aaron.axvig/firewallissues
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
8559d63f9fd6f3ad941272549ea43f8f7b469f60
firewallissues/reference/PAN-OS/addressed/11.2.15.html
T

5588 lines
193 KiB
HTML
Raw Blame History

<table class="table colsep rowsep table-striped">
<!--cq:include script="../../common/tablestack.jsp" /-->
<colgroup>
<col style="width: 25%" />
<col style="width: 75%" />
</colgroup>
<thead class="thead">
<tr class="row">
<th class="entry">
<div class="p">Issue ID</div>
</th>
<th class="entry">
<div class="p">Description</div>
</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row rowsep">
<td class="entry">
<div class="p">—</div>
</td>
<td class="entry relcol">
<div class="p">
Fixes were made to address the following CVEs:
<ul id="pan_os_11_2_15_addressed_issues_ul-d2c_441_nkc" class="ul">
<li class="li">
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0310"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0310</a
>
</li>
<li class="li">
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0309"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0309</a
>
</li>
<li class="li">
<a
class="xref"
href="https://security.paloaltonetworks.com/CVE-2026-0308"
title=""
data-scope="external"
data-format="html"
data-type=""
target="_blank"
>CVE-2026-0308</a
>
</li>
</ul>
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-336162</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where commits involving routing related network
configuration changes experienced slower than usual completion times
or remaining at 20% completion.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-333488</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a selective push operation from Panorama removed
active configurations from a firewall when the push payload excluded
changes committed by other administrators that had not yet been
pushed. This resulted in the affected device group entering an
out-of-sync state. With this fix, selective push operations correctly
preserve all active configurations on the firewall.
</div>
</td>
</tr>
<tr class="row">
<td class="entry">
<div class="p">PAN-326424</div>
</td>
<td class="entry relcol">
<div class="p">
Fixed an issue where high memory utilization occurred in the
<span class="ph uicontrol">escd</span> process. With this fix, memory
utilization for the process remained stable.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-332608</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where firewalls intermittently disconnected from SLS.
With this fix, firewalls maintained a stable connection to SLS.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-332258</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>mprelay</a
>
process stopped responding unexpectedly, which led to the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>pan_task</a
>
process becoming unresponsive and subsequently caused path monitoring
issues.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-332247</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the proxy generated HTTP 503 errors for multiple
URLs, which prevented users from connecting to servers. With this fix,
the proxy now functions as expected.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-331856</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall unexpectedly terminated the DNS
proxy process when it received TCP/53 DNS queries on an interface
configured for DNS proxy, which led to repeated firewall reboots and
temporary unavailability of the web interface. With this fix, the
firewall processes TCP/53 DNS queries without interruption.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-331840</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">VM-Series firewalls in Azure environments only</tt
>) Fixed an issue where a hotplug event caused a system process to
unexpectedly stop responding, which led to a firewall reboot.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-331387</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where IPsec tunnels frequently went down due to high
process memory utilization. With this fix, the system process now
manages memory correctly, preventing tunnel instability.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-331386</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall incorrectly routed DNS traffic from
the management interface instead of the configured service route
interface when an address object was set as the source address. With
this fix, DNS traffic now correctly uses the designated service route
interface.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-330196</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall unexpectedly terminated operations
and rebooted due to an internal software error.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-330124</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>VM-Series firewalls in Microsoft Azure environments integrated with
Azure Gateway Load Balancer (GWLB)</tt
>) Fixed an issue where SSL decryption did not function correctly for
connections when the accumulation proxy was enabled, which caused the
firewall to send an ACK packet through an incorrect tunnel. With this
fix, SSL decryption operates as expected.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-330095</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>VM-Series firewalls in AWS Cloud Mode with Geneve-based service
chaining</tt
>) Fixed an issue where the firewall experienced unexpected reboots
and a temporary loss of connectivity. This occurred when the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>mprelay</a
>
process attempted to process system object modifications involving
Geneve service chain metadata, which led to repeated process
interruptions and a system reboot. With this fix, the firewall now
handles these operations without interruption.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-330016</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where enabling App Acceleration resulted in
connectivity disruption for GlobalProtect users and branches connected
through ION devices, which prevented access to applications. With this
fix, App Acceleration functions as expected without causing
connectivity issues.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329965</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where commit operations failed due to redis
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>idmgr</a
>
connection leaks. With this fix, commit operations complete as
expected.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329834</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a memory leak associated with some display CLI
commands caused instability.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329809</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where testing an SCP server connection from the
Panorama web interface returned an error instead of prompting to allow
the host key, which prevented the successful establishment of the
connection. With this fix, the system now correctly prompts to allow
the host key.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329793</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the characters in PDF Summary Reports did not
