--- type: Addressed product: PAN-OS version: 11.0.3 --- ## PAN-231823 A fix was made to address CVE-2024-5916. ## PAN-233954 Fixed an issue where the firewall was unable to retrieve correct groups from the LDAP server. ## PAN-232059 Fixed an issue with memory management when processing large certificates using TLSv1.3. ## PAN-229691 Fixed an issue on Panorama where configuration lock timeout errors were observed during normal operational commands by increasing thread stack size on Panorama. ## PAN-228877 ```caveat PA-7050 firewalls only ``` Fixed an issue with OOM conditions which caused slot restarts due to pan_cmd consuming more than 300 MB. ## PAN-227639 Fixed an issue where the ACC displayed an incorrect DNS-base application traffic byte count. ## PAN-227376 Fixed an issue where a memory overrun caused the all_task process to stop responding. ## PAN-227179 Fixed an issue where routes were not updated in the forwarding table. ## PAN-226418 A CLI command was added to address an issue where long-lived sessions aged out even when there was ongoing traffic. ## PAN-226198 Fixed an issue on Panorama where the configd process repeatedly restarted when attempting to make configuration changes. ## PAN-225920 Fixed an issue where duplicate predict sessions didn't release NAT resources. ## PAN-225183 Fixed an issue where SSH tunnels were unstable due to ciphers used as part of the high availability SSH configuration. ## PAN-225169 Added a CLI command to view Cortex Data Lake queue usage. ## PAN-224145 Fixed an issue in multi-vsys environments where, when Panorama was on a PAN-OS 10.2 release and the firewall was on a PAN-OS 10.1 release, commits failed on the firewall when inbound inspection mode was configured in the decryption policy rule. ## PAN-223852 Fixed an issue where all_pktproc stopped responding when network packet broker or decryption broker chains failed. ## PAN-223741 Fixed an issue where the mprelay process stopped responding, which caused a slot restart when another slot rebooted. ## PAN-223501 ```caveat PA-5200 Series and PA-7000 Series firewalls only ``` Fixed an issue where diagnostic information for the dataplane in the dp-monitor.log file was not complete. ## PAN-223488 Fixed an issue where closed ElasticSearch shards were not deleted, which resulted in shard purging not working as expected. ## PAN-223457 Fixed an issue where, if the number of group queries exceeded the Okta rate limit threshold, the firewall cleared the cache for the groups. ## PAN-223317 Fixed an issue where SSL traffic failed with the error message: Error: General TLS protocol error. ## PAN-223185 Fixed an issue where the distributord process stopped responding. ## PAN-222957 Fixed an issue where managed firewalls did not reflect changes pushed by users who were not in a superuser role. ## PAN-222941 Fixed an issue where viewing the latest logs took longer than expected due to log indexer failures. ## PAN-222533 ```caveat VM-Series firewalls on Microsoft Azure and Amazon Web Services (AWS) environments ``` Added support for high availability (HA) link monitoring and path monitoring. ## PAN-222418 Fixed an issue where the firewall intermittently recorded a reconnection message to the authentication server as an error, even if no disconnection occurred. ## PAN-222162 Fixed an issue where the show transceiver CLI command showed the RX and TX powers as 0.00 mW. ## PAN-221984 ```caveat VM-Series firewalls in Microsoft Azure environments only ``` Fixed an issue where an interface went down after a hotplug event and was only recoverable by restarting the firewall. ## PAN-221836 Fixed an issue where improper SNI detection caused incorrect URL categorization. ## PAN-221787 Fixed an issue where a User Principal Name (UPN) was incorrectly required in the pre-logon machine certificate. ## PAN-221647 Fixed an issue where the Apps seen value was not reflected on Panorama. ## PAN-221577 Fixed an issue where a static route for a branch or hub over the respective virtual interface was not installed in the routing table even when the tunnel to the branch or hub was active. ## PAN-221208 Fixed an issue where the tunnel monitor was unable to remain up when zone protection with Strict IP was enabled and NAT Traversal was applied. ## PAN-221126 Fixed an issue where Email server profiles (Device > Server Profiles > Email and Panorama > Server Profiles > Email) to forward logs as email notifications were not forwarded in a readable format. ## PAN-220910 Fixed an issue where an internal management plane NIC caused a kernel panic when doing a transmit due to the driver reinitializing under certain failure or change conditions on the same interface during transmit. ## PAN-220899 Fixed an issue where you were unable to choose the manual GlobalProtect gateway. ## PAN-220747 Fixed an issue where logs were not visible after restarting the log collector. ## PAN-220626 Fixed an issue where system warning logs were written every 24 hours. ## PAN-220448 Fixed an issue