously increase on active + devices in an HA cluster until the device stopped responding, even + after an HA failover. +
+
+
PAN-311166
+ 		+
+ Fixed an issue where the firewall rebooted unexpectedly to the + all_task_1 process repeatedly + restarting. +
+
+
PAN-311113
+ 		+
+ Fixed an issue where the firewall was unable to clear sessions using + the CLI command + clear session all filter rule + when the specified rule name exceeded 32 characters, even though the + limit is 63 characters. +
+
+
PAN-311098
+ 		+
+ Fixed an issue where firewalls entered a nonfunctional state due to L7 + running out of resources due to a high volume of traffic. +
+
+
PAN-311074
+ 		+
+ Fixed an issue where GRE tunnels took significantly longer to + establish when the hold timer was configured to a value of 10 or + higher, which resulted in a tunnel requiring more successful keepalive + packets than expected to transition to an + Up state. +
+
+
PAN-311073
+ 		+
+ (Panorama managed firewalls in HA configurations only) Fixed an issue where firewalls incorrectly updated the modified + date and MD5 hash of policy rules during an HA sync commit job or a + subsequent local commit, even when no changes were made to the policy + rules. +
+
+
PAN-311040
+ 		+
+ Fixed an issue where the + all_task + process stopped responding and caused the firewall to reboot + unexpectedly. +
+
+
PAN-310851
+ 		+
+ Fixed an issue where firewalls experienced + snmpd log flooding with messages + such as + update_ifTable_utilization_rates(pan_interfacecache.c:1720): Last + time is 0 for dedicated-ha2., which caused the snmpd log to + overflow and be cleared every five minutes. This occurred because the + snmpd process attempted to + calculate interface utilization rates without first verifying if the + interface had valid + sysd configuration data, as the + code incorrectly assumed all interfaces in the MIB would possess valid + sysd data. +
+
+
PAN-310499
+ 		+
+ Fixed an issue on Panorama where, while configuring an Application + Filter with Generative AI tags, the web interface did not retain + application exclusions that were added across multiple pages until you + clicked OK. +
+
+
PAN-310476
+ 		+
+ (Firewalls in active/passive HA configurations only) Fixed an issue where CPLD did not power cycle the firewall after + internal packet path monitoring failures occurred, and both firewalls + instead became simultaneously non-functional after a reboot. +
+
+
PAN-310473
+ 		+
+ Fixed an issue where committing configuration changes to an Advanced + Logical router caused a 20-30 second loss of management access in the + firewall when IPv4 and IPv6 default static routes were configured with + identical attributes including interface, next-hop, and metrics, which + triggered an unnecessary routing table refresh. +
+
+
PAN-310402
+ 		+
+ Fixed an issue where SNMP returned an incorrect down status for HSCI + and logging interfaces even when the interfaces were up, and counters + for the interfaces displayed only zero values. +
+
+
PAN-310362
+ 		+
+ Fixed an issue where IPv6 Routed HA did not function correctly when + the HA1 (control link) was configured with an IPv6 routed connection. +
+
+
PAN-309960
+ 		+
+ (Firewalls in active/passive HA configurations only) Fixed an issue where, when the active firewall experienced an OOM + condition, the passive firewall incorrectly initiated a failover, + which resulted in both firewalls being active simultaneously. +
+
+
PAN-309927
+ 		+
+ Fixed an issue on Panorama where the + multi-clone XML API operation + reported a successful configuration change even when the specific + device group did not exist. +
+
+
PAN-309853
+ 		+
+ (Firewalls with FIPS-CC enabled only) Fixed an + issue where, when attempting to make changes to the GlobalProtect + portal, an error message was displayed and configuration updates + failed. +
+
+
PAN-309828
+ 		+
+ Fixed an issue where, after a firewall serial number was updated via + Panorama, a subsequent policy rule push from Panorama incorrectly + deleted target policy rules from managed firewalls with the updated + serial numbers. +
+
+
PAN-309826
+ 		+
+ (VM-Series firewalls only) Fixed an issue where + files from SSL decrypted sessions were incorrectly forwarded to the + WildFire cloud for analysis even when + Allow Forwarding of Decryption Content + was disabled. +
+
+
PAN-309493
+ 		+
+ Fixed an issue where the URL cloud connection was impacted, which + caused a traffic outage. +
+
+
PAN-309459
+ 		+
+ Fixed an issue where on PA-5420 firewalls, configuring security rules + with a number of static IMSI/IMEI/NSSAI entries exceeding 5,000 + resulted in a commit failure. This occurred because the firewall + incorrectly reported the maximum supported static IMSI/IMEI/NSSAI IDs + as 5,000 (as seen in the + cfg.mobile-nw-id.max-static-entries + system state variable), instead of the documented limit of 100,000 for + the platform. +
+
+
PAN-309379
+ 		+
+ Fixed an issue where the + logrcvr + process stopped responding on DPCs, which prevented logs from being + forwarded. +
+
+
PAN-309306
+ 		+
+ Fixed a rare issue on Octeon Dataplane platforms where the firewall + experienced an unexpected dataplane restart due to a race condition + that occurred during session teardown for traffic undergoing + software-based Content Threat detection. +
+
+
PAN-309258
+ 		+
+ Fixed an issue where you were unable to delete a HIP object with + OR in the name, even though you were able to + successfully create and commit the object. +
+
+
PAN-309217
+ 		+
+ Fixed an issue on the Panorama web interface where refreshing or + configuring settings in the + Response Pages tab caused the web + interface to respond more slowly when navigating to other tabs. +
+
+
PAN-309009
+ 		+
+ Fixed an issue where log ingestion stopped on the Elasticsearch + cluster when the number of open shards was significantly higher than + the number of data nodes. +
+
+
PAN-308902
+ 		+
+ Fixed an issue where, after upgrading to an affected release, the + firewall did not add mTLS websites that required client certificate + authentication via DN list to the ssl-decrypt exclude-cache list. +
+
+
PAN-308786
+ 		+
+ (Panorama appliances only) Fixed an issue where + traffic log queries using the + device_name filter returned no + results, and complex log queries that included negation operators + produced incorrect outputs. +
+
+
PAN-308732
+ 		+
+ (Multi-vsys firewalls only) Fixed an issue + where GlobalProtect clients were unable to use custom source region + objects for gateway selection criteria due to region objects defined + in Panorama not being correctly recognized or displayed in the + GlobalProtect Portal configuration. +
+
+
PAN-308711
+ 		+
+ Fixed an issue where superusers with read-only privileges on Panorama + were unable to execute + show device-certificate CLI + commands. +
+
+
PAN-308668
+ 		+
+ Fixed an issue on Prisma Access Remote Network firewalls where high + CPU utilization caused slowness and command timeouts. +
+
+
PAN-308563
+ 		+
+ Fixed an issue where multiple + pan_tasks + processes attempted to clear the packet queue of the same session. +
+
+
PAN-308461
+ 		+
+ Fixed an issue where the CLI command + request system software download to-version <version> + failed to download multiple software images due with a + Download terminated due to timeout + error message. +
+
+
PAN-308377
+ 		+
+ (PA-7050 firewalls in HA configurations only) + Fixed an issue where the firewall reached 100% disk utilization due to + the + logrcvr + process repeatedly restarting and dumping core files due to a blocked + hints processing thread, which caused a failover. +
+
+
PAN-308261
+ 		+
+ Fixed an issue where the firewall failed to send SNMPv3 traps when the + SNMP destination was configured with an FQDN that resolved to multiple + IP address through DNS load balancing. +
+
+
PAN-308188
+ 		+
+ Fixed an issue where, after a successful commit and push from + Panorama, the management interface SSH profile configuration was + missing or empty on Log Collectors. +
+
+
PAN-308085
+ 		+
+ (VM-Series firewalls in Microsoft Azure environments only) Fixed an issue where, after resizing the VM, the HA2 link became + unstable. Frequent keep-alive failures occurred, and HA2 keep-alive + packets were simultaneously transmitted to multiple destination MAC + addresses and the peer firewall's interface MAC). This issue occurred + on firewalls with Accelerated Networking enabled. +
+
+
PAN-308060
+ 		+
+ (Firewalls in active/active HA configurations only) Fixed an issue where the BFD session went down and did not recover + even though the BGP remained in an established state, which caused the + firewall to cease route learning and advertisement with the peer, even + though BGP keep-alives were exchanged correctly. +
+
+
PAN-307901
+ 		+
+ Fixed an issue where a leak in decryption counters caused resource + exhaustion, which led to a GlobalProtect service outage. +
+
+
PAN-307893
+ 		+
+ Fixed an issue where the Strata Cloud Manager (SCM) web interface + failed to fetch External Dynamic List (EDL) details from Prisma Access + and displayed the error message + Could not fetch the EDL main info. This occurred because the XML query returned an external list + authentication failed response when the EDL entry lacked a valid + certificate. +
+
+
PAN-307806
+ 		+
+ Fixed an issue where, after replacing the MPC (Management Processor + Card) on a firewall, the + logdb process incorrectly wrote + logs to the root partition instead of the /opt/panlogs partition, + which led to high root partition usage and a non-functional state. +
+
+
PAN-307717
+ 		+
+ Fixed an issue on Panorama where administrators were unable to + override SNMP setup configurations within device groups due to the + configured override not being retained. +
+
+
PAN-307714
+ 		+
+ VM-Series firewalls only) Fixed an issue where + insufficient i-node space was available on the sysroot0 partition. +
+
+
PAN-307702
+ 		+
+ (Firewalls in HA configurations only) Fixed an + issue where traffic passing through AE layer 2 and layer 3 interfaces + was interrupted during HA failovers. +
+
+
PAN-307481
+ 		+
+ Fixed a commit failure issue that occurred after migrating from Legacy + to Advanced routing on firewalls where an OSPF authentication profile + was configured to use a 16-character MD5 key with key-ID 10. +
+
+
PAN-307453
+ 		+
+ Fixed an issue for Panorama management servers where commit push + failed when + customer_info status was a + failure received from the + orchestrator, which prevented the system from processing and + validating the specified telemetry region correctly during the commit. +
+
+
PAN-307072
+ 		+
+ Fixed an issue where SNMP interface speed reporting incorrectly + identified 5Gbps interfaces as 1Gbps interfaces during an SNMP walk. +
+
+
PAN-306934
+ 		+
+ Fixed an issue where traffic was unexpectedly blocked due to a + misconfiguration with an empty or invalid application filter. The + firewall incorrectly interpreted the empty filter as + match all cloud-apps, which caused + the traffic to be denied. +
+
+
PAN-306903
+ 		+
+ Fixed an issue on the firewall where, after upgrading, the system log + displayed the error message + Last config fetch FAILED. A commit is required for userid + functionality to work. +
+
+
PAN-306886
+ 		+
+ Fixed an issue where the root partition on the firewall or Panorama + management server filled up due to a file leak in the logging process. +