display correctly when the Locale was set as Japanese, Korean,
Simplified Chinese, or Traditional Chinese.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329698</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">OCTEON, MIPS, platforms only</tt>) Fixed an issue
where the dataplane became unresponsive. With this fix, the dataplane
operates stably.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329675</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a Strata Logging Service license showed as
failing to install even though it was successfully fetched.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329637</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the push scope window did not display the target
devices when attempting to push configurations from Panorama, which
required manual selection of templates or device groups. With this
fix, the push scope window now correctly populates with the intended
push scope.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329550</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall experienced unexpected process
terminations, which resulted in an HA failover and led to the
dataplane becoming unresponsive.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329182</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Panorama virtual appliances in management only mode deployed in AWS
only</tt
>) Fixed an issue where Panorama failed to mount
<span class="ph systemoutput">panlogs</span>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329180</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where Panorama did not automatically resume syslog
forwarding over TCP after the syslog server became unavailable or was
restarted.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-329034</div></td>
<td class="entry relcol">
<div class="p">
Fixed an intermittent issue where firewall restarted unexpectedly
while processing zip files.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-328837</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where firewalls did not generate system logs when an
administrator cleared logs, which impacted auditing capabilities. With
this fix, firewalls now generate system logs for log clearing events.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-328770</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where BGP Graceful Restart (GR) capability continued to
be advertised to BGP peers after GR was disabled on a Logical Router
configured with the Advanced Routing Engine, which caused peers to
incorrectly believe the firewall supported GR. With this fix,
disabling BGP GR on a Logical Router correctly removes the capability
from BGP Open messages.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-328742</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the dataplane silently dropped HTTP POST
payloads, which disrupted application integrations. This occurred due
to an internal error when processing XFF headers within the CTD
engine.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-328712</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on the web interface where HA related filter options
(<span class="ph uicontrol">HA Cluster ID</span>,
<span class="ph uicontrol">HA Cluster State</span>, and
<span class="ph uicontrol">HA Pair Status</span>) disappeared from the
<span class="ph uicontrol"
>Commit &gt; Push to Devices &gt; Edit Selection</span
>) window in Panorama when the window was reopened within the same
login session. With this fix, these options remain visible as
expected.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-328654</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on the web interface where some threats were
incorrectly displayed as
<span class="ph uicontrol">Threat ID</span> instead of
<span class="ph uicontrol">Threat Name</span>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-328625</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Firewalls in active/passive HA configurations only</tt
>) Fixed an issue where Genetec camera streaming experienced lag and
dropped video feeds due to the exhaustion of private RTP ports, which
led to their accumulation over time. With this fix, the firewall now
properly releases private RTP ports, preventing their exhaustion.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-328145</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a firewall functioning as an Area Border Router
did not correctly translate NSSA Type-7 LSAs to Type-5 LSAs when OSPF
neighbors set the Nt bit in the NSSA Area, and routes were not
advertised to upstream OSPF neighbors in the backbone area, which
resulted in traffic being silently discarded.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-327960</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where firewalls experienced continuous unexpected
restarts and entered a suspended state due to improper processing of
certain URLs. With this fix, firewalls maintain stable operation in HA
configurations.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-327858</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where access to websites was interrupted or pages
rendered incompletely when SSL/TLS decryption was enabled due to the
firewall prematurely terminating sessions upon receiving a
<span class="ph uicontrol">TLS Close Notify</span> alert. With this
fix, the firewall properly handls
<span class="ph uicontrol">TLS Close Notify alerts</span>, allowing
complete page rendering.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-327812</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a process remained in a recursive loop when
processing queued packets after hold mode was disengaged, particularly
when handling ADNS traffic with failed
<span class="ph systemoutput">wif-forward </span>responses, which led
to system instability. With this fix, the process properly continues
packet processing.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-327603</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where user-ID mappings for a user were incorrectly
cleared during a user group synchronization event when the user was
removed from one group before being added to another. With this fix,
user-ID mappings are correctly updated during group changes.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-327460</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a
<span class="ph uicontrol">Commit and Push</span> operation on
Panorama did not successfully push configuration changes to Prisma
Access endpoints. This occurred when the system reported that not all
commit jobs were triggered. With this fix,
<span class="ph uicontrol">Commit and Push</span> operations now
correctly apply configurations to Prisma Access.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-327443</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where log forwarding stopped. With this fix, log
forwarding resumes normal operation.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-327295</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where critical alerts related to registered IP address
updates appeared in system logs even when User-ID was not configured
due to a conflict during simultaneous updates of IP tags and EDLs.