where the GlobalProtect client connection remained at the prelogin stage when Kerberos SSO failed and was unable to fall back to the realm authentication. ## PAN-220401 Fixed an issue where, during a reboot, an unexpected error message was displayed that the syslog configuration file format was too old. ## PAN-220281 ```caveat PA-7080 firewalls only ``` Fixed an issue where autocommitting changes after rebooting the Log Forwarding Card (LFC) caused the logrcvr process to fail to read the configuration file. ## PAN-220180 Fixed an issue where configured botnet reports (Monitor > Botnet) were not generated. ## PAN-219813 Fixed an issue where the configuration log displayed incorrect information after a multidevice group Validate-all operation. ## PAN-219659 Fixed an issue where root partition frequently filled up and the following error message was displayed: Disk usage for / exceeds limit, xx percent in use, cleaning filesystem. ## PAN-219644 Fixed an issue where firewalls that forwarded logs to a syslog server over TLS (Objects > Log Forwarding) used the default Palo Alto Networks certificate instead of the configured custom certificate. ## PAN-219623 Fixed an issue where, when a multidynamic group validate job was pushed on the firewall, logs displayed Panorama push instead of ValidateAll push. ## PAN-219498 Fixed an issue where the Threat ID/Name detail in Threat logs was not included in syslog messages sent to Splunk. ## PAN-219300 Fixed an issue where the task manager displayed only limited data. ## PAN-219253 Fixed an issue where, after making changes in a template, the Commit and Push option was grayed out. ## PAN-218988 Fixed an issue in FIPS mode where, when importing a certificate with a new private key, and the certificate used the name of an existing certificate on the Panorama, the following error message was displayed: Mismatched public and private keys. ## PAN-218947 Fixed an issue where logs were not displayed in Elasticsearch under ingestion load. ## PAN-218697 Fixed an issue where the ElasticSearch status frequently changed to red or yellow after a PAN-OS upgrade. ## PAN-218663 A fix was made to address CVE-2024-2433 ## PAN-218404 Fixed an issue where ikemgr stopped responding due to receiving CREATE_CHILD messages with a malformed SA payload. ## PAN-218340 Fixed an issue where selective pushes to template stack and multi device group pushes caused a buildup of resident memory, which caused the configd process to stop responding. ## PAN-218318 Fixed an issue where the firewall changed the time zone automatically instead of retrieving the correct time zone from the NTP server. ## PAN-218273 Fixed an issue where TCP keepalive packets from the client to the server weren't forwarded when SSL decryption was enabled. ## PAN-218267 Fixed an issue where a commit and push operation from Panorama to managed firewalls did not complete or took longer to complete than expected. ## PAN-218252 Fixed an issue where the slot-1 data processor showed the status as down during an SNMP query. ## PAN-218107 Fixed an issue with ciphers used for SSH tunnels where packet lengths were too large, which made the SSH tunnel unstable. ## PAN-218046 Fixed an issue where the Virtual Routers (Network > Virtual Routers) setting was not available when configuring a custom admin role (Device > Admin Roles). ## PAN-218001 ```caveat PA-400 Series firewalls only ``` Fixed an issue where shutdown commands rebooted the system instead of correctly triggering a shutdown. ## PAN-217650 ```caveat VM-Series firewalls and Panorama virtual appliances in Microsoft Azure environments only ``` Fixed an issue where management interface Speed/Duplex was reported as unknown. ## PAN-217493 Fixed an issue where superusers with read-only privileges were unable to view SCEP object configurations. ## PAN-217169 Fixed an issue where the logrcvr stopped forwarding logs to the syslog server after a restart. ## PAN-217053 Fixed an issue where the configd process stopped responding after a selective push to multiple device groups failed. ## PAN-216957 Fixed an issue where allow list checks in an authentication profile did not work if the group Distinguished Name contains the ampersand ( & ) character. ## PAN-216775 Fixed an issue where the devsrvr process stopped responding at pan_cloud_agent_get_curl_connection() and the URL cloud could not be connected. ## PAN-216366 Fixed an issue where, when custom signatures used a certain syntax, false positives were generated on devices on a PAN-OS 10.0 release. ## PAN-216214 ```caveat Panorama managed firewalls in active/active HA configurations only ``` Fixed an issue where the HA status displayed as Out of Sync (Panorama > Managed Devices > Health) if local firewall configurations were made on one of the HA peers. This caused the next HA configuration sync to overwrite the local firewall configuration made on the HA peer. ## PAN-216048 Fixed an issue where, when upgrading from a PAN-OS 9.1 release to a PAN-OS 10.0 