+
+
PAN-306884
+ 		+
+ Fixed an issue where after changing Panorama to logger mode, commits + failed due to the + panorama-admin role assigned to + plugin management configuration users. +
+
+
PAN-306555
+ 		+
+ Fixed an issue where the firewall stopped responding, which led to + service outages. +
+
+
PAN-306502
+ 		+
+ Fixed two issues that impacted TLSv1.2 or earlier sessions when the + traffic matched a decryption policy rule with the no-decrypt action: +
+
    +
  • + Connections failed when both HTTP header insertion (Objects > Security Profiles > URL Filtering > HTTP + Header Insertion) and + Send handshake messages to CTD for inspection + (Device > Setup > Session > Decryption Settings > SSL + Decryption Settings) were enabled. +
    • +
  • + New sessions failed due to software packet buffer resource + depletion, which occurred when + Log Successful SSL Handshake + was disabled in the decryption policy rule and the decryption + profile attached to the rule had both + Block sessions with expired certificates + and + Block sessions with untrusted issuers + disabled. +
    • +
+
+
PAN-306451
+ 		+
+ (VM-Series firewalls on AWS environments only) + Fixed an issue where, after upgrading the firewall to an affected + release, GlobalProtect clients did not connect with IPSec and instead + connected using SSL due to traffic flow being disabled when checking + for health check packets. +
+
+
PAN-306356
+ 		+
+ Fixed an issue where the + logrcvr + process on a firewall stopped responding due to a document node being + unexpectedly freed. +
+
+
PAN-306226
+ 		+
+ Fixed an issue where the TLS handshake did not complete and the + session did not go through. This occurred if the HTTP header insertion + applied to an HTTP CONNECT request passing through the firewall, the + scan-handshake feature was enabled, the session matched a decryption + policy rule with the decrypt action, and if the TLS client hello was + in a single packet and TLS 1.2 or below. +
+
+
PAN-306225
+ 		+
+ Fixed an issue on the firewall where the + sslmgr + process memory utilization continually increased due to memory + fragmentation. +
+
+
PAN-306215
+ 		+
+ Fixed an issue where creating device groups in bulk via XML API took + significantly more time and the web interface stopped responding. +
+
+
PAN-305922
+ 		+
+ Fixed an issue on Panorama where the CLI output for the running + configuration intermittently inserted + set template stack commands + within certificate hash data. +
+
+
PAN-305874
+ 		+
+ Fixed an issue on the firewall where the output of the CLI commands + show running persistent-dipp-client pool + and + show running persistent-dipp-pool ip-utilization + displayed incorrect information or errors. This occurred due to the + command output including data from the network control dataplane. +
+
+
PAN-305835
+ 		+
+ Fixed an issue where firewalls with Memory Integrity Checking + Architecture enabled rebooted unexpectedly due to accessing an invalid + memory address. This occurred because the forwarding data structure + index exceeded its designed limit. +
+
+
PAN-305700
+ 		+
+ Fixed an issue where a reboot loop occurred when OSPF interfaces were + configued with a link type of + point-to-point. +
+
+
PAN-305605
+ 		+
+ Fixed an issue where GlobalProtect gateway authentication failed due + to the firewall incorrectly bypassing SAML. +
+
+
PAN-305557
+ 		+
+ Fixed an issue where LSVPN (Large Scale VPN) satellites failed to + authenticate to the gateway because the portal was providing a + zeroized certificate. +
+
+
PAN-305552
+ 		+
+ Fixed an issue where DLP logs displayed an incorrect file type when + the firewall did not set the file type field. +
+
+
PAN-305549
+ 		+
+ Fixed an issue where the firewall's service route functionality was + impacted due to a missing service route support code. +
+
+
PAN-305502
+ 		+
+ Fixed an issue where Panorama was unable to forward logs to a syslog + server over TLSv1.3 when configured with SSL on a custom port. The + connection was established, but logs were not forwarded due to a + failure in the CRL check. +
+
+
PAN-305412
+ 		+
+ Fixed an issue where the Logging Service License Status displayed a + license failure when the license status transitioned from valid to + expired and then back to valid even when the connection to the + Security Logging Service (SLS) was working. +
+
+
PAN-305411
+ 		+
+ Fixed an issue where, after creating a logical interface with an + assigned IP address and adding it to a virtual router, the connected + route for the interface did not appear in the + show routing route CLI command + output. This occurred even when the interface was up and learning ARP + entries. +
+
+
PAN-305374
+ 		+
+ Fixed an issue on Panorama where the first letter of a custom URL + category was not displayed in generated reports. +
+
+
PAN-305188
+ 		+
+ Fixed an issue where TLS connections failed to establish in asymmetric + routing environments if the Client Hello was split into multiple + segments and arrived out of order. +
+
+
PAN-304840
+ 		+
+ Fixed an issue where multiple firewalls experienced high management + CPU utilization after upgrading to an affected release due to repeated + index regeneration occurring every 15 minutes, which caused periodic + CPU spikes above 90%. +
+
+
PAN-304756
+ 		+
+ Fixed an issue on Panorama where, after you disabled the shared + optimization feature, a full configuration push to multi-vsys devices + caused a validation error. +
+
+
PAN-304746
+ 		+
+ (Panorama appliances and Panorama virtual appliances only) Fixed an issue where the + configd + process restarted when committing and pushing configuration for a new + WildFire cluster. +
+
+
PAN-304718
+ 		+
+ Fixed an issue where OSPF and BGP outages occurred due to an + all_task process restart during + clientless VPN content rewrite processing. +
+
+
PAN-304696
+ 		+
+ Fixed an issue where the Cloud User-ID connection timed out because + the firewall took too long to process the OCSP response. +
+
+
PAN-304689
+ 		+
+ Fixed an issue on Panorama where device group users were able to view + and commit configuration changes that had been created by Superusers + but not yet committed, even with access domains configured. +
+
+
PAN-304636
+ 		+
+ Fixed an issue where BGP aggregate routes were not created and discard + routes were not installed in the routing table. +
+
+
PAN-304576
+ 		+
+ Fixed an issue where the firewall entered a non-functional state due + to segmentation fault within the + all_pktproc + process that was caused by a session that involved http2 cleartext + traffic. +
+
+
PAN-304538
+ 		+
+ Fixed an issue where traffic logs did not populate the + Source EDL or + Destination EDL fields when traffic + matched a Security policy rule that used predefined external dynamic + lists. +
+
+
PAN-304397
+ 		+
+ Fixed an issue on the web interface where you were unable to test the + SCP server connection for Scheduled Log Exports, and the error message + key is invalid was displayed. +
+
+
PAN-304229
+ 		+
+ Fixed an issue on the Panorama web interface where you were unable to + disable Lifesize (Templates > Network > Network Profiles > IPSec + Crypto). +
+
+
PAN-304205
+ 		+
+ Fixed an issue on Panorama where, after upgrading to an affected + release, a partial commit via the API did not push configuration + changes to managed firewalls, and a full commit was required to + synchronize the configuration. +
+
+
PAN-304148
+ 		+
+ Fixed an issue where a large number of GlobalProtect users experienced + failed gateway pre-logins with the error + Failed to create SAML SSO request + during peak login times. +
+
+
PAN-304019
+ 		+
+ (VM-Series firewalls only) Fixed an issue where + the firewall did not send traffic to SCM or SLS via a configured + explicit proxy IP address when the proxy username was not configured. +
+
+
PAN-303954
+ 		+
+ Fixed an issue where, when configuring Safenet HSMs in HA and + authentication HSM manually, the second HSM server failed to + authenticate due to the firewall overwriting the first HSM server's + certificate with the second HSM server's certificate. +
+
+
PAN-303791
+ 		+
+ Fixed an issue where configuring a service route on a loopback + interface caused intermittent connectivity issues and disrupted + traffic due to the firewall being unable to resolve domain names. +
+
+
PAN-303745
+ 		+
+ Fixed an issue where inter-dataplane forwarding did not work for + sessions ingressing on Slot 2, which resulted in intermittent ping + failures to interfaces on Network Card 2 when traffic was forwarded to + Slot 3. +
+
+ Note: With this fix, after a slot restart, the + global counter will still show dot1q errors for a short period. +
+
+
PAN-303722
+ 		+
+ Fixed an issue on the firewall where configuring spyware and + vulnerability profiles in Security policy rules caused a memory leak + in the + devsrvr + process with each configuration commit. +
+
+
PAN-303671
+ 		+
+ Fixed an issue where third-party clients were unable to connect to the + GlobalProtect gateway after a successful login when the username was + entered in the domain\username format. +
+
+
PAN-303663
+ 		+
+ Fixed an issue on the firewall where SolarWinds monitoring systems + reported 100% usage for + Slot1 Data Processor-0 Hardware Packet Buffers + due to an inaccurate reported packet buffer. +
+
+
PAN-303662
+ 		+
+ Fixed an issue where PA-455 firewalls running PAN-OS 11.2.4-h7 + intermittently failed to generate system logs and trigger an HA + failover when a link-monitored interface was unplugged, despite the + interface's status being reflected as down on the GUI. +
+
+
PAN-303508
+ 		+
+ Fixed an issue where the firewall failed to fetch the device + certificate during initial installation. +
+
+
PAN-303487
+ 		+
+ Fixed an issue where Panorama appliances in FIPS-CC mode did not push + the configured values for + max-session-count and + max-session-time to managed + firewalls that were not in FIPS mode. +
+
+
PAN-303390
+ 		+
+ Fixed an issue on the firewall where the DNS cache capacity was set to + an incorrect value, which caused the firewall to repeatedly send DNS + requests for FQDN objects even after receiving valid responses. This + resulted in the firewall not storing DNS responses in the cache for + more than 10-15 seconds despite the minimum FQDN refresh interval + being set to a higher value. +
+
+
PAN-303379
+ 		+
+ Fixed an issue where the + show system resources CLI command + displayed incorrect CPU usage values that did not add up to 100%. +
+
+
PAN-303363
+ 		+
+ Fixed an issue where predict traffic was dropped due to non-zero hash + bucket values, even when no flows were present. This occurred because + because the predict flow entries list of a hash bucket was incorrectly + updated during predict flow deletion, which caused more predict flows + to be deleted than intended. +
+
+
PAN-302983
+ 		+
+ Fixed an issue where, after committing changes on Panorama, a shared + post-rule moved to the end of the + post shared rulebase on the + managed device instead of remaining at the top. +
+
+
PAN-302921
+ 		+
+ Fixed an issue where the + set auth radius-require-msg-authentic yes + and + show auth radius-require-msg-authentic + CLI commands were unavailable on Log Collectors. +
+
+
PAN-302834
+ 		+
+ Fixed an issue where Panorama did not display decryption logs after a + certain date due to the decryption index being purged. +
