Fixed an issue threat reports were empty when generated from Panorama, but displayed correctly when generated from the firewall.

Fixed an issue where large IPv6 packets were reassembled incorrectly on the firewall when the packets arrived fragmented over an IPv4 tunnel.

Fixed an issue where the logd process repeatedly restarted when the SD-WAN site name was over 31 characters and contained certain XML escape characters.

Fixed an issue where the web interface did not display a message to commit prior changes before attempting a partial configuration load.

Fixed an issue where navigating Panorama > Monitor > Logs was slower than expected.

Fixed an issue where the firewall lost the pre-shared key configuration assigned from a PSK variable when an unrelated device group configuration was loaded.

(PA-1400 Series firewalls only) Fixed an issue on the web interface where Enable Bonjour Reflector was not displayed (Network > Interfaces > Ethernet Interface).

Fixed an issue where SMTP packets were not sent out when the Client Hello arrived at the firewall in multiple out-of-order segments and the traffic was not subject to SSL decryption.

Fixed an issue where scheduled SaaS application usage reports were generated incorrectly, and the login page was displayed instead of the report content.

Fixed an issue where the CLI did not display a message to commit prior changes before loading a partial configuration.

Fixed an issue where the configuration audit displayed inaccurate information after partially loading the configuration via the CLI, which caused the audit to flag the configuration as deleted or changed.

(PA-445 firewalls only) Fixed an issue where the firewall did not properly power cycle during a reboot.

Fixed an issue where a policy-based forwarding (PBF) rule with an action of no-pbf and a service of TCP-22 did not match traffic after upgrading to PAN-OS 11.1.5-h1. As a result, traffic was matched by a lower rule with a service of any and an action of forward.

Fixed an issue where the logrcvr process discarded logs due to a full queue.

Fixed an issue where the XML API and REST API failed to run commands with an error.

Fixed an issue where the packet buffer size increased significantly when WildFire File Forwarding was continued after a threat detection and then canceled.

Fixed an issue where the GlobalProtect client displayed an error message when you clicked Check Now and Preferred Releases and Base Releases were unchecked (Device > Software).

Fixed an issue where the password expiry prompt was not visible when logging in via the web interface.

(Panorama virtual appliances only) Fixed an issue where Panorama stopped responding when running reports.

Fixed an issue where multicast flows were dropped due to a missing sysd variable for maximum multicast routes.

Fixed an issue where importing a firewall with a large number of address objects into Panorama did not work and remained at 99% completion.

Fixed an issue where the Panorama web interface was slower than expected and Elasticsearch CPU usage was high.

Added support for bootstrapping Panorama virtual appliances on ESXi.

Fixed an issue where Panorama stopped forwarding logs to a Syslog server after upgrading to PAN-OS 11.1.5-h1.

Fixed an issue where the Log Collector service did not start on a new Log Collector appliance added to a Log Collector group. As a result, the new Log Collector appliance did not appear in the cluster and the number of nodes in the cluster was incorrect.

Fixed an issue where DNS Security intermittently logs malicious domain URLs as Alert instead of taking a Sinkhole action, even when configured to Sinkhole malicious DNS domains.

(M-600 appliances only) Fixed an issue where the Elasticsearch cluster certificate (CC) status displayed with a past expiration date, which caused all shards to be unassigned.

Fixed an issue where the firewall might reboot when traffic matches with certain Advanced features (such as Advanced Threat Prevention and Advanced URL Filtering with properly configured URL Filtering/Anti-Spyware/Vulnerability security profiles) and Shared Pool Type 32 becomes depleted.

Fixed an issue where empty traffic logdb folders were generated for each day even when traffic logs were not received by the logrcvr process.

Fixed an issue where the devsrvr process restarted after a failed commit due to an invalid memory access.

Fixed an issue on PA-5450 in FIPSCC mode where a firewall rebooted into maintenance mode when it was manually rebooted from the web interface.

(M-600 Appliances only) Fixed an issue where the web interface was slow when logging in and filtering for policies due to deep search operations taking longer than expected.

Fixed an issue where Global Search did not redirect correctly to routing profiles when searching for their names.