release, commits failed with the error message: hip profiles unexpected here. ## PAN-215767 Fixed an issue where, after a high availability failover, IKE SA negotiation failed with the error message INVALID_SPI, which resulted in temporary loss of traffic over some proxy IDs. ## PAN-215655 Fixed an issue where, after a multidynamic group push, Security policy rules with the target device tag were added to a firewall that did not have the tag. ## PAN-215338 ```caveat PA-5400 Series firewalls only ``` Fixed an issue where the inner VLAN tag for Q-in-Q traffic was stripped when forwarding. ## PAN-215317 Fixed an issue where the dataplane stopped responding unexpectedly with the error message comm exited with signal of 10. ## PAN-215066 Fixed an issue on Panorama where push scope rendering caused the Commit and Push or Push to Devices operation window to hang for several minutes. ## PAN-214990 Fixed an issue where firewall copper ports flapped intermittently when device telemetry was enabled. ## PAN-214987 Fixed an issue where Application Filter names were not random, and they matched or included internal protocol names. ## PAN-214815 Fixed an issue where SNMP queries were not replied to due to an internal process timeout. ## PAN-214727 Fixed an issue where a memory leak related to the useridd process resulted in an OOM condition, which caused the process to stop responding. ## PAN-214669 Fixed an issue where FIN and RESET packets were sent in reverse order. ## PAN-214463 Fixed an issue where IKE re-key negotiation failed with a third-party vendor and the firewall acting as the initiator received a response with the VENDOR_ID payload and the error message unexpected critical payload (type 43). ## PAN-214201 Fixed an issue where, after exporting custom reports to CSV format, the letter b appeared at the beginning of each column. ## PAN-214186 Fixed an issue where category length was incorrect, which caused the dataplane to restart. ## PAN-213956 Fixed an issue where the firewall interface did not go down even after the peer link/switch port went down. ## PAN-213931 Fixed an issue where the logrcvr process cache was not in sync with the mapping on the firewall. ## PAN-213296 Fixed an issue where Single Log-out (SLO) was not correctly triggered from the firewall toward the client, which caused the client to not initiate the SLO request toward the identity provider (IdP). This resulted in the IdP not making the SLO callback to the firewall to remove the user. ## PAN-213162 Fixed an issue where an SD-WAN object was not displayed under a child device group. ## PAN-213112 Fixed an issue where executing the show report directory-listing CLI command resulted in no output after upgrading to a PAN-OS 10.1 release. ## PAN-212978 Fixed an issue where the firewall stopped responding when executing an SD-WAN debug CLI command. ## PAN-212726 Fixed an issue where RTP/RTCP packets were dropped for SIP calls by SIP ALG when the source NAT translation type was persistent Dynamic IP And Port. ## PAN-212577 ```caveat PA-5200 Series and PA-7080 firewalls only ``` Fixed an issue where commits took longer than expected when more than 45,000 Security policy rules were configured. ## PAN-212240 Fixed an issue where packet capture was logged for an unknown application session when packet capture logging was disabled. ## PAN-212057 Fixed an issue where Advanced Threat Prevention caused SSL delays when no URL licenses were present. ## PAN-211441 Fixed a memory leak issue related to SSL crypto operations that resulted in failed commits. ## PAN-211398 Fixed an issue where dataplane processes stopped responding when handling HTTP/2 streams. ## PAN-211384 Fixed an issue where the size of the redisthost_1 in the Redis database continuously increased, which caused an OOM condition. ## PAN-210640 Fixed an issue where applications were not displayed after authenticating into the clientless VPN. ## PAN-210502 Fixed an issue where Panorama was unable to convert to PAN-OS 9.1 syntax for WF-500 appliances. ## PAN-210456 Fixed an issue where high latency occurred on PA-850-ZTP when SSL decryption was enabled. ## PAN-210452 Fixed an issue where application packet capture (pcap) was not generated when Security policy rules were used as a filter. ## PAN-210429 ```caveat VM-Series firewalls only ``` Fixed an issue where the HTTP service failed to come up on DHCP dataplane interfaces after rebooting the firewall, which resulted in health-check failure on HTTP/80 with a 503 error code on the public load balancer. ## PAN-210364 Fixed an issue where high latency was observed when accessing internal web applications, which interrupted development activities related to the web server. ## PAN-209585 The Palo Alto Networks QoS implementation now supports a new QoS mode called lockless QoS for PA-3400, PA-5410, PA-5420, PA-5430, and PA-5440 firewalls. For firewalls with higher bandwidth QoS requirements, the lockless QoS dedicates cores to the QoS function that improves QoS