--- type: Addressed product: PAN-OS version: 11.2.7-h12 --- ## PAN-316911 ```caveat VM-Series firewalls on Amazon Web Services (AWS) environments only ``` Fixed an issue where a newly bootstrapped firewall required a management server restart, relicensing, or license push from Panorama to invoke the device certificate. ## PAN-315912 Fixed an issue where the Maximum Segment Size (MSS) rewrite functionality for packets ingressing through SD-WAN interfaces on firewalls was not optimized. ## PAN-314147 Fixed an issue where SSL traffic was dropped on SD-WAN DIA interfaces with member having different MTU. ## PAN-313623 Fixed an issue where the /opt/pancfg/mgmt/ssl/private/ directory on Palo Alto Networks devices with TPM support became 100% utilized due to an accumulation of undeleted .pub_pem files. This occurred because executing the show device-certificate status CLI command initiated a process that generated these files but failed to remove them, which prevented the fetching of new device certificates. ## PAN-313216 Fixed an issue where firewalls with Prisma Access incorrectly displayed some traffic as unsanctioned in traffic logs for cloud applications that were tagged as **sanctioned**. ## PAN-312706 Fixed an issue where the firewalls restarted due to a function lacking a NULL-pointer sanity check. ## PAN-311512 Fixed an issue where HIP (Host Information Profile) reports were blocked on GlobalProtect when **Authentication Cookie Usage Restrictions** was enabled and the Prisma Access Agent protocol was in use. This occurred because the system failed to correctly process HIP messages that were relayed via IPSec tunnels with a Virtual IP as the source, leading to their rejection. ## PAN-309300 Fixed an issue where management plane system resources configuration size exceeded 28 MB for over 4 hours, and the following error message was displayed: Configuration size reaching device capacity limit. ## PAN-308786 ```caveat Panorama appliances only ``` Fixed an issue where traffic log queries using the **device_name** filter returned no results, and complex log queries that included negation operators produced incorrect outputs. ## PAN-308564 Fixed an issue where packets were dropped on SD-WAN interfaces when a proxy was enabled due to an MTU inconsistency where the firewall failed to rewrite the maximum segment size in SYN/ACK packets based on the SD-WAN virtual interface MTU. **Note**: This fix does not apply when the traffic egress interface is SD-WAN Direct Internet Access (DIA) interface and proxy is enabled. ## PAN-308507 ```caveat Panorama managed firewalls only ``` Fixed an issue where the firewall intermittently failed to maintain active log forwarding streams to Strata Logging Service (SLS) even when duplicate logging and enhanced application logging were enabled. ## PAN-308418 Fixed an issue where, when Advanced DNS Security was enabled and experienced unusually high loads, DNS resolution failures occurred with the error **resources-unavailable**. ## PAN-306555 Fixed an issue where the firewall stopped responding, which led to service outages. ## PAN-304019 ```caveat VM-Series firewalls only ``` Fixed an issue where the firewall did not send traffic to SCM or SLS via a configured explicit proxy IP address when the proxy username was not configured. ## PAN-303745 Fixed an issue where inter-dataplane forwarding did not work for sessions ingressing on Slot 2, which resulted in intermittent ping failures to interfaces on Network Card 2 when traffic was forwarded to Slot 3. **Note**: With this fix, after a slot restart, the global counter will still show dot1q errors for a short period. ## PAN-302983 Fixed an issue where, after committing changes on Panorama, a shared post-rule moved to the end of the post shared rulebase on the managed device instead of remaining at the top. ## PAN-302564 Fixed an issue on the firewall where a path monitoring failure occurred and caused the dataplane to restart. ## PAN-301653 Fixed an issue where DNS traffic sessions prematurely terminated with the message resources-unavailable. This occurred due to IPv4 fragmented DNS responses causing the Advanced DNS Security module to incorrectly pack the DNS payload multiple times when forwarding to the cloud for inspection. ## PAN-300837 Fixed an issue where firewalls experienced multiple reboots due to the pan_task process restarting with a SIGSEGV signal. This occurred because the client-to-firewall side assumed TLS 1.3 for the firewall-server side. ## PAN-300671 Fixed an issue where traffic reports that were generated with destination/source and destination/source hostnames were not displayed in IPv4 format. ## PAN-300423 Fixed an issue where Data Processing Cards (DPCs) installed in slots 5 and 6 remained stuck in a starting state with the error **Signal detected for port xeS5-DP0 but Link Down** alerts, which resulted in device instability. ## PAN-299242 Fixed an issue where the firewall's SSL proxy sent an empty HTTP2 SETTINGS message to the client before confirming server support, which caused some clients to incorrectly assume HTTP/2 support and not fall back to HTTP/1.1. Additionally, the firewall dropped HTTP1.1 400 Bad Request frames from the server, which prevented the client from correctly detecting the lack of HTTP/2 support. ## PAN-298617 Optimized the commit workflow to reduce the size of the effective configuration, resulting in lower memory consumption. ## PAN-297708 Fixed an issue where a long-lived session with many Machine Learning (ML) model triggers caused a memory leak of feature states associated with the ML model runs. This resulted in Spyware_State failure increases, allocation max outs, and impaired policy matching. ## PAN-295802 Fixed an issue where a memory leak related to the configd process occurred. ## PAN-295309 Fixed an issue where OSPF session using MD5 authentication experienced intermittent flapping due to out-of-order packet processing. ## PAN-293644 ```caveat Firewalls in HA configurations only ``` Fixed an issue where the configd process stopped responding during an External Dynamic List (EDL) refresh. ## PAN-290938 Fixed an issue where multiple memory leaks occurred related to the configd process. ## PAN-264762 Fixed an issue where the firewall showed the status of SFP+ interfaces as not up, or up but not configured, when a PAN-SFP-PLUS-SR cable was connected. ## PAN-263691 Fixed an issue where the firewall rebooted unexpectedly due to a memory leak in the all_task process. ## PAN-248913 Fixed an issue where the Elasticsearch client certificate was not auto renewed, which caused it to enter a Red state, and logs were not displayed in Panorama.