</div>
<div class="p">
To enable this fix, run the CLI command
<span class="ph systemoutput"
>debug user-id regip-max-update-retry rate
&amp;lt;value&amp;gt;</span
>
with a value between 30 and 300.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-327266</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where IP addresses configured for Source Address
Exclusions in a Zone Protection Profile within a template stack did
not save correctly. With this fix, the IP addresses save as expected.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-327011</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall was unable to revert locally
overridden configurations for permitted IP addresses on the management
interface after an upgrade. With this fix, the configuration could be
reverted as expected.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-327009</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>all_task</a
>
process stopped responding.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-326933</div></td>
<td class="entry relcol">
<div class="p">
(PA-440 firewalls only) Fixed an issue where Management Plane (MP) CPU
utilization frequently spiked to 100%, which triggered critical
alerts. With this fix, the Management Plane CPU utilization remained
stable under normal operating conditions.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-326734</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a Security policy rule configured in the Shared
device group on Panorama was not displayed in the web interface for a
child device group, which caused a discrepancy between the displayed
configuration and the actual deployed configuration on the associated
device. With this fix, the user interface accurately reflects the
deployed security policy rules.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-326705</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where high CPU utilization occurred on one of the CPU
cores.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-326694</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where enabling multi-vsys on a firewall with shared
override nodes created duplicate configuration nodes, which caused
commit operations to fail. With this fix, enabling multi-vsys no
longer duplicates configuration nodes.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-326677</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a selective push from Panorama to the firewall
was successful even when applying rename operation failed in selective
push, which resulted in configurations on the firewall being deleted.
With this fix, the selective push will fail when applying rename
operation fails.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-326354</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>sslmgr</a
>
process stopped responding when attempting to display the OSCP host
cache.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-326056</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where ACE applications did not match the correct
Security policy rules when the service was not set to
<span class="ph uicontrol">Application Default</span> after an
upgrade, which caused traffic to be incorrectly denied.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-326054</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where Zone Protection dropped legitimate TCP scan
traffic despite the source IP address being configured in the Source
Address Exclusion list, which resulted in the blocked IP address not
appearing in the <span class="ph systemoutput">dos-block</span> table.
With this fix, Zone Protection correctly applies source address
exclusions and displays blocked IP addresses in the
<span class="ph systemoutput">dos-block</span> table.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325936</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the log purging process on the Panorama log
collector would not complete successfully, which prevented logs from
being automatically removed after their configured retention period.