Fixed an issue where the firewall rebooted continuously after upgrading to PAN-OS 11.1.5-h1 when a tunnel session was established in a Gateway Load Balancing (GWLB) scenario and no data packet was associated with the packet.

Fixed an issue where you were unable to use the s_encrypted field in custom reports for the Panorama threat log database.

Fixed an issue where the transmit power for a cable that was used on port 44 displayed as N/A.

Fixed an issue where GlobalProtect health information (HIP) did not display the certificate key usage.

Fixed an issue where the firewall generated the following error message in the snmpd logs: pan_get_keystr_from_cryptod(pan_snmpinterface.c:181): Key X2F1dGhfa2V5 import from cryptod failed.

Fixed an issue where the firewall skipped the DNS policy rule of a domain external dynamic list (EDL) during an EDL refresh.

Fixed an issue where packets were dropped initially when a SYN cookie with activation threshold 0 was enabled.

Fixed an issue where logs in the cloud database displayed in the Not-Resolved category but not in the local database.

Fixed an issue where firewalls configured with a VPN tunnel stopped responding when a configuration update was applied.

Fixed an issue where restarting the firewall did not initiate an autocommit job, which caused the firewall to stop responding and the HA interface to go down.

Fixed an issue where GlobalProtect clients on macOS devices were prompted to enter their username and password for Kerberos SSO authentication.

Fixed an issue where the Panorama web interface was slower than expected due to excessive polling of the MonitorDirect.getTasks API by the Task Manager.

Fixed an intermittent issue where SSL decryption failed.

Fixed an issue where commits from Panorama to VM-Series firewalls on Microsoft Azure environments failed.

Fixed an issue where you were unable to export the GlobalProtect client software version to the SCP server.

(PA-440 firewalls only) Fixed an issue where the firewall entered an unstable state after committing changes or onboarding to Panorama.

Fixed an issue where non-captive portal traffic was not visible under Traffic Logs when the traffic was denied by an authentication rule and the session was discarded.

Fixed an issue on the web interface where the URL Filtering change category feature did not work.

Fixed an issue where the firewall did not display VPC endpoints when there was a large amount of VPC endpoints to interface mappings.

(PA-1420 firewalls only) Fixed an issue where the firewall reported unsupported SFPs when PAN-SFPPLUS10GBASE-T SFPs were used on ports Ethernet 1/21 and 1/22.

Fixed an issue where the firewall displayed packet buffers between 18 and 19 even when there was little or no traffic.

Fixed an issue where plugin_api_server could experience a memory leak when using OpenConfig for telemetry.

Fixed an issue where the firewall dropped the AAAA DNS server response and caused delays in traffic from Ubuntu or Linux clients when DNS Security was enabled.

Fixed an issue where the firewall might crash and reboot when DoH is enabled for DNS Security and multiple DoH transactions are sent in a single HTTP/1 connection.

Fixed an issue where the push scope did not populate when attempting to push a policy to a device group.

Fixed an issue where the firewall logs displayed the reason for data filtering action as FW Skipped: XXXX.

Fixed an issue where User-ID connections were lost after an HA failover.

Fixed an issue where the firewall did not increase the metric of the default route when redistributed into OSPF when the firewall was configured as an NSSA ABR.

(PA-1400 and PA-3400 Series firewalls only) Fixed an issue where the firewall displayed the error message Failed to parse pbf policy when you committed a configuration that included more than 8 Policy Based Forwarding (PBF) rules with symmetric return enabled.

Fixed an issue on the firewall that caused the following error message to be displayed: frr_ns0: failed to stop child frr_ns0_ospf6d.

A CLI counter was added to indicate a full suppression queue.

Fixed an issue where Device Telemetry failed due to an issue with the encoding of characters in the log file path.

Fixed an issue where committing changes to Advanced Routing and redistribution profiles failed while pushing the configuration from SCM.

(7000-Series firewalls in HA configurations only) Fixed an issue where the firewall failed over into a non-functional state, and the LFC LED was blinking on the passive firewall.

Fixed a memory leak issue related to the configd process that occurred when running consecutive commits for mulitple days.

Fixed an issue where the show system statistics application CLI command failed.