+
+
PAN-302811
+ 		+
+ (Firewalls in HA configurations only) Fixed an + issue where network traffic was disrupted due to the + all_pktproc + process repeatedly restarting, which caused an HA failover. +
+
+
PAN-302737
+ 		+
+ Fixed an issue where API key generation failed after renewing an + expired API certificate, and the system continued to use the expired + certificate. +
+
+
PAN-302654
+ 		+
+ (Firewalls in active/passive HA configurations only) Fixed an issue where, when the HA configuration had multiple + logical routers, static or connected routes redistributed into OSPF + aged out in the LSDB, which caused the routes to be removed on peer + OSPF neighbors. +
+
+
PAN-302564
+ 		+
+ Fixed an issue on the firewall where a path monitoring failure + occurred and caused the dataplane to restart. +
+
+
PAN-302512
+ 		+
+ Fixed an issue where M-200 Panorama appliances configured in High + Availability (HA) and acting as local log collectors displayed a + disconnected inter-log collector status. +
+
+ (Log Collectors in HA configurations only) + Fixed an issue where log collectors displayed a disconnected inter-log + collector status. +
+
+
PAN-302387
+ 		+
+ Fixed an issue where on PA-7500 firewalls, SNMP incorrectly reported + the administrative and operational status of High Speed Chassis + Interconnect (HSCI) interfaces as down, even when the interfaces were + physically up. Additionally, interface counters for these interfaces + displayed all zeroes. +
+
+
PAN-302254
+ 		+
+ Fixed an issue where the web interface made calls to retrieve cloud + authentication service regions even when creating a non-cloud + authentication service profile. +
+
+
PAN-302196
+ 		+
+ Fixed an issue where the dataplane stopped responding when cleaning up + expired sessions currently in Advanced Threat Prevention hold mode. +
+
+
PAN-302175
+ 		+
+ Fixed an issue where, after upgrading an LSVPN portal/gateway to an + affected release, the portal was unable to issue and transfer + certificates to the satellite firewalls, which led to repeated + certificate requests and prevented the satellite firewalls from + authenticating to the gateway. +
+
+
PAN-301975
+ 		+
+ (Firewalls in HA configurations only) Fixed an + issue where the passive firewall incorrectly triggered PBP alerts even + with low packet rates. +
+
+
PAN-301965
+ 		+
+ Fixed an issue on Panorama where enabling Advanced Routing in a + template did not work. +
+
+
PAN-301937
+ 		+
+ Fixed an issue where Microsoft Defender for Cloud detected cleartext + SSH private keys in the /var/appweb and /etc/appweb directories on + PA-VM firewalls deployed in Azure. +
+
+
PAN-301912
+ 		+
+ Fixed an issue where Panorama stopped responding when deploying + dynamic updates to managed devices. +
+
+
PAN-301733
+ 		+
+ Fixed an issue where the + show cloud-auth-service-regions + CLI command took longer than expected to complete due to timeouts + while fetching Cloud Authentication Service (CAS) regions. +
+
+
PAN-301731
+ 		+
+ Fixed an issue where, when the firewall was unable to establish an SCM + connection due to the discovery service returning a 404 error when the + device was not yet known to the service, the firewall did not retry + the attempt as expected. +
+
+
PAN-301691
+ 		+
+ Fixed an issue where BGP stopped responding with the error message + Too many open files when pushing + 1000 eBGP (External BGP) neighbor configurations. With this fix, the + number of file descriptors for the BGP process is increased from 1024 + to 8192. +
+
+
PAN-301662
+ 		+
+ Fixed an issue where direct application URLs for Clientless VPN did + not work on one device in a high availability (HA) pair because the + RelayState in the SAML assertion was not encoded by the firewall. +
+
+
PAN-301600
+ 		+
+ Fixed an issue on the firewall where, after an upgrade, OSPF + adjacencies remained in the exchange state, which resulted in an + incomplete routing table. +
+
+
PAN-301513
+ 		+
+ Fixed an issue on Panorama managed multi-vsys firewalls where, when + the shared-to-shared feature was enabled, shared objects reverted to + an older configuration after a selective push to a vsys. +
+
+
PAN-301456
+ 		+
+ Fixed an issue on Panorama where the + debug system reset-ztp CLI + command was unavailable. +
+
+
PAN-301409
+ 		+
+ Fixed an issue where Panorama failed to perform a selective push to a + managed device when device tags were added or modified on the policy + rules. The selective push failed with the error message + Failed to generate selective push configuration. Schema validation + failed. Please try a full push. +
+
+
PAN-301222
+ 		+
+ Fixed an issue where DNS Security logs incorrectly displayed a + sinkhole action for benign DNS categories due to the firewall saving + the drop or sinkhole action in session flags without discarding the + session. +
+
+
PAN-301113
+ 		+
+ Fixed an issue where the XML API returned the error + Access to this vsys is unauthorized + when generating a report for a specific vsys, even when the + administrator had access to that vsys. This was due to the API session + not correctly populating the + vsysvector field with the user's + allowed vsys. +
+
+
PAN-301018
+ 		+
+ Fixed an issue on Panorama where API queries for correlated category + logs incorrectly returned a count of 0. +
+
+
PAN-301014
+ 		+
+ Fixed an issue where the GlobalProtect portal used an outdated + bootstrap version for clientless VPN. +
+
+
PAN-300922
+ 		+
+ Fixed an issue where the syslog connection was handled by the syslog + forwarding thread. +
+
+
PAN-300833
+ 		+
+ Fixed an issue where the static default route remained active even + when the path or SaaS monitor was down when SD-WAN was used for local + internet breakout. This was due to missing validation handling in the + FRR routed code for link up/down status. +
+
+
PAN-300664
+ 		+
+ Fixed an issue on the Panorama and firewall web interface where + Applications pages became unresponsive after activating the SaaS + Inline license. +
+
+
PAN-300555
+ 		+
+ (Firewalls in HA configurations only) Fixed an + issue where the HA1-A interface reported an incorrect SNMP down value + even when the interface was physically up on the active firewall. +
+
+
PAN-300423
+ 		+
+ Fixed an issue where Data Processing Cards (DPCs) installed in slots 5 + and 6 remained stuck in a starting state with the error + Signal detected for port xeS5-DP0 but Link Down + alerts, which resulted in device instability. +
+
+
PAN-300280
+ 		+
+ Fixed an issue where, on firewalls configured as an Area Border Router + (ABR) with a backbone area (0.0.0.0) and a stub area, external Type-5 + Link State Advertisement (LSA) routes were not installed in the + routing table. +
+
+
PAN-300227
+ 		+
+ Fixed an issue where the firewall dropped packets due to the incoming + flow being hashed to a flow bucket that was full. +
+
+
PAN-300055
+ 		+
+ Fixed an issue where the firewall experienced high disk utilization in + the /opt/pancfg/mgmt/content-preview directory due to older content + data not being automatically removed when an error occurred during the + process. +
+
+
PAN-299910
+ 		+
+ Fixed an issue where unintended ARP packets were sent out from the + dataplane interface when the service route setting for DNS was + configured to use that interface. +
+
+
PAN-299815
+ 		+
+ Fixed an issue on multi-vsys firewalls where a host was not removed + from the quarantine list after receiving a redistribution message from + Panorama. This occurred when Panorama was configured to redistribute + quarantine messages to a firewall cluster, and the GlobalProtect + configuration and redistribution were built out in a vsys other than + vsys1. +
+
+
PAN-299785
+ 		+
+ (PA-7500 and PA-5450 firewalls in FIPS-CC mode) + Fixed an issue where the affected firewalls would boot into + maintenance mode when a reboot was initiated from the web interface. + This was due to a device reboot triggering a power down to all slots, + leading to maintenance mode. A hard reboot would allow the firewall to + boot normally. +
+
+
PAN-299772
+ 		+
+ (VM-Series firewalls in active/passive configurations only) Fixed an issue where, after an HA failover event, the newly active + firewall DHCP client interfaces failed to obtain IP addresses + automatically. This occurred because the DHCP client processes did not + initiate the necessary DHCP discover or renew requests +
+
+
PAN-299757
+ 		+
+ Fixed an issue where Router Advertisements for IPv6 were not sent at + the configured time intervals. +
+
+
PAN-299751
+ 		+
+ Fixed an issue where the firewall was unable to connect to the + Subscription License Service (SLS) due to a public and private key + pair mismatch with the device certificate. +
+
+
PAN-299738
+ 		+
+ Fixed an issue where excessive dataplane debug logs were generated due + to the + pan_task + process restarting, even without any dataplane debug logs or captures + being enabled by the administrator. +
+
+
PAN-299678
+ 		+
+ Fixed an issue where the firewall repeatedly rebooted when downgrading + to an affected release. +
+
+
PAN-299623
+ 		+
+ (Panorama appliances in Management Only mode only) Fixed an issue where the firewall incorrectly allowed access to the + web interface on a blocked port. Additionally, after configuring a + custom certificate, Panorama continued to present the self-signed + certificate on the blocked port. +
+
+
PAN-299622
+ 		+
+ Fixed an issue where the MFA timestamp was not redistributed between + standalone firewalls behind an Azure load balancer after upgrading, + which resulted in users being prompted to reauthenticate multiple + times. +
+
+
PAN-299615
+ 		+
+ Fixed an issue where, when the Network Packet Broker feature was + enabled, forward TLS (non-decrypted) traffic was not working as + expected when there were segmented client hellos and a no-decrypt rule + existed. This issue occurred when Zone Protection profiles were + configured for trust/untrust zones but not attached to NPB zones. +
+
+
PAN-299495
+ 		+
+ Fixed an issue where the + show system setting ssl-decrypt certificate + CLI command did not display certificates when XML output was enabled. +
+
+
PAN-299450
+ 		+
+ Fixed an issue where PAN-OS + logrotate did not rotate large + log files until the + cron.daily + process ran, which resulted in the root partition filling up. +
+
+
PAN-299242
+ 		+
+ Fixed an issue where the firewall's SSL proxy sent an empty HTTP2 + SETTINGS message to the client before confirming server support, which + caused some clients to incorrectly assume HTTP/2 support and not fall + back to HTTP/1.1. Additionally, the firewall dropped HTTP1.1 400 Bad + Request frames from the server, which prevented the client from + correctly detecting the lack of HTTP/2 support. +
+
+
PAN-299193
+ 		+
+ Fixed an issue on the firewall where, after upgrading, autocommits + repeatedly failed until after a second reboot due to a timing issue + between content loading on the management plane card (MPC) and the log + receiver startup. +
+
+
PAN-299027
+ 		+
+ (Panorama virtual appliances in Management Mode only) Fixed an issue where a maximum configuration size of 120 was + incorrectly enforced instead of 150 MB. +
+
+
PAN-298945
+ 		+
+ Fixed an issue where OSCP HTTP POST requests were not formatted + correctly, which caused failures with strict responders. +
+
+
PAN-298929
+ 		+