With this fix, logs are purged as expected according to their
retention settings.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325904</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where Panorama continued to display a message prompting
a device reboot to activate changes, even after the managed device had
been rebooted. This occurred after certain configuration changes, such
as enabling jumbo frames, which caused the message to persist
incorrectly. With this fix, the message now clears as expected after
the device reboots.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325903</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, after upgrading Panorama, a custom admin role
with Object Level Changes disabled did not automatically populate
out-of-sync firewalls in the push scope.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325890</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where licenses were not installed after bootstrapping a
VM-Series firewall in an air-gapped environment.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325724</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where importing PKCS12 certificates failed with the
error
<span class="ph systemoutput"
>Import of certificate and private-key failed. Failed to extract
certificate</span
>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325496</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">KVM VM-Series firewalls only</tt>) Fixed an issue
where ARP entries were incomplete after an upgrade to an affected
release.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325151</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a system log was not generated when the proxy
reached its session limit.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325120</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on PA-415, PA-415-5G, PA-445, PA-455, and PA-455-5G
platforms where certain PAN-OS versions caused intermittent
connectivity failures on the Eth1/1 data port and loss of power on PoE
ports.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325105</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a GlobalProtect gateway would not request a Host
Information Profile (HIP) report from a client even when the client
generated a new MD5 sum, which resulted in the firewall incorrectly
determining that a new HIP report was not required and led to outdated
information in the HIP match logs. With this fix, the gateway properly
requests updated HIP reports when a new MD5 sum is detected.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325057</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where TCP sessions were dropped due to an
ACK-out-of-window condition during TCP reassembly when SYN cookies
were enabled in a Zone Protection Profile. With this fix, TCP session
establishment with SYN cookies enabled correctly tracks sequence
numbers and no longer drops valid ACK packets from the Server.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-325002</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Google Cloud NGFW Enterprise VM-Series firewalls only</tt
>) Fixed an issue where the HTTP2 threat logs did not include VPC ID,
Security_key, and Endpoint ID.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-324966</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on the web interface where you were unable to view new
or modified App-IDs under
<span class="ph uicontrol">Review Policy</span> or
<span class="ph uicontrol">Review Apps</span>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-324902</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where exporting Custom Reports to CSV failed with a
<span class="ph systemoutput">UnicodeEncodeError</span> message when
report entries contained multibyte characters.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-324734</div></td>
<td class="entry relcol">
<div class="p">
(Panorama only) Fixed an issue where the log daemon (logd) would
restart periodically, which resulted in commit operations failing with
a "Client logd not connected" error. This issue occurred when SD-WAN
site names contained special characters or exceeded a specific length.
With this fix, the log daemon remains stable and commit operations
complete successfully.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-324652</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where selective configuration pushes from Panorama
failed after an upgrade, which caused shared policy rules to go out of
sync. With this fix, selective configuration pushes complete
successfully and policies remain in sync.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-324370</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where IDE traffic did not function as expected when
both HTTP head insertion and DLP inspection were enabled.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-324336</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where GlobalProtect iOS users were unable to connect
due to the firewall incorrectly reporting that the maximum number of
users was exceeded, even when the actual number of active users was
below the configured limit.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-324275</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where requesting logging service forwarding
certification information via the CLI did not work.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-324136</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the CRL download failed because it followed the
Service Route Setting instead of the CRL's own setting. The fix allows
CRL to follow its own setting, enabling the download to succeed.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-324128</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where Panorama pushed an incorrect configuration to a
firewall during a selective push, which occurred when the system would
incorrectly select an older base configuration version after a
successful push with large configuration lines. With this fix,
Panorama now correctly handles selective pushes, ensuring the latest
configuration is applied or the push fails as expected.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-323842</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where commits intermittently failed on some Prisma
Access nodes with the error message
<span class="ph systemoutput">client pppoed phase 1 failure</span>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-323798</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where firewalls experienced frequent, unexpected
reboots, which occurred when internal processes became unresponsive
and exceeded their restart limits. With this fix, firewalls no longer
experience these unexpected reboots.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-323501</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where SWG Explicit Proxy Kerberos authentication bypass
did not occur for some URLs that matched a configured URL category.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-323485</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where multicast radio RTP based traffic was dropped
after an upgrade when the firewall performed Cloud Inline inspection,
which led to an exceeded session queue for Cloud Threat Detection.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-323249</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">M-700 appliances only</tt>) Fixed an issue where
the Elasticsearch processes repeatedly restarted and log collectors
showed the Elasticsearch health status as red.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-323243</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>configd</a
>
process stopped responding occurred when a Security policy rule was
updated or refreshed in the web interface.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-323219</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where an error message was displayed that an IoT
Security license was required even when the firewall had a valid
Enterprise IoT license, which resulted in devices not appearing under
<span class="ph uicontrol">Objects &gt; Devices</span> but correctly
appearing in SCM.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-323154</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where Real-time Transport Protocol (RTP) packets were
dropped after an upgrade, which occurred due to a predict session
conversion failure and resulted in delayed or absent video streams.