Fixed an issue where API calls to Panorama failed with the error Server error : Timed out while getting config lock. Please try again.

Fixed an issue where the firewall didn't restart after applying an air-gapped license if the firewall capacity was the same as the license capacity. The additional character in subscription is tracked fixed as IT issue.

Fixed an issue where the userid process stopped responding due to memory was being reset to NULL when it was freed.

Fixed an issue where the GlobalProtect client (UWP) or metered hotspot connections triggered TLS resumption fo GlobalProtect portal authentication, which caused the portal authentication to fail with a valid cert required error.

Fixed an issue where the Low free buffer limit output was not available.

Fixed an issue where the firewall failed to forward logs to a SNMP trap server if the SNMP manager IP address was unable to be resolved.

Fixed an issue where the Panorama management server changed its certificate authority (CA) unexpectedly, which caused managed firewalls to disconnect.

Fixed an issue where the firewall attempted to connect to the AppID cloud using gRPC even when App-ID Cloud Engine was disabled.

Fixed an issue threat reports were empty when generated from Panorama, but displayed correctly when generated from the firewall.

Fixed an issue where half-closed TCP sessions did not refresh the session timeout when continuously receiving data after setting the cfg.session.tcp-no-refresh-fin-rst option toTrue.

Fixed an issue where GlobalProtect clients failed to connect with the error message The device or feature requires a GlobalProtect subscription license.

Fixed an issue where the firewall rebooted unexpectedly when configuring the GlobalProtect portal and gateway from Panorama.

Fixed an issue where the scheduled report generation script did not return debug information.

Fixed an issue where the firewall did not query for an AAAA record when only IPv6 was enabled for the management interface.

Fixed an issue where the firewall did not send the client hello to the server when the server hello message contained a certificate with a common name of 0.0.0.0.

Fixed an issue where the firewall redirected the user to the first application instead of the portal page with a list of applications when multiple applications were configured for GlobalProtect clientless VPN along with any user match.

(VM-Series firewalls only) Fixed an issue where the aggressive clean-up threshold for disk space was set to 95% in system monitor.

Fixed an issue where the varrcvr process stopped responding.

Fixed an issue where traffic was blocked by a URL filtering profile even though the Security policy rule did not have a URL filtering profile configured.

Fixed an issue related to external dynamic lists that caused commit times on the firewall to be higher than expected.

Fixed an issue where IP address tags were removed from firewalls after a management server or useridd process restart. This occurred when a Panorama serial-number based configuration was used for User-ID redistribution.

Fixed an issue where a large number of logs caused the logrcvr process to stop responding.

Fixed an issue where PDF summary and email reports displayed IPv6 addresses instead of IPv4 addresses.

Fixed an issue where the XML API call to clear rule hit count using device group syntax failed with an error.

Fixed an issue where traffic did not match the correct security policy when using an application-filter that references a cloud application. This occurred when a high number of cloud applications were attached with a custom tag.

Fixed an issue where GlobalProtect users with client certificates received an authentication failure message without entering a password and clicking connect or login.

Fixed an issue where the firewall displayed 0 bytes received for GlobalProtect SSL sessions in the traffic logs.

Fixed an issue where the web interface was slower than expected when logging in and filtering for policies.

Fixed a Threat log PCAP ID overwrapping issue.

Fixed an issue where the execute show transceiver-detail all XML API command returned an incorrect value for the low temperature alarm threshold.

Fixed an issue where autocommits failed if the management IPv6 gateway was the same as the dataplane interface IP address.

Fixed an issue where GlobalProtect clients intermittently failed to connect to the gateway with the error message could not connect to gateway.

Fixed an issue where uploading files that were 5GB or larger to Google Drive or Youtube failed when a decryption policy rule for http2 was enabled

Fixed an issue where tagging devices in Panorama did not work as expected.

Fixed an issue on firewalls in active/passive HA configurations where, after a failover, irrelevant routing FIB entries were seen in the routing table on the newly active firewall.

Fixed an issue on the Panorama web interface where Application and Category was not able to be selected under Test Policy Match.

Fixed an issue where UserID stopped working when the show object registered user CLI command was used with start-point and limit options.