+ (Firewalls in HA configurations only) Fixed an + issue where, after upgrading the ESXi host to version 8.0.3, the + firewall interface went down on the active firewall due to a behavior + change in ESXi 8. +
+
+
PAN-298872
+ 		+
+ (PA-400 Series firewalls in HA configurations only) Fixed an issue where ports went down after an HA failover. +
+
+
PAN-298654
+ 		+
+ Fixed an issue where the firewall generated false positive threat logs + during updates to a large domain list (EDL) when a DNS lookup for a + domain being added or removed occurred during the update process. This + resulted in a threat log being generated for a different, unrelated + domain that remained on the list. +
+
+
PAN-298505
+ 		+
+ Fixed an issue where, after upgrading an HA pair of PA-7050 firewalls, + the vsys ID changed in sequence, causing autocommit failures with + validation errors. This occurred when the multi-vsys firewall had + virtual systems created and pushed from Panorama, and the vsys ID was + not in a correct sequence because the unused vsys was deleted from + Panorama and pushed to devices. +
+
+
PAN-298252
+ 		+
+ Fixed an issue where Data Loss Prevention (DLP) inspection of chunked + transfer encoding over TLS resulted in incomplete file downloads on + Outlook Web App (OWA) due to the WIF page size limit, which led to + corrupted or incomplete PDF attachments. +
+
+
PAN-298141
+ 		+
+ Fixed an issue where the firewall experienced recurring kernel + segfaults related to multiple processes, which led to a SIGSEGV error. +
+
+
PAN-297976
+ 		+
+ Fixed an issue where the firewall experienced extended boot times + after a reboot due to the + configd + process needing to rebuild the ACE catalog after detecting + discrepancies that were caused by duplicate application checking + between the ACE catalog and content. +
+
+
PAN-297972
+ 		+
+ Fixed an issue where a dataplane crash occurred when traffic matched + Inline Cloud Analysis prefiltering signatures, even when Inline Cloud + Analysis features were not enabled. +
+
+
PAN-297963
+ 		+
+ Fixed an issue where PA-400 Series firewalls were not properly caching + DNS responses for FQDN objects. The firewall was observed to + repeatedly send DNS requests for the same FQDN objects every 10-15 + seconds, even after receiving valid responses, despite the minimum + FQDN refresh interval being set to a much higher value. This resulted + in excessive DNS queries originating from the firewall's management + interface. +
+
+
PAN-297819
+ 		+
+ Fixed an issue where the firewall was unable to send device telemetry + files to Cortex Data Lake due to the firewall receiving an invalid + upload token. +
+
+
PAN-297797
+ 		+
+ Fixed an issue where, during a refresh of a large External Dynamic + List (EDL), traffic that matched a domain on the list was incorrectly + identified as a different domain, which resulted in false positive + threat logs. +
+
+
PAN-297796
+ 		+
+ Fixed an issue on Panorama where the policy review feature in + Dynamic Updates failed to display + Security policy rules when the device group was set to + All. +
+
+
PAN-297775
+ 		+
+ Fixed an issue where, after upgrading to an affected PAN-OS release, + the Visible Virtual System field referenced the vsys name instead of + the vsys ID, which caused inter-vsys routing to fail. This occurred + when a vsys display name matched one of the vsys IDs. If you're using + a multivsys environment, you must upgrade your firewalls to a fixed + PAN-OS version. The best practice is to upgrade both the firewalls and + Panorama to a fixed PAN-OS version. +
+
+ If you don't upgrade Panorama to a fixed version, you'll encounter + PAN-245064, where a commit on a multivsys firewall fails with the + message + vsys name should end with a number vsys is invalid + after you + Export or push device config bundle + from 11.1.1 Panorama. +
+
+ After you upgrade Panorama to a fixed version, you'll encounter + PAN-214177, which causes an + Export or Push device config bundle + from Panorama to the firewall to fail. The workaround for PAN-214177 + is to first push only the template configuration and then push the + device group configurations. +
+
+
PAN-297761
+ 		+
+ Fixed an issue where the firewall incorrectly categorized some URLs as + not-resolved due to a conflict with Top Level Domain (TLD) data + handling in the PAN-DB URL cloud. This affected URLs under domains + marked as TLDs, which the firewall incorrectly assumed did not have + any category. +
+
+
PAN-297749
+ 		+
+ Fixed an issue where the redistribution agent status was blank on the + web interface on both the firewall and Panorama, even though the CLI + showed the agent as connected. +
+
+
PAN-297708
+ 		+
+ Fixed an issue where a long-lived session with many Machine Learning + (ML) model triggers caused a memory leak of feature states associated + with the ML model runs. This resulted in Spyware_State failure + increases, allocation max outs, and impaired policy matching. +
+
+
PAN-297609
+ 		+
+ Fixed an issue where the the CLI command + debug user-id refresh user-id agent all + failed with the error message + Invalid agent name. Agent name should be 1 to 31 characters + long. +
+
+
PAN-297540
+ 		+
+ (Panorama managed firewalls in HA configurations only) Fixed an issue where the HA-Link-Monitor configuration pushed from + Panorama was converted to a local configuration on the peer device + after an HA sync, which caused subsequent Panorama pushes of link + monitor changes to be flagged as overwritten, and a forced template + push or manual clearing of the configuration on the firewall was + required. +
+
+
PAN-297412
+ 		+
+ (VM-Series firewalls only) Fixed an issue where + the firewall rebooted unexpectedly due to a negative decoded length. +
+
+
PAN-297370
+ 		+
+ Fixed an issue where pushing a new object from Panorama to a Cloud + NGFW Device Group unexpectedly removed existing Panorama-pushed policy + rules, even though the + Push Preview did not show any + deletions, which led to traffic disruptions. +
+
+
PAN-297321
+ 		+
+ (Firewalls in active/active HA configurations only) Fixed an issue where return packets from a phone gateway looped + between the HA pair instead of being encapsulated into the + GlobalProtect tunnel. This occurred when the inner session and the + outer IPSec tunnel terminated on different nodes, which led to + excessive retries and packet drops. +
+
+
PAN-297320
+ 		+
+ (Panorama virtual appliances only) Fixed an + issue where scheduled configuration exports failed with an + invalid key error when connecting + to a SCP server using non-default SCP port. Also, additional CLIs were + added to delete the known-hosts file. +
+
+
PAN-297263
+ 		+
+ (PA-5220 firewalls only) Fixed an issue where + the + ikemgr + process crashed intermittently, which caused IPSec tunnels to go down + randomly. With this fix, the IKE Security association data structures + are accessed in a thread-safe manner, and the + ikemgr + process does not reference an invalid memory pointer during teardown + operations. +
+
+
PAN-296977
+ 		+
+ Fixed an issue where the web interface became unresponsive when + attempting to view + Ethernet interface details after + applying a filter in + Network > Interfaces. +
+
+
PAN-296749
+ 		+
+ Fixed an issue where email alerts sent from the firewall were marked + as spam due to the EHLO header containing only the firewall hostname + and not the fully qualified domain name (FQDN). +
+
+
PAN-296694
+ 		+
+ Fixed an issue where the firewall rebooted due to the + useridd + process repeatedly restarting during an IP-port data type writes to + the redis from multiple sources such as TSA or XML in a scale + environment. +
+
+
PAN-296592
+ 		+
+ Fixed an issue where a 404 error occurred when attempting to download + a sample file. +
+
+
PAN-296543
+ 		+
+ Fixed an issue where a memory leak related to the + configd + process occurred when committing configurations related to WildFire + Cloud Services or WildFire appliance settings. +
+
+
PAN-296535
+ 		+
+ Fixed an issue on the firewall where BGP peers disconnected when more + than 500 BGP neighbors were configured in a single Logical Router +
+
+
PAN-296490
+ 		+
+ (Firewalls with FIPS-CC mode enabled only) + Fixed an issue where Panorama on GCP lost access to management + interface after an hour of uptime. +
+
+
PAN-296453
+ 		+
+ Fixed an issue where decryption exclusion lists were not working for + untrusted certificates, and SSL sessions were still being decrypted + even after adding them to the exclusion list. This occurred because + the firewall was not adding sessions to the exclude cache until after + receiving a non-RFC alert (BadCertificate) from the server. The fix + ensures that the first session is added to the exclude cache, allowing + subsequent sessions to skip decryption. This issue affects firewalls + configured as clients in server-client communication. +
+
+
PAN-296452
+ 		+
+ Fixed an issue where, when Panorama manages Prisma Access, filtering + GlobalProtect logs by IPv6 subnets displays all logs, including IPv4 + logs. +
+
+
PAN-296443
+ 		+
+ (PA-5450 firewalls only) Fixed an issue where + the firewall had a lower maximum capacity for DIPP translated IP + addresses than the PA-5260, which caused configuration commit errors + during migration. With this fix, the maximum capacity on PA-5450 + firewalls has been increased to 8000. +
+
+
PAN-296397
+ 		+
+ Fixed an issue on the Panorama web interface where previewing changes + after a commit to shared objects were not accurately displayed in the + push scope. +
+
+
PAN-296206
+ 		+
+ Fixed an issue where the firewall incorrectly routed external Type-5 + Link State Advertisements (LSAs) within a stub area when the firewall + was configured as an Area Border Router (ABR) in a stub area and + learned about an external prefix from another ABR connected to the + backbone area. +
+
+
PAN-295951
+ 		+
+ Fixed an issue on firewalls in active/passive HA configurations where + CLI outputs incorrectly included XML formatting. +
+
+
PAN-295944
+ 		+
+ Fixed an issue where static routes remained active in the FIB and RIB + even when the associated physical port interface was down, which + resulted in traffic being incorrectly routed through a non-operational + interface. +
+
+
PAN-295796
+ 		+
+ Fixed an issue where the firewall intermittently failed to forward + VXLAN GARP packets, which led to connectivity issues for wireless + clients in environments that used VXLAN tunnels for wireless access + points. +
+
+
PAN-295766
+ 		+
+ (VM-Series firewalls in HA configurations only) + Fixed an issue where Panorama displayed incorrect packet buffer values + on the web interface and the CLI. +
+
+
PAN-295728
+ 		+
+ Fixed an issue where configuring an OSPFv2 NSSA area range caused + OSPF-learned routes to become unreachable due to the incorrect + installation of a discard route when the NSSA range prefix matched an + existing OSPF route. +
+
+
PAN-295662
+ 		+
+ Fixed an issue where Panorama displayed the URL instead of the file + name for vulnerability threat logs fetched from the Logging Service. +
+
+
PAN-295644
+ 		+
+ Fixed an issue where Strata Logging Service (SLS) log forwarding + streams intermittently displayed as inactive. +
+
+
PAN-295586
+ 		+
+ Fixed an issue where, after committing changes to a Certificate + Profile or other global configurations without any making changes to + the virtual system (vsys), the Data Redistribution include/exclude + lists were ignored on the firewall. This resulted in the firewall + receiving and processing User-ID information from all sources. +