With this fix, RTP packets are processed correctly, and video streams
display without delay.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-323141</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where SD-WAN SaaS monitoring for HTTPS URLs
continuously flapped, which caused frequent traffic shifting between
ISPs. This occurred due to the firewall unexpectedly hitting resource
limits for monitoring.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-322815</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>VM-Series firewalls on Microsoft Azure environments only</tt
>) Fixed an issue where the firewall entered maintenance mode after
enabling FIPS-CC mode and rebooted.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-322804</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where OSPF learned routes were not advertised to other
OSPF peers, even when OSPF adjacencies were in a full state. This
occurred when OSPF packets fragmented internally before transmission.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-322402</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where ACC reports for a duration of seven or more days
did not fully load or displayed partial information.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-322390</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the Enhanced Application Logging status in the
Logging Service Status dashboard displayed as gray and indicated 0/0
connections, even though EAL logs were successfully forwarded to
Cortex XDR.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-322325</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>PA-3400, PA-5400, PA-5500, and PA-5500l platforms with dedicated
log interfaces only</tt
>) Fixed an issue where email forwarding failed silently when the SMTP
gateway was reachable only via the log-interface, even when test
emails were forwarded successfully.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-322159</div></td>
<td class="entry relcol">
<div class="p">This issue was addressed in this release.</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-322137</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where log retention policies prematurely purged
Infrastructure and Audit logs, which occurred because the system
removed entire log indices instead of only logs older than the
configured retention period. With this fix, log retention policies
correctly preserve logs for the specified duration.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-321937</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where an expired SD-WAN license caused SD-WAN tunnels
to become unavailable, which resulted in traffic interruptions. With
this fix, the device provides logs and commit messages about expired
licenses.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-321816</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where processes stopped responding unexpectedly.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-321699</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where device telemetry intermittently failed to send
files, which resulted in critical alerts in system files.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-321516</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the dataplane restarted due to a race condition
in the dataplane cache infrastructure.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-321465</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the IP-MIB (Management Information Base) reported
an incorrect value for IPv6 address prefixes. With this fix, the
correct IPv6 address prefix values are now reported.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-321340</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Firewalls in FIPS mode only</tt>) Fixed an issue
where GlobalProtect unexpectedly prompted for RADIUS authentication
instead of client certificate authentication due to an OSCP validation
error and subsequent CRL verification failure, which led to
certificates being marked as invalid.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-321282</div></td>
<td class="entry relcol">
<div class="p">
Fix an issue where the AI Security profile was referenced in the
Security profile group, which caused the device group to remain out of
sync after a selective push to devices for device groups.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-321222</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where you were unable to create an HTTP server profile
an API key certificate was configured. This occurred because the
generated API key exceeded the maximum character limit.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-321204</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where FTP-DATA sessions did not match the installed
predict session, which led to session termination in HA
configurations.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-321150</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the interface remained down after an upgrade.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-321084</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">VM-Series firewalls on ESXi platforms only</tt>)
Fixed an issue where enabling link monitoring caused the
<span class="ph systemoutput">brdagent</span> process to stop
responding, which caused system instability, interface outages,
split-brain conditions in HA pairs, and a reboot during failover.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-321081</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where
<span class="ph uicontrol">Log Quotas</span> incorrectly displayed a
value that was higher than possible.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-321060</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where an ethernet interface remained in a down state
after repeated automated enable/disable cycles and required manual
intervention, which resulted in backup outages.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-320966</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the Panorama web interface incorrectly displayed
pending template changes and outdated configurations for managed
firewalls, which caused the firewalls to be flagged as out of sync
even after successful configuration pushes. With this fix, Panorama
accurately reflects the configuration state of managed firewalls.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-320643</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a system process terminated unexpectedly, which
caused the device to restart and resulted in an extended service
interruption. With this fix, the device maintains stable operation.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-320598</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where internal and external DNS names did not resolve
when connected to a GlobalProtect gateway.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-320420</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<span class="ph systemoutput"
>show running resource-monitor ingress-backlogs</span
>
API call returned an unexpected error instead of the expected resource
monitoring information.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-320370</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where your firewall, configured as a Dynamic Host
Configuration Protocol (DHCP) client, unexpectedly changed its DHCP
server IP address. This resulted in the firewall receiving negative
acknowledgments (NAKs) during lease renewals and using an unintended
DHCP server. This occurred when the DHCP client received a second DHCP
Offer from a different server after completing its initial lease
acquisition process. With this fix, your firewall maintains the