Fixed an issue where the firewall did not detect the eth1/1 and eth1/2 interfaces when you created a firewall on an ESXi 8 server.

Fixed an issue where the Panorama web interface was slower than expected due to high CPU utilization on the mongodb process.

Fixed an issue where an External Dynamic List (EDL) IP address in an unsupported format was recognized as valid on the firewall.

Fixed an issue where WildFire submission logs incorrectly reported allowed malicious samples even when they were blocked by threat prevention profiles.

(Firewalls in HA configuration only) Fixed an issue where the Network pre-negotiation enabled page did not display on the firewall dashboard.

Fixed an issue where the firewall failed to upload a macOSX file if the file had a MIME boundary.

Fixed an issue where the firewall did not send User-ID redistribution messages to Panorama when the firewall had multiple virtual systems configured and one of the virtual systems had a display name that was the same as the existing vsys name.

Fixed an issue where the firewall dropped packets if the log rate exceeded the configured maximum log rate.

Fixed an issue on the firewall where ICMP ping loss occurred after installing a Network Processing Card (NPC) in slot 7.

Fixed an issue where multicast streams were unstable with ECMP and dropped every 30 seconds.

Fixed an issue where sessions ended with the message decrypt error in the logs for traffic that matched a no-decrypt policy.

(PA-800 firewalls in HA configurations only) Fixed an issue where the Link LEDs for ethernet1/9 to ethernet1/12 did not turn off after a failover.

Fixed an issue where filtering BGP routes by peer name in Advanced Routing Engine (ARE) did not display the correct routes.

Fixed an issue where an email was able to be transferred to the destination MTA even when the firewall detected a suspicious file with a reset-bot action when it was encrypted by STARTTLS.

Fixed an issue on Panorama where a cyclic nested address group configuration caused the configd process to stop responding after a commit.

Fixed an issue on the firewall where traffic matched a custom signature even if the custom signature was removed from the configuration.

Fixed an issue where unexpected path monitor failures caused the firewall to stop responding.

Fixed an issue where users were unable connect to the portal due to Certificate Revocation List (CRL) checks due to the downloaded CRL file being expired, which caused the CRL cache to be bypassed.

Fixed an issue where partial commits failed when objects that were referenced in a high number of Security policy rules were renamed. In such cases below error would be seen in configd logs, "Limit printing dirty xpaths in journal at count 3000"

To overcome the 3000 xpaths change limit, use the command to set the limit to a higher value and restart configd daemon. " debug management-server max-ref-xpaths "

Fixed an issue where selective pushes did not work as expected when the device group was renamed by a different admin user.

Fixed an issue on the firewall where, when a high number of SD-WAN branch sites or interfaces were not connected, SD-WAN processes and tund processes stopped responding due to a high probing rate.

Fixed an issue where the number of hints values were not updated even when there were no hint files on the system.

Fixed an issue where Hybrid-SWG explicit proxy connections failed when the number of destination domains exceeded 1024.

Fixed an issue where BFD sessions took longer than expected to establish after an HA failover due to BGP.

Fixed an issue on Panorama where the default version of IKE gateway was not set to IKEv2 only mode, which caused VPN establishment issues if the firewall recognized a new configuration as IKEv1.

Fixed an issue where URLs did not work due to certificate revocation list (CRL) requests failing.

Added debug functionality in the packet-diag log to address an issue regarding policy rule matching.

(PA-3400 Series firewalls only) Fixed an issue where the all_task process stopped responding, which caused the firewall to reboot.

Fixed an issue where double-clicking the login button returned the error message Login session expired.

Fixed an issue where the firewall stopped responding due to a tund process or SD-WAN process restart.

Fixed an issue where the all_task process stopped responding, which caused the dataplane to go down.

Fixed an issue where the GlobalProtect portal logged passwords in cleartext.

Fixed an issue where the flow process restarted with the error message SIGABRT __GI_raise __GI_abort __libc_message malloc_printer.

Fixed an issue where changes made to device groups with the same prefix name were not visible in the commit scope.

Fixed an issue where the firewall did not shut down completely.

Fixed an issue on Panorama where you were unable to change the order of traffic steering rules.