performance, resulting in improved throughput and latency. ## PAN-209375 Fixed an issue on the firewall where log filtering did not work as expected. ## PAN-209288 Fixed an issue where generating certificates with SCEP did not work. ## PAN-209172 Fixed an issue where the firewall was unable to handle GRE packets for Point-to-Point Tunneling Protocol (PPTP) connections. ## PAN-209108 Fixed an issue where a Panorama in Management Only mode was unable to display logs from log collectors due to missing schema files. ## PAN-208567 Fixed an issue with email formatting where, when a scheduled email contained two or more attachments, only one attachment was visible. ## PAN-208438 Fixed an issue on Panorama where Security policy rules incorrectly displayed as disabled. ## PAN-208395 Fixed an issue where user authentication failed in multi-vsys environments with the error message User is not in allowlist when an authentication profile was created in a shared configuration space. ## PAN-208316 Fixed an issue where user-group names were unable to be configured as the source user via the test security-policy-match command. ## PAN-208240 Fixed an issue where, when attempting to replace an existing certificate, importing a new certificate with the same name as the existing certificate failed due to mismatched public and private keys. ## PAN-208198 Fixed an issue with firewalls in active/passive HA configurations where, after rebooting the passive firewall, interfaces were briefly shown as powered up, and then shown as down or shutdown. ## PAN-208090 Fixed an issue where the ACC report did not display data when querying the filter for the fields Source and Destination IP. ## PAN-207604 Fixed an issue where system logs continuously generated the log message Not enough space to load content to SHM. ## PAN-207577 Fixed an issue where Panorama > Setup > Interfaces was not accessible for users with custom admin roles even when the interface option was selected for the custom admin roles. ## PAN-206765 Fixed an issue where log forwarding filters involving negation did not work. ## PAN-205015 Fixed an issue where not all users were included in the user group after an incremental sync between the firewall and the Cloud Identity Engine. ## PAN-204868 Fixed an issue where disk utilization was continuously high due to the log purger not sufficiently reducing the utilization level. ## PAN-204718 ```caveat PA-5200 Series firewalls only ``` Fixed an issue where, after upgrading to PAN-OS 10.1.6-h3, a TACACS user login displayed the following error message during the first login attempt: Could not chdir to home directory /opt/pancfg/home/user: Permission denied. ## PAN-203611 Fixed an issue where URL categorization was not recognized for URLs that contained more than 100 characters. ## PAN-202524 Fixed an issue where the session ID was missing in the session details section of the ingress-backlogs XML API output. ## PAN-199819 Fixed an issue where, if a decryption profile allowed TLSv1.3, but the server only supported TLSv1.2, and the cipher used by the first connection to the server was a CBC SHA2 cipher suite, the connection failed. ## PAN-198509 Fixed an issue where commits failed due to insufficient CFG memory. ## PAN-198453 Fixed an issue where you were unable to resize the Description pop-up window (Policies > Security > Prerules). ## PAN-198050 Fixed an issue where Connection to update server is successful messages displayed even when connections failed. ## PAN-197339 Fixed an issue where template configuration for the User-ID agent was not reflected on the template stack on Panorama appliances on PAN-OS 10.2.1. ## PAN-196345 Fixed an issue where scheduled dynamic content updates failed to be retrieved by managed firewalls from Panorama when connectivity was slow. ## PAN-189328 Fixed an issue where traffic belonging to the same session was sent out from different ECMP enabled interfaces. ## PAN-187989 Fixed an issue where a user who did not have permissions of other access domains were able to view the commit and configuration lock. ## PAN-185360 Fixed an issue where, when Authentication Portal Authentication was configured, l3svc_ngx_error.log and l3svc_access.log did not roll over after exceeding 10 megabytes, which caused the root partition to reach full utilization. ## PAN-180082 Fixed an issue where errors in brdagent logs caused dataplane path monitoring failure. ## PAN-177227 ```caveat VM-Series firewalls on Amazon Web Services environments only ``` Fixed an issue where traffic sent from a GENEVE tunnel to the firewall was dropped if the firewall attempted to encapsulate traffic into an IPSec tunnel. ## PAN-169586 Fixed an issue where scheduled log view reports in emails didn't match the monitor page query result for the same time interval. ## PAN-160633 ```caveat PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls only ``` Fixed an issue where the dataplane restarted repeatedly due to an internal path monitoring failure until a power cycle.