--- type: Addressed product: PAN-OS version: 11.1.10-h1 --- ## PAN-241230 Fixed an issue where the SNMP get request status value for Panorama connections was incorrect. ## PAN-253187 ```caveat PA-5450 firewalls only ``` Fixed an issue where the class of service (CoS) priority bit was not modified, causing access points to lose connectivity to the wireless controller when traffic was routed through the firewall. ## PAN-253778 ```caveat PA-7500 Series firewalls in a cluster configuration only ``` Fixed an issue where users were able to enable or disable certain configurations. ## PAN-290239 ```caveat PA-455 firewalls in active/passive HA configurations only ``` Fixed an issue where, after an upgrade, the TCP session for syslog forwarding did not resume after the syslog server service was disabled and then re-enabled, which caused logs to be dropped. This occurred when the syslog server was down for more than 16 minutes. ## PAN-290088 Fixed an issue where a memory leak occurred related to the configd process when pushing configurations from Panorama to a firewall. This occurred when the configurations contained shared policy rules. ## PAN-289304 ```caveat PA-7500 firewalls only ``` Fixed an issue where SNMP polling failed due to the snmpd process becoming unresponsive to incoming requests, which resulted in high CPU usage. ## PAN-289102 Fixed a race condition issue related to predict processing on multi-core platforms, which resulted in a dataplane restart and traffic loss. ## PAN-288930 Fixed an issue where traffic from cloud applications intermittently matched an incorrect cloud-apps policy rule when ACE (App-ID Cloud Engine) was enabled. ## PAN-288893 ```caveat Firewalls in multi-vsys configurations only ``` Fixed an issue where HTTP/2 traffic failed due when one virtual system (vsys) had a decryption policy rule enabled and another vsys had a no-decrypt policy rule for the same session. ## PAN-288363 Fixed an issue where the MIB ID returned an incorrect value via SNMP. ## PAN-287838 ```caveat Panorama appliances only ``` Fixed an issue on the web interface where resetting the rule hit counter for multiple policy rules failed with the error message Failed to reset rule-hit job. ## PAN-287818 Fixed an issue where sessions timed out sooner than expected due to the pan_proxy_accumulation_ restore_timeout not initiating when the accumulation session_init failed. ## PAN-287734 Fixed an issue where Scan ERR: Internal Err 1002 messages were unexpectedly generated when WIF shared memory use was high. ## PAN-287621 Added debug logs for an issue where a slow IP address pool NAT leak occurred when persistent NAT was enabled, which led to NAT IP pool exhaustion. ## PAN-287584 Fixed an issue on the web interface where the address object pop up window only displayed a maximum of four address objects in the policy rule even after expanding the window. ## PAN-287056 Fixed an issue where BGP export policy rules with next-hop matching failed to block the advertisement of static routes, and the firewall incorrectly matched the egress interface IP address instead of the original next-hop IP address of the static route, which caused the deny rule to fail. ## PAN-287023 Fixed an issue where a large number of logs caused the logrcvr process to stop responding. ## PAN-286857 Fixed an issue where only failed Kerberos authentication events were logged in auth.log, and successful authentication events were not logged. ## PAN-286848 Fixed an issue where ECMP incorrectly balanced sessions across links based on the configured metric, which led to an imbalance in traffic distribution and resulted in traffic assignment shifting disproportionately to routes with lower metrics. ## PAN-286443 Fixed an issue where, after an upgrade, the firewall was unable to be managed via HTTPS or SSH. ## PAN-286306 Fixed an issue where, when getting transceiver information from ESCC for SFP 25G modules, the transceiver code was incorrectly updated with Unknown instead of 25GBase-SR. ## PAN-285894 Fixed an issue where the all_task process stopped responding, which caused the firewall to reboot unexpectedly, and traffic failures occurred. ## PAN-285818 Fixed an issue where a tool was needed to display leaked NAT port numbers without requiring a forced synchronization. ## PAN-284908 Fixed an issue where retrieving filenames from OneDrive resulted in a cache miss. ## PAN-284067 Fixed an issue where the devsrvr process experienced OOM conditions due to the show running application statistics CLI command, which caused the firewall to reboot. ## PAN-284003 Fixed an issue where clients did not receive a valid response when when searching a website due to a compression error. ## PAN-283979 Fixed an issue where the firewall became non-functional due to high root partition use. ## PAN-283813 Fixed an issue on Panorama where the web interface performance was slower than usual when retrieving read-only configurations from Panorama. ## PAN-282394 Fixed an issue where a firewall was only able to display a maximum of 14 permitted IP addresses from a Panorama Template Variable. ## PAN-282277 Fixed an issue where an OOM condition on the logrcvr process caused interface flapping, and the interface unexpectedly went down and then recovered without intervention. ## PAN-281509 ```caveat Panorama appliances only ``` Fixed an issue where log exports were slower than expected or failed when filtering logs after an upgrade, which resulted in timeouts or delays in displaying logs on the web interface. ## PAN-280101 Fixed an issue where set and edit commands took longer than expected when adding address objects with a large number of