Fixed an issue where the Log Forwarding for Security Services feature did not correctly filter policy rules with log forwarding profiles.

Fixed an issue where the maximum session limit for a vsys was 4,194,290.

(VM-Series firewalls only) Fixed an issue where the all_task process stopped responding and a reboot was required.

Fixed an issue where the firewall did not start Elasticsearch after a commit if Elasticsearch was not previously enabled and started.

Fixed an issue where the firewall sent a 503 response when a client connected to a web server when the firewall was configured as a web proxy and authentication bypass for Kerberos was enabled.

Fixed an issue where the CLI and XML API values for the show system environment command did not match.

Fixed an issue where the Authentication Portal did not work properly with session cookies when the request to the portal contained the header Sec-Fetch-Site=cross-site.

(PA-5400 Series firewalls only) Fixed an issue where the firewall sent correlated event logs to the syslog server using the management interface instead of the log interface.

Fixed an issue where the firewall stopped responding after the all_task process stopped responding.

Fixed an issue where disk space that was used by file descriptors was not freed, which caused the root partition to become full and Panorama to be inaccessible.

(VM-Series firewalls in HA configurations only) Fixed an issue where the firewall rebooted due to multiple HA failovers.

Fixed an issue where multiple DNS responses with different CNAME values caused evasion false positive alerts.

Fixed an issue where management plane CPU usage increased after upgrading when there was a full-mesh User-ID redistribution configuration between multiple firewalls.

Fixed an issue where Microsoft Outlook did not work as expected when the GlobalProtect clientless VPN was configured.

(PA-455 firewalls in HA configurations only) Fixed an issue where the HA LED light on the front panel did not turn on even when HA was enabled.

Enhanced debugging capability when the control network to DP0 was not reliable when the J2C port was down.

(PA-3410, PA-3420, and PA-3430 firewalls only) Fixed an issue where the maximum supported number of zones was 200.

Fixed an issue on the firewall where cfg.developer.tasks had a default configuration of True, which capped dataplane CPU performance at 50% in production.

(Panorama appliances only) Fixed an issue where the configd process experienced continuous high CPU utilization and repeatedly restarted.

(Firewalls in active/active HA configurations only) Fixed an issue where non-tunneled internal GlobalProtect gateway client information was not synced between firewall peers when using a floating IP address.

Fixed an issue where the error message Failed to reload config files displayed in the system logs even when device telemetry was not enabled.

Fixed an issue where the firewall generated the error message Successfully generating a new set of config files in the system logs even when device telemetry was not enabled.

Fixed an issue where the service route setting for HTTP was not applied when the source interface IP address was set via an address object, which caused HTTP traffic to be sent from the management interface.

Fixed an issue where the firewall did not display the converted configurations before a commit and reboot, and the commit failed when attempting to migrate from MS to FRR mode.

Fixed an issue where the XML API key length exceeded the buffer size when the API key lifetime was changed from the default value.

(VM-Series firewalls in Microsoft Azure environments only) Fixed an issue where enabling flow basic on firewalls caused ARP entries to be removed on both firewalls.

Fixed an issue where the firewall configuration process restarted during an External Dynamic List refresh or a commit and push operation.

Fixed an issue where the firewall displayed incorrect statistics for mac_transmit_err and send_deffered on PA-440 appliances running PAN-OS 10.1.9-h3.

Fixed an issue where WildFire submission logs were not displayed when filtered by Sender Address.

Fixed an issue where traffic was dropped when Data Loss Prevention or Advanced URL Filtering were enabled. This occurred when the payload size was greater than 3.5 KB.

Fixed an issue where frequent brdagent errors occurred.

(VM-Series firewalls in Microsoft Azure environments only) Fixed an issue where the firewall displayed 0 for the physical port counters read from MAC.

Fixed an issue where multiple smartctl processes entered a d state due to failure to read from the kernel partition, which resulted in high CPU and management impact.

Fixed an issue where GlobalProtect Decryption logs were not forwarded to Panorama.

Fixed an issue where the all_pktproc process stopped responding, which caused the firewall to become unavailable.