+
+
PAN-295484
+ 		+
+ Fixed an issue where SD-WAN did not generate system logs with + timestamps and reasons for degradation of Direct Internet Access + paths. +
+
+
PAN-295470
+ 		+
+ Fixed an issue on the firewall where the + useridd + process continuously increased its memory consumption, which resulted + in an OOM condition that caused the firewall to restart. +
+
+
PAN-295421
+ 		+
+ Fixed an issue where the CLI command outputs incorrectly included XML + formatting tags. +
+
+
PAN-295385
+ 		+
+ Fixed an issue where syslog forwarding dropped due to FQDN resolution + failures. +
+
+
PAN-295342
+ 		+
+ Fixed an issue where the + pan_comm + process stopped responding due to insufficient time allocated to read + file descriptors when processing long messages. +
+
+
PAN-295257
+ 		+
+ Fixed an issue where, after onboarding a firewall to Panorama, IPsec + tunnels displayed IKEv2 in Panorama, even though the tunnels were + configured with IKEv1 locally on the firewall. +
+
+
PAN-295245
+ 		+
+ Fixed an issue where the + useridd + process stopped responding because the client was unavailable. +
+
+
PAN-295240
+ 		+
+ Fixed an issue where the source user field was intermittently missing + in traffic logs, even when the IP address-to-user mapping was + available. This occurred due to a race condition where the log + generation process preceded the creation of the IP address-to-user + mapping. +
+
+
PAN-295221
+ 		+
+ Fixed an issue where, after upgrading Panorama and Log Collectors from + PAN-OS 10.2.9 to PAN-OS 11.1.6-h6, Traffic and Threat logs were not + forwarded to a Splunk server over UDP. +
+
+
PAN-295185
+ 		+
+ (Panorama appliances only) Fixed an issue where + a custom administrator role with the permission + Network > QoS (Read Only) was + unable to create a QoS profile, even when the + Policies > QoS (Enabled) and + Network Profiles > QoS Profile (Enabled) + permissions were also set. +
+
+
PAN-295095
+ 		+
+ Fixed an issue where, when you used a syslog forwarding profile with + the CEF format, an additional string was appended to the end of the + log message when viewing the log entry from the Universal Forwarder + directory. +
+
+
PAN-294998
+ 		+
+ Fixed an issue where the LogDB incorrectly reported that the database + quota for extpcap logs was + reached. +
+
+
PAN-294898
+ 		+
+ (Panorama appliances only) Fixed an issue + where, when performing device software deployment to dedicated log + collectors, the Validate option did + not display the required software versions. Additionally, attempting + to download images to multiple log collectors simultaneously failed. +
+
+
PAN-294893
+ 		+
+ Fixed an issue where firewalls with the + Send handshake messages to CTD for inspection + setting enabled caused incorrect security policy rules to be matched + during the TLS handshake. Additionally, the expected response page for + blocked URLs was not displayed. +
+
+
PAN-294524
+ 		+
+ Fixed an issue where firewalls and Panorama management servers were + unable to view or download WildFire reports from a WF-500 appliance, + resulting in a 401 error in the report tab. +
+
+
PAN-294488
+ 		+
+ Fixed an issue where certificate data was missing in decryption logs + for No decrypt policy rules and + TLS1.2 traffic after upgrading , and the + Subject Common Name, + Issuer Common Name, + Certificate Start Date, + Certificate End Date, + Certificate Serial Number, and + Certificate Fingerprint fields were + blank in the decryption logs. +
+
+
PAN-294434
+ 		+
+ Fixed an issue where memory leaks occurred. These leaks were caused by + two distinct scenarios: the failure to deallocate memory for a nodeset + when a new nodeset was assigned to the same variable, and the failure + to free a UUID hash table during error conditions. +
+
+
PAN-294379
+ 		+
+ Fixed an issue where, when SD-WAN SaaS Application path monitoring + failed for all interfaces, the firewall stopped forwarding traffic + even if the ISP links and default gateway probing were still active. +
+
+
PAN-294307
+ 		+
+ Fixed an issue on Panorama where a + configd + SIGSEGV crash occurred when renaming objects within policy rules, + objects, or zones. +
+
+
PAN-294179
+ 		+
+ Fixed an issue where viewing, refreshing, and comparing config + versions in Config Audit caused the + configd + process to stop responding. If the page loaded successfully, some + commit versions displayed incorrect or missing data. +
+
+
PAN-294161
+ 		+
+ Fixed an issue where the firewall rebooted unexpectedly due to the + useridd + process restarting and causing an HA failover. This occurred due to + the + configd + process timing out when running the CLI command + show user user-id-agent config all. +
+
+
PAN-293985
+ 		+
+ Fixed an issue with the Panorama web interface where admin users were + unable to log in and received the error message + 504: Gateway Timeout. +
+
+
PAN-293825
+ 		+
+ Fixed an issue where packets with bad TCP checksums were transmitted + even when the + Strict TCP/IP checksum option was + enabled. +
+
+
PAN-293708
+ 		+
+ Fixed an issue where the + configd + process stopped responding when a partial revert operation was + performed on a newly added rule in a rulebase that was empty in the + running configuration. +
+
+
PAN-293707
+ 		+
+ Fixed an issue where the + iotd + process failed to install DPI Cloud server FQDN due to a configuration + parsing failure, caused by the configuration XML memory buffer not + being NULL terminated. This resulted in the accumulation of EAL logs + and DLP forwarding being stopped. +
+
+
PAN-293686
+ 		+
+ Fixed an issue where importing a device state file was incorrectly + allowed during an existing commit job. +
+
+
PAN-293644
+ 		+
+ (Firewalls in HA configurations only) Fixed an + issue where the + configd + process stopped responding during an External Dynamic List (EDL) + refresh. +
+
+
PAN-293561
+ 		+
+ Fixed an issue where users with a custom role-based administrator role + were unable to download the GlobalProtect client application via the + web interface even when the + GlobalProtect Client option was + enabled in the admin role profile. +
+
+
PAN-293428
+ 		+
+ Fixed an issue where the interval of IKEv1 Dead Peer Detection (DPD) + R-U-THERE packets did not correspond to the configured value in the + IKE Gateway profile due to using the value configured for retry + instead. +
+
+
PAN-293281
+ 		+
+ Fixed an issue where the reported throughput and packet rate were + higher than the actual interface traffic due to a double counting + error. +
+
+
PAN-293033
+ 		+
+ Fixed an issue on Panorama where + Push was disabled during a Selective + Push operation. +
+
+
PAN-292752
+ 		+
+ Fixed an issue where a command injection vulnerability occurred due to + improper input sanitization. +
+
+
PAN-292580
+ 		+
+ (Panorama appliances only) Fixed an issue where + the software deployment validation process did not display the + required software version for dedicated log collectors (DLCs), and + downloading software images to multiple DLCs failed. +
+
+
PAN-292529
+ 		+
+ Fixed an issue where HA configuration synchronization failed between + HA firewalls due to an empty interface node present only in the + passive firewall's running-config.xml file. +
+
+
PAN-292481
+ 		+
+ Fixed an issue where a memory leak occurred in autotagging when + communicating with multiple Panorama management servers. +
+
+
PAN-292393
+ 		+
+ Fixed an issue where TFTP file transfers intermittently timed out in + active-active HA pairs when the TFTP control channel was processed by + one firewall and the data channel was processed by the other. This + occurred because the firewall receiving the data channel failed to + match the predicted session due to asynchronous processing of HA + messages. +
+
+
PAN-292306
+ 		+
+ Fixed an issue where the + authd + process stopped handling RADIUS authentication requests and required a + restart. +
+
+
PAN-292242
+ 		+
+ Fixed an issue on M-200 and logging appliances where traffic logs were + intermittently truncated when forwarded using a TCP syslog + configuration. This issue occurred during the log forwarding stage due + to intermittent syslog drops caused by exceeding the forwarding queue + capacity. +
+
+
PAN-292220
+ 		+
+ Fixed an issue where the Status LED on PA-7500 SFCs did not work. +
+
+
PAN-292079
+ 		+
+ (Panorama appliances only) Fixed an issue where + the data on scheduled SaaS Application Usage Reports was different + than the data on on-demand reports generated via + Run Now. +
+
+
PAN-291984
+ 		+
+ Fixed an issue where SSH/SFTP traffic was intermittently blocked by + URL filtering due to the firewall incorrectly applying URL categories + from previous sessions. +
+
+
PAN-291973
+ 		+
+ Fixed an issue where the Advanced Routing Engine stopped responding + when a route-map was configured to match on a metric with a value of + 0. +
+
+
PAN-291940
+ 		+
+ Fixed an issue where the firewall established multiple TCP connections + to a syslog server, which caused logs to be dropped. This occurred + because the firewall established a new TCP session for each transfer + and the sessions were not closed, which resulted in a continuous + increase in connections over time. +
+
+
PAN-291883
+ 		+
+ Fixed an issue where Prisma Access logs were not visible in the + Security Logging Service (SLS) and Panorama. +
+
+
PAN-291716
+ 		+
+ Fixed an issue where during a commit, the firewall experienced an + out-of-memory (OOM) condition due to a memory leak and displayed an + error message. This issue caused the device to stop responding and + reboot unexpectedly. +
+
+
PAN-291661
+ 		+
+ Fixed an issue on Panorama appliances and Log Collectors where, after + an upgrade, Elasticsearch intermittently entered into a Red state + before automatically recovering. +
+
+
PAN-291635
+ 		+
+ Fixed an issue where cookie surrogate cache entries remained + unresolved after an + idmgr + process reset due to the request not being retransmitted. This + occurred because the timestamp in the cache entry was refreshed even + when the UID was 0, which prevented the retransmission of the request + if the initial response was not received. +
+
+
PAN-291593
+ 		+
+ (Firewalls in active/passive HA configurations only) Fixed an issue where, when the passive firewall was down and the + idmr + process was reset, the firewall generated the system log + User-ID manager was reset. Commit is not required to reinitialize + User-ID, even though the + idmr + process restart was not successful. +
+
+
PAN-291499
+ 		+
+ ( + VM-Series firewalls on Amazon Web Services (AWS) environments + only) Fixed an issue where newly deployed firewalls were unable to + connect to the Strata Logging Service (SLS) until after a reboot, + license fetch, or management server restart. +
+
+
PAN-291284
+ 		+
+ Fixed an issue where single-session IPSec VPN traffic was distributed + across multiple member interfaces of a Link Aggregation Group + configured with LACP. This resulted in packet reordering and loss, + which impacted VPN performance. +
+
+
PAN-291247
+ 		+
+ Fixed an issue where checksum values changed when downloading files + through TFTP on firewalls using subinterfaces. +
+
+
PAN-291067
+ 		+
+ Fixed an issue where the + devsrvr + process periodically exceeded its virtual memory limit and restarted, + which led to intermittent outages. +