dynamic groups due to the completion cache being enabled. With this fix, the completion cache is disabled by default. ## PAN-279706 ```caveat M-600 appliances only ``` Fixed an issue where Panorama did not update all panreplay database entries after performing a commit and full push to all devices. ## PAN-279500 Fixed an issue where TLS connections failed to establish in asymmetric routing environments if the firewall did not see server-to-client (s2c) packets of the TLS handshake. To use this fix, run the following CLI command: debug dataplane set ssl-decrypt accumulate-client-hello asym-disable yes. ## PAN-278836 Fixed an issue where, after an upgrade, GlobalProtect attempted to use the embedded browser instead of the default browser for gateway authentication even when it was configured to use the default browser. ## PAN-278812 Fixed an issue where authentication to GlobalProtect failed with the error message User not in allowed list. ## PAN-278150 Fixed an issue where the firewall removed the Authentication Key Identifier (AKID) from the certificate during SSL decryption, which caused Python 3.13 to fail with a certificate verification error. ## PAN-277808 Fixed an issue where the eproxy process stopped responding when running a long duration test using IXload with hybrid SWG SAML authentication bypass for HTTPS payloads, which caused the proxy to become unreachable. ## PAN-277617 Fixed an issue where deleting the NTP server address caused a commit validation error. This occurred when the configuration included both primary and secondary NTP servers and the secondary server was removed. ## PAN-277234 Fixed an issue where a device group import resulted in a Security policy rule being created with Application set to none. ## PAN-276920 Fixed an issue where web-advertisement traffic was not immediately blocked which resulted in pages loading indefinitely. ## PAN-276678 Fixed an issue where Panorama became unresponsive while performing a dynamic address update without a lock. ## PAN-275451 ```caveat Panorama appliances only ``` Fixed an issue where sequence numbers were lost when forwarded from Panorama, which resulted in missing or lost logs. ## PAN-275133 Fixed an issue where HTTP 503 server errors occurred while browsing websites due to slow Secure Web Gateway (SWG) bypass rule lookup. ## PAN-275047 ```caveat VM-Series firewalls only ``` Fixed an issue where, after an upgrade, the firewall was unable to send logs to the Strata Logging Service (SLS) when using a specific proxy server, and the SSL connection status displayed as failed when attempting to forward logs through the web proxy. ## PAN-274797 Fixed an issue where a DPC on slot 3 failed intermittently due to the pktlog_forwarding process restarting, which resulted in an unexpected HA failover. ## PAN-273964 Fixed an issue where SNMP scans to a firewall timed out after upgrading to a PAN-OS 10.2 release. ## PAN-272395 Fixed an issue where informational logs caused the distributord process log file to be frequently overwritten. ## PAN-272175 Fixed an issue where session rematch caused ACE cloud application traffic to match the wrong policy. ## PAN-271810 Fixed an issue where auto-negotiation advertised and negotiated 10/100 half and full duplex. ## PAN-271432 Fixed an issue where the firewall was unable to decrypt SSL traffic when using forward proxy and HSM with an ECDSA signing certificate. ## PAN-271425 ```caveat Firewalls in active/active HA configurations only ``` Fixed an issue with SSL inbound decryption on firewalls on a vwire setup with asymmetric routing. To use this fix, enter the CLI command set system setting ssl-decrypt ha-vwire-mac-learn global yes on both firewalls in an HA pair. ## PAN-269700 Fixed an issue where commits to service connection firewalls from Panorama failed. ## PAN-269057 Fixed an issue where the routed process stopped responding due to accessing freed memory from a hash table when the route vectors were resized. This occurred when a large number of static routes were configured. ## PAN-268787 Fixed an issue where users were unable to log in to Panorama and the following error message was displayed: Timed out while getting config lock. Please try again. This occurred when pushing configurations to a large number of devices. ## PAN-268313 Fixed an issue where the Priority Code Point (PCP) bits in the VLAN header were not reset to 0 when a packet was received from one Layer 3 tagged interface and forwarded to another, which resulted in dropped packets. To use this fix, run the CLI command set force-vlan-pcp-reset yes and reboot the firewall. ## PAN-267759 Fixed an issue where Prisma Access gateway downloads were slower than expected. ## PAN-267328 Fixed an issue where the all_task process stopped responding, which caused the firewall to stop processing traffic. ## PAN-264708 Fixed an issue where a selective push was blocked when a configuration load was done. ## PAN-259727 ```caveat Panorama appliances in HA configurations only ``` Fixed an issue where Panorama became unresponsive and displayed a 504 gateway timeout error when accessing the web interface or the CLI. ## PAN-253778 ```caveat PA-7500 Series firewalls in a cluster configuration only ``` Fixed an issue where users were able to enable or disable certain configurations. ## PAN-253187 ```caveat PA-5450 firewalls only ``` Fixed an issue where the class of service (CoS) priority bit was not modified, causing access points to lose connectivity to the wireless controller when traffic was routed through the firewall. ## PAN-241230 Fixed an issue where the SNMP get request status value for Panorama connections was incorrect.