(Firewalls in active/active HA configurations only) Fixed an issue where packet loss occurred when dataport was used for HA3 for asymmetrically routed traffic during commits and a virtual wire was configured .

Fixed an issue where the show auth radius-require-msg-authentic command CLI displayed no output.

Fixed an issue that caused the Panorama web interface to be slower than expected due to disabling completion-cache by default.

Fixed an issue where a commit for a policy and configuration dump overlapped, which resulted in a null pointer exception.

Fixed an issue where the firewall dropped a retransmitted SYN packet when using the TCP Fast Open option.

Fixed an issue where the firewall delayed video file transfers over SMB when Exclude Video Traffic from the Tunnel feature was enabled and no applications were added to the list.

Fixed an issue where the Panorama port 28270 did not adhere to the restricted TLS version and ciphers set in the Secure Communication Settings.

Fixed an issue where the firewall did not support TLSv1.3 in the Clientless VPN, which caused the portal page to not load.

Fixed an issue where the dsdc process stopped responding after receiving an unexpected API return value.

Fixed an issue where the firewall was unable to load application metadata from the chunk files. This occurred when the application metadata entry was larger than the buffer used to read it, which resulted in an incomplete entry that caused commit failures.

Fixed an issue on firewalls in HA configurations where a network loop was detected by switches after suspending HA on the active firewall.

Fixed an issue where the firewall did not include the NAS-ID and NAS-IP attributes in the RADIUS Access-Request message when using PEAP-MSCHAPv2 authentication.

(PA-5410, PA-5420, PA-5430, PA-5440 and PA-5445 firewalls only) Fixed an issue related to the all_pktproc process where DPC slot 3 stopped responding.

Fixed an issue where selective push operations failed with the error message: Failed to generate selective push configuration. Schema validation failed. Please try a full push.

Fixed an issue where HA path monitoring using VWire did not work as expected after a reboot.

Fixed an issue where Panorama pushed content to devices that did not have a Threat Prevention license.

Fixed an issue where the web interface stopped responding when configuring the GlobalProtect gateway when the language was set to Japanese.

Fixed an issue where Device Telemetry Regions did not show up with the latest content due to content files not being parsed for the region list when Telemetry was turned off.

Fixed an issue where commits failed when you set Use Management interface for all and MGMT was configured for Data Services.

(PA-7000b firewalls only) Fixed an issue where Luna Network Hardware Security Modules (HSM) did not work after an upgrade or downgrade.

(VM-Series firewalls across all public and private clouds) Fixed an issue where the firewall experienced high dataplane CPU usage when SSL Decryption was enabled.

Fixed an issue where GlobalProtect users were unable to connect when the option Block sessions if the certificate was not issued to the authenticating device was enabled in the certificate profile.

Fixed an issue on the Panorama web interface where the Configuration tab did not accurately display changes made to URL filtering profiles.

Fixed an issue where the request wildfire registration channel public API command failed with the error message Method not found.

Fixed an issue where the CLI command show user ip-user-mapping-mp all displayed the total timeout value instead of the current timeout value when the set cli op-command-xml-output on CLI command was used.

(PA-7000b firewalls only) Fixed an issue where the firewall web interface displayed an incorrect HSM client version when the client was upgraded to version 7.2.0.220.

Fixed an issue where, when you attempted to select a redistribution profile when creating a BGP Redistribute policy rule, the firewall displayed an empty dropdown.

Fixed an issue on Panorama where, when you removed Security profile groups from a Security policy rule via the CLI and committed the change, the Security policy rule was deleted.

Fixed an issue where the firewall might reboot unexpectedly due to the varrcvr process progressively using more memory when WildFire file forwarding is handling PE files.

Fixed an issue where ICD's virtual memory continuously increased due to an increase in unknown IP addresses, which resulted in high management plane CPU utilization.

Added support for export and import of SC3 CA certificates on Panorama appliances during RMA.

Fixed an issue where Possible Domain Fronting Detection for HTTP/2 generated false positives. With this change, domain fronting is limited to HTTP/1.

Fixed an issue where a false positive HTTP/TLS evasion alert was generated when the domain had DNS load balance.

Fixed an issue where the firewall dropped DNS traffic when using DNS Security.