+
+
PAN-291009
+ 		+
+ Fixed an issue where, after a web server returned a 401 or 403 error, + the firewall was unable to decrypt HTTP/2 traffic, and the firewall + rejected all subsequent streams from the client. +
+
+
PAN-290954
+ 		+
+ Fixed an issue where the web server used a low HTTP Strict Transport + Security (HSTS) max-age value of 86400 seconds for the + log.query.expression.js.php page. +
+
+
PAN-290948
+ 		+
+ Fixed an issue where the proxy hid the Cache-Control header, which + prevented context switching. +
+
+
PAN-290923
+ 		+
+ (Panorama virtual appliances only) Fixed an + issue on the web interface where you were unable to export the + Threat Map. +
+
+
PAN-290851
+ 		+
+ Fixed an issue where the Agent User Override Key was incorrectly + available for configuration on Panorama management servers when + running in FIPS-CC mode. +
+
+
PAN-290783
+ 		+
+ Fixed an issue where the + debug dataplane nat sync-ippool + command did not accurately account for all allocated ports or + display/sync leaks when multiple NAT rules use the same IP pool. This + resulted in inaccurate reporting of leaked ports. The fix modifies the + implementation to directly compare the original pool against the + temporary pool across all vsys. +
+
+
PAN-290728
+ 		+
+ Fixed an issue where modifying an interface IP address on an existing + vsys caused a default vsys1 to be + created, which led to commit failures due to the maximum supported + number of vsys being reached. +
+
+
PAN-290694
+ 		+
+ Fixed an issue on the Panorama web interface where you were unable to + push shared objects to devices if an + HA failover occurred during a configuration push. +
+
+
PAN-290663
+ 		+
+ (Panorama managed firewalls in HA configurations only) Fixed an issue where the firewall did not enforce serial number + validation during HA deployment or replacement, which resulted in + pairs being established even when the serial numbers configured on + Panorama did not not match the serial number of the devices. +
+
+
PAN-290455
+ 		+
+ Fixed an issue where the + Pprof + path was missing in the + logrcvr + script, which prevented the conversion and decoding of addresses in + the resulting stack when running + Pprof + against + Logrcvr. +
+
+
PAN-290157
+ 		+
+ Fixed an issue on Panorama where the + configd + process stopped responding when filtering in the + Config Audit window, which caused + Panorama to restart unexpectedly. +
+
+
PAN-290117
+ 		+
+ (Firewalls in active/passive HA configurations only) Fixed an issue with high dataplane CPU utilization on both active + and passive firewalls. +
+
+
PAN-290088
+ 		+
+ Fixed an issue where a memory leak occurred related to the + configd + process when pushing configurations from Panorama to a firewall. This + occurred when the configurations contained shared policy rules. +
+
+
PAN-289852
+ 		+
+ Fixed an issue where websites did not load when accumulation proxy was + enabled. +
+
+
PAN-289822
+ 		+
+ Fixed an issue where the Policy Optimization feature did not display + values correctly when the language was not set to English. +
+
+
PAN-289736
+ 		+
+ Fixed an issue where partial-revert operations were taking a long + time, causing config lock timeout issues and resulting in frequent + error messages being displayed: + Timed out while getting config lock. Please try again. +
+
+
PAN-289383
+ 		+
+ Fixed an issue where the MPLS interface eth1/6 went down and remained + down, even after replacing the SFP with a supported one and adjusting + duplex and speed settings. +
+
+
PAN-289249
+ 		+
+ Fixed an issue where a memory leak occurred on the + reportd + process when a WildFire update was initiated while device telemetry + data collection was in progress. This resulted in an OOM condition. +
+
+
PAN-289067
+ 		+
+ Fixed an issue where, after upgrading Panorama in a High Availability + (HA) pair, the configuration logs stopped synchronizing from the + primary Panorama to the secondary Panorama. This issue occurred + because the log forwarding flag was permanently disabled due to the + connection state not being active when the + log-fwd-ctrl message was + received. +
+
+
PAN-288939
+ 		+
+ Fixed an issue where the + logrcvr + process stopped responding due to an invalid SSL context being used + for socket communication, which caused commits to fail. +
+
+
PAN-288869
+ 		+
+ Fixed an issue where custom administrators with visibility into + specific vsys logs were able to view logs for all vsys. +
+
+
PAN-288617
+ 		+
+ Fixed an issue where the firewall attempted to connect to + wildfire.paloaltonetworks.com when a user downloaded a WildFire PDF + report from the CSP/WF portal even if the user was not behind the + firewall. +
+
+
PAN-288175
+ 		+
+ Addressed a stack buffer overflow memory leak under plugin management + code path. +
+
+
PAN-288141
+ 		+
+ Fixed an issue where the + debug data-plane sync ippool CLI + command did not work for Per Destination IP Pool (PDIPP) and caused a + memory leak. +
+
+
PAN-288139
+ 		+
+ Fixed an issue where the firewall incorrectly identified ports as + leaking when the session was not active even though the ports were + allocated. +
+
+
PAN-287978
+ 		+
+ Fixed an issue where a directly connected interface or aggregate + interface did not appear in the routing table, which caused ping + failures to the directly connected interface. +
+
+
PAN-287693
+ 		+
+ Fixed an issue where Panorama did not use the configured proxy + settings to check WildFire private cloud content and instead connected + directly to the WildFire device using the management interface. This + occurred even when + Use Proxy Settings for Private Cloud + was enabled. +
+
+
PAN-287599
+ 		+
+ Fixed an issue where the prefix value for a BGP neighbor caused the + firewall to leak routes to a different BGP peer. +
+
+
PAN-287394
+ 		+
+ (CN-Series firewalls only) Fixed an issue where + the firewall generated critical system log alerts every 3 minutes. +
+
+
PAN-287387
+ 		+
+ Fixed an issue on Panorama where API jobs failed with the error + message + Server error: Timed out while getting config lock. This occurred due to slow set request performance when setting a + large number of address objects in a single set call. +
+
+
PAN-287280
+ 		+
+ Fixed an issue where a + configd crash occurred when the + Policies > Security view was + updated or refreshed in the web interface. +
+
+
PAN-287159
+ 		+
+ Fixed an issue where file uploads to Dropbox stalled when using a + PA-CPT device with MLC2 and DLP Mirror mode enabled for HTTP2 traffic. + This occurred because the proxy was unable to decrement packet counts + properly when the queue was large, resulting in a receive window size + of 0 for the parent session. +
+
+
PAN-287086
+ 		+
+ Fixed an issue where PA-3420 firewalls experienced unexpected reboots + due to the + all_task_7 + process crashing with signal 6, leading to a non-functional state. +
+
+
PAN-287034
+ 		+
+ Fixed an issue where sequence numbers were skipped for all types of + logs on the firewall due to audit logs being generated but not written + to disk when Audit Tracking was enabled. +
+
+
PAN-286865
+ 		+
+ Fixed an issue where, when you upgraded log collectors via Panorama + (Device Deployment), the software + installation on the log collector remained at 0%. +
+
+
PAN-286534
+ 		+
+ Fixed an issue where a multi-vsys firewall was unable to retrieve + address groups and address objects pushed from Panorama as shared + objects when using the REST API. +
+
+
PAN-285315
+ 		+
+ Fixed an issue on Panorama where the log forwarding queue depth was + not accurately displayed in the logd.log files. +
+
+
PAN-285208
+ 		+
+ Fixed an issue where the firewall did not automatically recover after + a machine check exception (MCE) occurred. +
+
+
PAN-284872
+ 		+
+ Fixed an issue where ENA (Elastic Network Adapter) extended statistics + (conntrack allowance metric) were unavailable in DPDK 22.11.x. This + metric is now available through AWS Cloudwatch. +
+
+
PAN-284801
+ 		+
+ Fixed an issue where the OpenConfig plugin was automatically installed + on VM Panorama and firewalls after upgrading. +
+
+
PAN-284417
+ 		+
+ Fixed an issue where proxied traffic was shown as decrypted even when + no applicable decryption policy rule was configured. Additionally, the + show session CLI command and the + session browser web interface incorrectly displayed cleartext proxy + sessions as decrypted. +
+
+
PAN-283333
+ 		+
+ Fixed an issue where threat logs displayed logs from the + N/A threat category when a random + string was used for the + category-of-threatid filter in + threat logs. +
+
+
PAN-283237
+ 		+
+ Fixed an issue where traffic logs incorrectly displayed the action as + allow for traffic matching a + Security policy rule configured with the action set to + deny. This issue occurred due to the + child session being used for policy rule lookup when a configuration + update triggered a rematch if the FTP-data application was not in the + rule. +
+
+
PAN-282335
+ 		+
+ Fixed an issue where firewalls in a cluster experienced approximately + 50% packet loss on IPSec NATT tunnels when tunnel acceleration was + enabled. +
+
+
PAN-281588
+ 		+
+ Fixed an issue where packet buffer depletion occurred due to the a + high number of + tcp_pkt_queued packets when Jumbo + was enabled. +
+
+
PAN-280917
+ 		+
+ Fixed an issue on Panorama where the WildFire cloud URL contained an + extra period character, which prevented the retrieval of WildFire + analysis reports. +
+
+
PAN-280536
+ 		+
+ Fixed an issue where firewalls that were connected to the same Cloud + Identity Engine displayed inconsistent group membership information, + with some firewalls showing only a subset of users belonging to a + group. This occurred due to a full or incremental group sync failure. +
+
+ This fix introduces a retry mechanism for failed group queries to the + Cloud Identity Engine. To use this feature, run the following CLI + commands. +
+
+ To enable the retry mechanism: + debug user-id dscd retry-enable on. +
+
+ To set the retry time: + debug user-id dscd retry-time set-time <1-10>. The default value is 5 seconds. +
+
+ To set the number of retry attempts: + debug user-id dscd retry attempts set-attempts <3-10>. The default value is 5 attempts. +
+
+ To disable the retry mechanism: + debug user-id dscd retry-enable off. +
+
+ Additionally, a system log is now generated when a group sync fails, + and you are able to monitor the group sync status with the following + CLI commands: +
+
    +
  • + show user group count list cloud-identity-engine +
    • +
  • + show user group count name <group_name> +
    • +
+
+
PAN-279829
+ 		+
+ Fixed an issue where NAT pool leaks occurred during a test when RTSP + traffic hit NAT rules. +
+
+
PAN-279364
+ 		+
+ (VM-Series firewalls with multiple NICs only) + Fixed an issue were the queue count in the task dump displayed an + incorrect number of queues for SR-IOV interfaces due to the queue + mapping logic incorrectly using a non-multi-NIC function. +
+
+
PAN-278834
+ 		+
+ (Firewalls in HA configurations only) Fixed an + issue where the + configd + process stopped responding with a segmentation fault. +
+
+
PAN-278611
+ 		+
+ Fixed an issue on Panorama where software images were not purged from + the /opt/pancfg/mgmt/sw-images folder. +
+
+
PAN-277971
+ 		+