correct DHCP server IP address, ensuring stable lease renewals.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-320345</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall repeatedly restarted when the
monitored User-ID server became unreachable during Kerberos
authentication connection attempts, which caused the authentication
process to stop responding. On firewalls in HA configurations, both
peer firewalls entered maintenance mode.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-320324</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where incorrect source region information appeared in
GlobalProtect logs, which occurred because the location service lookup
did not consistently return region information for public IP
addresses. With this fix, accurate source region information is
consistently displayed.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-320290</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where ACC reports did not display data under the
<span class="ph uicontrol">Area</span> and
<span class="ph uicontrol">Column</span> graphs. This occurred when
the report included dates prior to March 8.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-320062</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where changing a firewall's master key caused template
configuration, previously pushed by Panorama, to be incorrectly copied
to the firewall's local running configuration, which resulted in the
configuration persisting on the firewall even after it was removed
from the Panorama template. With this fix, the template configuration
is correctly managed.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319940</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<span class="ph systemoutput">set system setting target-vsys</span>
command output displayed the virtual system (vsys) ID in both columns.
With this fix, the command output now correctly displayed the vsys ID
and the corresponding vsys name.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319889</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a firewall became non-functional when dataplane
and control plane monitoring processes exited due to missed
heartbeats, which occurred after a dataplane crash. With this fix, the
firewall maintained operational stability.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319798</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Panorama virtual appliances in AWS environments only</tt
>) Fixed an issue where logging disks failed to mount or reported an
unknown file system type.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319793</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, after upgrading to PAN-OS 12.1.5, GlobalProtect
Clientless VPN failed to access JavaScripts.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319656</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where security policies intermittently did not apply as
expected to users, which resulted in inconsistent access. This
occurred because the User-ID Agent learned user identities in multiple
formats, such as User Principal Name (UPN) and Security Account
Manager (SAM) account names, which led to inconsistent group mapping
and unreliable policy enforcement. With this fix, security policies
apply consistently based on user group memberships.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319570</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where shadow rule and duplicate rule warnings did not
appear during the validation stage of a configuration commit
operation, which prevented administrators from addressing these issues
before the final commit to the device. With this fix, these warnings
now appear during the validation stage.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319557</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where graphical counters did not display correctly in
the control plane or dataplane monitor logs.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319504</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where telemetry data was not sent to the cloud due to
the firewall being unable to resolve the destination server's FQDN
even when a proxy server was configured. With this fix, the firewall
properly sends telemetry data through the configured proxy server
without requiring direct public DNS resolution for the telemetry
server's FQDN.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319481</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on Panorama where system logs did not display the
firewall serial numbers when Panorama retrieved logs from the SLS.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319419</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Firewalls in active/passive HA configurations only</tt
>) Fixed an issue where active firewalls were unable to send device
telemetry data to CDL.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319415</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Firewalls in active/passive HA configurations only</tt
>) Fixed an issue where the passive firewall's device certificate
failed to automatically renew when the custom service route through
data interface configured only for paloalto-networks-services but not
for dns service. This occurred due to a logic error that caused the
passive device to attempt a direct renewal through its own inactive
data interface instead of properly tunneling the renewal through the
active device via the HA1 interface. Because data ports cannot forward
traffic on a passive firewall, the connection timed out, preventing
automatic renewal.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319352</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall rebooted unexpectedly without any
configuration or power changes.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319343</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Prisma Access Gateways only</tt>) Fixed an issue
where the global management plane stopped responding, which caused SSH
and HTML disconnections, HIP database lookup failures, and
significantly slower SCM commits. This occurred when egress IP allow
listing was enabled in SCM and changes were made to EDLs.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319342</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, after upgrading Panorama, HA firewalls did not
consistently group together in the Panorama interface even though HA
was enabled on both peers.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319335</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall did not follow configured management
proxy settings for OCSP and CRL queries, and instead reverted to
default configurations after a process restart.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319288</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a DPC in Slot 4 restarted repeatedly, which
caused internal path monitoring failures and a failover event.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319266</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Cloud IPS only</tt>) Increased scale limit for zone
mappings.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319228</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where External Dynamic List (EDL) refresh and commit
operations remained in a pending state, which prevented any subsequent
operations from completing.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319136</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall generated high-severity system log
alerts due to a certificate trust issue during SSL handshakes.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-319029</div></td>
<td class="entry relcol">
<div class="p">
(Firewalls in an Active/Active HA configuration only) Fixed an issue
where a discrepancy occurred between the total number of allocated
sessions and the sum of active sessions on the secondary Active node.