Fixed an issue where querying URL filtering logs with the filter (url_category_list contains 'artificial-intelligence' ) displayed both the artificial-intelligence and the shopping categories.

Fixed an issue where the firewall inconsistently blocked URLs due to intermittent URL category misidentification.

Fixed an issue where the logrcvr process stopped responding while processing session logs for forwarding to the LFC.

Fixed an issue where scheduled email reports were sent without PDF attachments if the firewall was in FIPS-CC mode.

Fixed an issue where exporting a Custom Report to CSV format did not display the full report if it contained non-ASCII characters.

(VM-Series firewalls only) Fixed an issue where firewalls with a DNS server IP address received by DHCP from Amazon Web Services (AWS) had a delay in resolving FQDNs after a reboot.

Fixed an issue where the firewall was unable to match HIP data with the correct anti-malware object for Windows Defender.

Fixed an intermittent issue where file downloads from websites failed when decrypting HTTP/2 traffic.

Fixed an issue on the firewall where newly added routes were not automatically sorted based on subnets when added to a redistribution profile.

Fixed an issue where BGP-ARE routes were not advertised due to a peer route map filter.

(PA-3410 firewalls only) Fixed an issue with an incorrectly open port.

Fixed an issue where the TCP timeout value was reflected incorrectly when using application override for a custom application in TAP mode.

Fixed an issue where the Panorama web interface did not display the push scope data for custom admin users when performing a partial commit and push.

Fixed an issue where an explicit proxy caused intermittent SSL handshake failures to SAP applications accessing public URLs.

Fixed an issue where the firewall displayed the following error message: critical userid registe 0 fail to integrate the update of registered ip addresses since 2 seconds ago; critical system log alerts observed.

(PA-3200 Series firewalls only) Fixed an issue where interfaces running at 10 Gbps did not display the speed and duplex information in the CLI or displayed only as auto.

Fixed an issue where newly added devices or existing deleted devices on the primary Panorama appliance were not updated on the secondary Panorama appliance if the secondary Panorama appliance experienced an HA sync commit failure.

Fixed an issue where users matched incorrect Security policy rules with a HIP profile.

(PA-450 firewalls only) Fixed an issue on the web interface where the DHCPv6 client was not available for VLAN interfaces.

Fixed an issue where the firewall rebooted into maintenance mode if the authentication process restarted repeatedly.

(PA-5450 firewalls in active/active HA configurations only) Fixed an issue where firewall traffic was silently dropped when sent to the peer owner.

Fixed an issue where applications did not load via the Clientless VPN portal when the portal was hosted on an L3 VLAN interface.

Fixed an issue where, when a dynamic address group with more than 500,000 addresses was created, the firewall displayed the error message pan_cfg_addresses_from_xmlhash failed.

Fixed an issue where DNS traffic did not match the intended SD-WAN policy rule when NAT was enabled.

Fixed an issue where committing a configuration change on a Panorama managed firewall caused a short outage for GlobalProtect clients.

(PA-3400 Series firewalls only) Fixed an issue where the firewall had a lower maximum number of Security profiles than expected.

Fixed an issue where GlobalProtect clients experienced slow SMB-V3 download throughput when passing through a Prisma IPSec tunnel and the firewall and the SMB-V3 session owner dataplane was the same as the IPSec-ESP tunnel on the multi-dataplane firewall.

Fixed an issue where the firewall did not have a heartbeat mechanism for the authd process, which caused the firewall to become unresponsive if the authd process stopped responding.

(PA-5200 Series firewalls only) Fixed an issue where the firewall did not increment the flow_parse_ip_cksm counter when traffic with an IP address checksum error was received.

Fixed an issue where a multi-vsys firewall failed to authenticate to GlobalProtect with a new group that had the same name (suffixed or prefixed) as an existing group.

Fixed an issue where the interface rate counter intermittently went to zero frequently.

Fixed an issue where the authd process stopped responding.

Fixed an issue where the firewall took an incorrect action for overlapping custom and edl-url-categories in a policy rule.

Fixed an issue where push operations from Panorama were slow due to the rasmgr process taking longer than expected.