+ Fixed an issue where the PA-5220 firewall reports inaccurate NetFlow + statistics for DNS flows after upgrading to PAN-OS 10.2.13. +
+
+
PAN-277629
+ 		+
+ Fixed an issue where the firewall did not match the correct policy for + SSL forward decrypted HTTP/2 traffic when upgrading from PAN-OS + 10.2.9-h1 to PAN-OS 11.2.3. +
+
+
PAN-274742
+ 		+
+ (VM-Series firewalls only) Fixed an issue where + the task-queue dump CLI command + returned incorrect information in multi-nic mode. +
+
+
PAN-274484
+ 		+
+ Fixed an issue where commits failed when + Data Services was in a Service route + configuration was configured with the + MGMT interface. +
+
+
PAN-273028
+ 		+
+ Fixed an issue where manual SCP exports from firewalls in FIPS mode + were successful to SCP servers that were not FIPS-compliant. This + occurred because the manual SCP process did not enforce FIPS security + checks. +
+
+
PAN-271643
+ 		+
+ Fixed an issue where, when a commit job ID was higher than 65535, the + XML API truncated the ID to a 16-bit unsigned integer due to an + incorrect type case during printing, which resulted in an incorrect + job ID being reported compared to the CLI output for the same commit. +
+
+
PAN-271239
+ 		+
+ Fixed an issue where searching for the GlobalProtect client version + browser in Panorama logs returned no results. +
+
+
PAN-269342
+ 		+
+ Fixed an issue where BGP aggregate routes with the AS-SET option + enabled had incorrect AS paths. +
+
+
PAN-269176
+ 		+
+ Fixed an issue where the + domain-edl column was empty in the + threat log even when a threat was detected as a DNS alert. +
+
+
PAN-268038
+ 		+
+ Fixed an issue where the + routed process on Orion-ZTNA NGFW + Connectors stopped responding when a destination FQDN path monitor + configuration was present and the + show routing path-monitor CLI + command was executed due to the CLI command handler dereferencing a + null pointer without proper validation. +
+
+
PAN-267965
+ 		+
+ (Firewalls on Amazon Web Services (AWS) environments only) Fixed an issue where newly bootstrapped firewalls sent an + incorrect, non-DHCP-assigned hostname to the SNMP server. This + occurred because the SNMP process referred to a configuration file + that was not updated due to a missing configuration commit. +
+
+
PAN-267450
+ 		+
+ Fixed an issue where the + reportd + process stopped responding with a SIGSEGV at + schedule_report_es_response. +
+
+
PAN-266843
+ 		+
+ Fixed an issue on airgapped firewalls where cloud connection errors + flooded the system logs. +
+
+
PAN-265744
+ 		+
+ Fixed an issue where the firewall repeatedly generated false critical + alerts due to an Intel firmware issue. +
+
+
PAN-264762
+ 		+
+ Fixed an issue where the firewall showed the status of SFP+ interfaces + as not up, or up but not configured, when a PAN-SFP-PLUS-SR cable was + connected. +
+
+
PAN-264349
+ 		+
+ Fixed an issue where the Management Processor Card (MPC) on modular + firewalls became unresponsive when a disk drive entered a low-power + state and failed to wake up. +
+
+
PAN-263691
+ 		+
+ Fixed an issue where the firewall rebooted unexpectedly due to a + memory leak in the + all_task + process. +
+
+
PAN-262831
+ 		+
+ (PA-5400f Series firewalls only) Fixed an + intermittent issue where the + all_task + process stopped responding, which caused the firewall to restart. +
+
+
PAN-262353
+ 		+
+ Fixed an issue where, when Panorama was upgraded but log collectors + were on an earlier version, logs from a log collector group were not + viewable on a Panorama. +
+
+
PAN-260782
+ 		+
+ Fixed an issue where telemetry did not send data if + Could not resolve or + No route to host were returned + even when the connection was successful. +
+
+
PAN-259785
+ 		+
+ Fixed an issue where the + devsrvr + process restarted and created a core dump because two threads did not + terminate correctly. +
+
+
PAN-258425
+ 		+
+ Fixed an issue where the ACC tab did not display any data when + selecting a user group in the + Global Protect Activity filter. +
+
+
PAN-254946
+ 		+
+ Fixed an issue where the firewall HA2 keep-alive went down multiple + times without a specific reason. +
+
+
PAN-251897
+ 		+
+ Fixed an issue where GlobalProtect user traffic intermittently did not + match the correct Security policy rule with HIP objects due to the + firewall learning the GlobalProtect IP address-to-user mapping from + multiple sources. +
+
+
PAN-251035
+ 		+
+ Fixed an issue where selective push operations did not push + certificate changes to the firewall. +
+
+
PAN-251024
+ 		+
+ Fixed an issue where GlobalProtect logs did not show the correct + region for the IP address due to content updates not retrieving the + latest configuration. +
+
+
PAN-250339
+ 		+
+ Added an improvement to automatically clean up idle HTTP connection + pools to address an issue where idle connection pools accumulated when + a circuit breaker limit was reached, which caused client requests to + fail with a 503 + no_healthy_upstream error. +
+
+
PAN-248913
+ 		+
+ Fixed an issue where the Elasticsearch client certificate was not auto + renewed, which caused it to enter a Red state, and logs were not + displayed in Panorama. +
+
+
PAN-245120
+ 		+
+ Fixed an issue where telemetry data was not sent to Cortex Data Lake + for devices with a management interface with IPv4 and IPv6 (dual + stack)due to the firewall not checking HTTP codes to determine if the + data was sent successfully. +
+
+
PAN-242952
+ 		+
+ Fixed an issue where high SSL traffic depleted flex memory, which + prevented the firewall from revalidating SSLVPN client CAs during + configuration pushes. +
+
+
PAN-241694
+ 		+
+ Fixed an issue where memory leaks related to the + devsrvr + process occurred when downloading and pushing updates from the App-ID + Cloud Engine to the dataplane. +
+
+
PAN-241467
+ 		+
+ (Cloud NGFWs in Microsoft Azure environments only) Fixed an issue where, on Panorama management servers, firewalls + connected through a public IP address did not automatically receive + content updates. This occurred when the Panorama server had the latest + content downloaded but the content information was not updated in the + contentinfo.xml file. +
+
+
PAN-239917
+ 		+
+ Fixed an issue where the + configd + process experienced an OOM condition during extended operations with + XML API calls. +
+
+
PAN-236892
+ 		+
+ Fixed an issue on Panorama with the Cloud Services plugin where the + firewall template setting to enable secure Panorama communication + under Secure Client Communication was not visible in the user + interface, even though it was accessible via the CLI. +
+
+
PAN-216770
+ 		+
+ Fixed an issue where, when a firewall was managed by Strata Cloud + Manager and configured to use a proxy server for external connections, + the management server did not use the configured settings to connect + to the Cloud Management service. +
+
+
PAN-213491
+ 		+
+ Fixed an issue where the management CPU was high, which caused the web + interface to be slower than expected. +
+
+
PAN-185731
+ 		+
+ Fixed an issue where the firewall was unable to parse the URL path and + host when the host header was located in a different packet, which + resulted in the firewall not logging the URL path in the first packet. +
+
+ The fix is disabled by default. The following CLI commands can be used + to enable/disable the feature: +
+
    +
  • + set system setting ctd url-crosspkt-host-path-caching + enable +
    • +
  • + set system setting ctd url-crosspkt-host-path-caching + disable +
    • +
  • + set system setting ctd url-crosspkt-host-path-caching + default +
    • +
+
diff --git a/reference/PAN-OS/addressed/11.1.4-h32.html b/reference/PAN-OS/addressed/11.1.4-h32.html new file mode 100644 index 0000000..bc22678 --- /dev/null +++ b/reference/PAN-OS/addressed/11.1.4-h32.html @@ -0,0 +1,143 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-308654
+ 		+
+ Fixed an issue where the Elasticsearch Close Indices process closed + more indices than expected and dropped the number of open shards below + the minimum of 800 per Elasticsearch instance. This occurred because + the process did not correctly account for the number of Elasticsearch + instances when calculating the maximum number of allowed open shards. +
+
+
PAN-292306
+ 		+
+ Fixed an issue where the + authd + process stopped handling RADIUS authentication requests and required a + restart. +
+
+
PAN-291716
+ 		+
+ Fixed an issue where during a commit, the firewall experienced an + out-of-memory (OOM) condition due to a memory leak and displayed an + error message. This issue caused the device to stop responding and + reboot unexpectedly. +
+
+
PAN-291288
+ 		+
+ Fixed an issue where the firewall rebooted unexpectedly due to a + pan_task + process restart related to page allocation failures. +
+
+
PAN-290088
+ 		+
+ Fixed an issue where a memory leak occurred related to the + configd + process when pushing configurations from Panorama to a firewall. This + occurred when the configurations contained shared policy rules. +
+
+
PAN-273158
+ 		+
+ (PA-7000 Series firewalls only) Fixed an issue + where an incorrect ASIC configuration caused silent packet drops or + application slowness when receiving a mix of jumbo and non-jumbo + packets. +
+
+
PAN-245686
+ 		+
+ Fixed an issue where memory leaks occurred when checking for, + downloading, or installing dynamic updates. +
+
diff --git a/reference/PAN-OS/known/11.1.14.html b/reference/PAN-OS/known/11.1.14.html new file mode 100644 index 0000000..96682b5 --- /dev/null +++ b/reference/PAN-OS/known/11.1.14.html @@ -0,0 +1,815 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Issue ID
+ 		+
Description
+
+
PAN-308564
+ 		+
+ Packets are dropped on SD-WAN interfaces if they require fragmentation + for an interface but have the + Don't Fragment (DF) bit set. This + results in unexpected packet drops. This affects client to server + sessions when using SD-WAN for NGFW. +
+
+ Workaround: Allow fragmenting packets with DF bit + set (debug dataplane set ip4-ignore-df yes). +
+
+
PAN-303959
+ 		+
+ Traffic that is incorrectly identified as unknown-tcp/unknown-udp + eventually drops due to an App-ID resource limitation issue. +
+
+
PAN-292202
+ 		+
+ The system logs repeatedly displayed the alert + Clearing snmpd.log due to log overflow + due to the SNMP counters rolling over. This is a benign message and + does not impact device functionality. +
+
+
PAN-289432
+ 		+
+ Generating a certificate with the + block-private-key yes command on + Panorama fails with the error: +
+
+ Could not get parameters for double encryption. + This occurred when the certificate was signed by an external + Certificate Authority (CA). +
+
+
PAN-286848
+ 		+
+ ECMP incorrectly balances sessions across links based on the + configured metric, which leads to an imbalance in traffic distribution + and results in traffic assignment shifting disproportionately to + routes with lower metrics. +
+
+
PAN-286496
+ 		+
+ (NGFW Clusters) URL-continue and override + continue selections will function like a general URL-block action. +
+
+
PAN-285894
+ 		+
+ If the Preserve Pre-NAT feature is enabled, dataplane crashes may + occur, which could result in firewall reboots. +
+
+ Workaround: Disable the Preserve Pre-NAT feature + using the + set deviceconfig setting preserve-prenat-feature no + CLI command. +
+
+
PAN-283429
+ 		+
+ When you use custom certificates for the connection between Panorama + and a log collector, the automated renewal for the predefined + ElasticSearch certificates gets disrupted. +
+
+ Workaround: Remove the custom certificates before + the ElasticSearch certificates expire. This allows the system to + correctly identify and renew the predefined ElasticSearch + certificates. After the renewal is complete, re-install the custom + certificates. +
+
+
PAN-279415
+ 		+
+ Service routes configured for a data plane interface might incorrectly + route traffic through the management plane interface instead. This + issue impacts Syslog and CRL status traffic when the service route + lacks a specific destination custom service route. +
+
+
PAN-276920
+ 		+
+ URL filtering response pages may load slowly or fail to display when + users request websites that are blocked in the URL Filtering profile + (site access for the corresponding URL category is + block, + continue, or + override) attached to the matching + Security policy rule. This occurs on an intermittent basis. +
+
+
PAN-275047
+ 		+
+ (VM-Series firewalls only) After an upgrade, + the firewall is unable to send logs to the Strata Logging Service + (SLS) when using a specific proxy server, and the SSL connection + status displays as failed when attempting to forward logs through the + web proxy. +
+
+
PAN-273158
+ 		+
+ (PA-7000 Series firewalls only) Due to an + incorrect configuration on the ASIC, receiving a mix of jumbo and + non-jumbo packets may cause silent packet drops or application + slowness. +
+
+
PAN-262556
+ 		+
+ The ElasticSearch cluster health status might continue to remain + yellow for an extended period after upgrading to PAN-OS 11.1 +
+
+
PAN-260851
+ 		+
+ From the NGFW or Panorama CLI, you can override the existing + application tag even if Disable Override is enabled for the + application (ObjectsApplications) tag. +
+
+
PAN-254240
+ 		+
+ In the event of an HSCI flap on an NGFW cluster node, traffic + reconvergence takes three to four seconds. +
+
+
PAN-253963
+ 		+
+ The auto commit job may take longer than expected to complete when the + Panorama management server is in Panorama or Log Collector mode. +
+
+
PAN-251551
+ 		+
+ When an NGFW cluster agent crashes and doesn't recover, leader + election will take approximately 45 seconds to begin and traffic + failover will occur during that time. +
+
+
PAN-250903
+ 		+
+ In a congestion scenario on an HSCI port of an NGFW cluster node, the + QoS priorities of cross node traffic streams might be reversed if + you're using the default QoS profile with class1 to class8 set as high + to low. +
+
+
PAN-247974
+ 		+
+ LACP flap is expected during a device failover in an NGFW cluster due + to an L2 ctrld restart on the new leader node. +
+
+
PAN-234015
+ 		+
+ The X-Forwarded-For (XFF) value is not displayed in traffic logs. +
+
+
PAN-224502
+ 		+
+ The autocommit time of the VM-Series firewall running PAN-OS 11.1.0 + might take longer than expected. +
+
+
PAN-220180
+ 		+
+ Configured botnet reports (MonitorBotnet) are not generated. +
+
+
PAN-207733
+ 		+
+ When a DHCPv6 client is configured on HA Active/Passive firewalls, if + the DHCPv6 server goes down, after the lease time expires, the DHCPv6 + client should enter SOLICIT state on both the Active and Passive + firewalls. Instead, the client is stuck in BOUND state with an IPv6 + address having lease time 0 on the Passive firewall. +
+
+
PAN-207611
+ 		+
+ When a DHCPv6 client is configured on HA Active/Passive firewalls, the + Passive firewall sometimes crashes. +
+
+
PAN-207442
+ 		+
+ For M-700 appliances in an active/passive high availability (PanoramaHigh Availability) configuration, the + active-primary HA peer + configuration sync to the + secondary-passive HA peer may + fail. When the config sync fails, the job Results is + Successful + (Tasks), however the sync status on + the Dashboard displays as + Out of Sync for both HA peers. +
+
+ Workaround: Perform a local commit on the + active-primary HA peer and then + synchronize the HA configuration. +
+
    +
  1. +
    + Log in to the Panorama web interface + of the active-primary HA + peer. +
    +
    2. +
  2. +
    + Select Commit and + Commit to Panorama. +
    +
    3. +
  3. +
    + In the active-primary HA peer + Dashboard, click + Sync to Peer in the High + Availability widget. +
    +
    4. +
+
+
PAN-207040
+ 		+
+ If you disable Advanced Routing, remove logical routers, and downgrade + from PAN-OS 11.0.0 to a PAN-OS 10.2.x or 10.1.x release, subsequent + commits fail and SD-WAN devices on Panorama have no Virtual Router + name. +
+
+
PAN-206913
+ 		+
+ When a DHCPv6 client is configured on HA Active/Passive firewalls, + releasing the IPv6 address from the client (using Release in the UI or + using the + request dhcp client ipv6 release all + CLI command) releases the IPv6 address from the Active firewall, but + not the Passive firewall. +
+
+
PAN-206909
+ 		+
+ The Dedicated Log Collector is unable to reconnect to the Panorama + management server if the configd + process crashes. This results in the Dedicated Log Collector losing + connectivity to Panorama despite the managed collector connection + Status (PanoramaManaged Collector) displaying connected and the + managed colletor Health status + displaying as healthy. +
+
+ This results in the local Panorama config and system logs not being + forwarded to the Dedicated Log Collector. Firewall log forwarding to + the disconnected Dedicated Log Collector is not impacted. +
+
+ Workaround: Restart the + mgmtsrvr process on the Dedicated + Log Collector. +
+
    +
  1. +
    + Log in to the Dedicated Log Collector CLI. +
    +
    2. +
  2. +
    + Confirm the Dedicated Log Collector is disconnected from Panorama. +
    + +
    + 
    admin> show panorama-status
    +
    + Verify the Connected status + is no. +
    +
    +
    3. +
  3. +
    + Restart the mgmtsrvr process. +
    + +
    + 
    admin> debug software restart process management-server
    +
    +
    4. +
+
+
PAN-197588
+ 		+
+ The PAN-OS ACC (Application Command Center) does not display a widget + detailing statistics and data associated with vulnerability exploits + that have been detected using inline cloud analysis. +
+
+
PAN-197419
+ 		+
+ (PA-1400 Series firewalls only) In + NetworkInterfaceEthernet, the power over Ethernet (PoE) ports do not display a + Tag value. +
+
+
PAN-196758
+ 		+
+ On the Panorama management server, pushing a configuration change to + firewalls leveraging SD-WAN erroneously show the auto-provisioned BGP + configurations for SD-WAN as being edited or deleted despite no edits + or deletions being made when you + Preview Changes (CommitPush to DevicesEdit Selections + or + CommitCommit and PushEdit Selections). +
+
+
PAN-195968
+ 		+
+ (PA-1400 Series firewalls only) When using the + CLI to configure power over Ethernet (PoE) on a non-PoE port, the CLI + prints an error depending on whether an interface type was selected on + the non-PoE port or not. If an interface type, such as tap, Layer 2, + or virtual wire, was selected before PoE was configured, the error + message will not include the interface name (eg. ethernet1/4). If an + interface type was not selected before PoE was configured, the error + message will include the interface name. +
+
+
PAN-194978
+ 		+
+ (PA-1400 Series firewalls only) In + NetworkInterfaceEthernet, hovering the mouse over a power over Ethernet (PoE) + Link State icon does not display + link speed and link duplex details. +
+
+
PAN-187685
+ 		+
+ On the Panorama management server, the Template Status displays no + synchronization status (PanoramaManaged DevicesSummary) after a bootstrapped firewall is successfully added to Panorama. +
+
+ Workaround: After the bootstrapped firewall is + successfully added to Panorama, + log in to the Panorama web interface + and select + CommitPush to Devices. +
+
+
PAN-187407
+ 		+
+ The configured Advanced Threat Prevention inline cloud analysis action + for a given model might not be honored under the following condition: + If the firewall is set to + Hold client request for category lookup and the action set to + Reset-Both and the URL cache has + been cleared, the first request for inline cloud analysis will be + bypassed. +
+
+
PAN-186283
+ 		+
+ Templates appear out-of-sync on Panorama after successfully deploying + the CFT stack using the Panorama plugin for AWS. +
+
+ Workaround: Use + CommitPush to Devices + to synchronize the templates. +
+
+
PAN-184708
+ 		+
+ Scheduled report emails (MonitorPDF ReportsEmail Scheduler) are not emailed if: +
+
    +
  • + A scheduled report email contains a Report Group (MonitorPDF ReportsReport Group) which includes a SaaS Application Usage report. +
    • +
  • + A scheduled report contains only a SaaS Application Usage Report. +
    • +
+
+ Workaround: To receive a scheduled report email + for all other PDF report types: +
+
    +
  1. + Select + MonitorPDF ReportsReport Groups + and remove all SaaS Application Usage reports from all Report + Groups. +
    2. +
  2. + Select + MonitorPDF ReportsEmail Scheduler + and edit the scheduled report email that contains only a SaaS + Application Usage report. For the Recurrence, select + Disable and click + OK. +
    + Repeat this step for all scheduled report emails that contain only + a SaaS Application Usage report. +
    +
    3. +
  3. + Commit. +
    + (Panorama managed firewalls) Select + CommitCommit and Push +
    +
    4. +
+
+
PAN-184406
+ 		+
+ Using the CLI to add a RAID disk pair to an M-700 appliance causes the + dmdb process to crash. +
+
+ Workaround: Contact customer support to stop the + dmdb process before adding a RAID disk pair to a M-700 appliance. +
+
+
PAN-183404
+ 		+
+ Static IP addresses are not recognized when "and" operators are used + with IP CIDR range. +
+
+
PAN-181933
+ 		+
+ If you use multiple log forwarding cards (LFCs) on the PA-7000 series, + all of the cards may not receive all of the updates and the mappings + for the clients may become out of sync, which causes the firewall to + not correctly populate the Source User column in the session logs. +
+
diff --git a/reference/urls.json b/reference/urls.json index aa91ff3..74d87e0 100644 --- a/reference/urls.json +++ b/reference/urls.json @@ -152,6 +152,10 @@ "addressed": "https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/pan-os-11-1-4-known-and-addressed-issues/pan-os-11-1-4-h27-addressed-issues", "known": "" }, + "11.1.4-h32": { + "addressed": "https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/pan-os-11-1-4-known-and-addressed-issues/pan-os-11-1-4-h32-addressed-issues", + "known": "" + }, "11.1.5": { "addressed": "https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/pan-os-11-1-5-known-and-addressed-issues/pan-os-11-1-5-addressed-issues", "known": "https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/pan-os-11-1-5-known-and-addressed-issues/pan-os-11-1-5-known-issues" @@ -311,6 +315,10 @@ "11.1.13-h3": { "addressed": "https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/pan-os-11-1-13-known-and-addressed-issues/pan-os-11-1-13-h3-addressed-issues", "known": "" + }, + "11.1.14": { + "addressed": "https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/pan-os-11-1-14-known-and-addressed-issues/pan-os-11-1-14-addressed-issues", + "known": "https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/pan-os-11-1-14-known-and-addressed-issues/pan-os-11-1-14-known-issues" } } } \ No newline at end of file