With this fix, the session counts now accurately reflect the active
sessions.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-318991</div></td>
<td class="entry relcol">
<div class="p">
(PA-440 and PA-220 firewalls only) Fixed an issue where SNMP-reported
ingress traffic statistics for tunnel interfaces were approximately
doubled after a PAN-OS upgrade, which led to inaccurate monitoring
data. With this fix, SNMP traffic statistics for tunnel interfaces now
report accurate ingress traffic.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-318990</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>GlobalProtect dual-profile MacOS/Windows deployments only</tt
>) Fixed an issue where GlobalProtect commit warnings incorrectly
flagged SAML
<span class="ph uicontrol">default browser</span> mismatches between
authentication profiles and agent configurations.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-318949</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where irrelevant error messages related to IoT devices
filled the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>logrcvr</a
>
logs.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-318784</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall stopped processing traffic and all
VPN tunnels went down even when the firewall remained in an active
state, and the CLI became unresponsive.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-318619</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where Geneve ingress traffic did not use the correct
public IP address for return traffic.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-318614</div></td>
<td class="entry relcol">
<div class="p">
(PA-7080 firewalls only) Fixed an issue where the Strata Logging
Service (SLS/CDL) status displayed a device connectivity error
erroneously.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-318580</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where processes restarted and the firewall unexpectedly
rebooted when you configured a Security policy rule with
<span class="ph uicontrol">Source Device &gt; quarantine</span>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-318567</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the OpenConfig plugin stopped working after a
configuration update.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-318472</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where traffic to multiple websites intermittently
encountered a block page, which occurred because traffic was
incorrectly matched to a default security policy instead of the
intended allow policy. With this fix, traffic is processed according
to the configured security policies.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-318412</div></td>
<td class="entry relcol">
<div class="p">
(On Panorama in management-only mode) Fixed an issue where the ACC SSL
Activity tab did not display the statistics table. With this fix, the
ACC SSL Activity tab now properly shows the statistics table.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-318382</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Firewalls in HA configurations only</tt>) Fixed an
issue where the secondary firewall remained at an
<span class="ph uicontrol">Initial</span> state after an upgrade.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-318275</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">VM-Series firewalls only</tt>) Fixed an issue where
the firewall became unresponsive and did not automatically reboot,
which led to prolonged outages. With this fix, the Linux kernel
configuration will trigger a system panic and reboot.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-318205</div></td>
<td class="entry relcol">
<div class="p">
(Firewalls in active/passive HA configuration) Fixed an issue where
the <span class="ph systemoutput">dnsproxy</span> process would
unexpectedly terminate, which led to an out-of-memory condition and
affected network connectivity. With this fix, the
<span class="ph systemoutput">dnsproxy</span> process now maintains
stable operation.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-318186</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where Selective Push operations failed after a partial
revert was performed for deleted objects in a Panorama device group,
which led to invalid object references.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-318120</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where SSL traffic was silently dropped when traffic was
processed by a Security policy with an Anti-Spyware profile that had
Inline cloud Analysis enabled for SSL C2 Detector with an action other
than allow or alert.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-318106</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where SCM did not update device telemetry for the
firewall after upgrading to an affected release.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-318033</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where IP mappings would remain with future timestamps,
which prevented them from being visible through the command-line
interface and from being cleared using standard commands. This
behavior was caused by an NTP issue, which resulted in IP mappings not
functioning as expected. With this fix, IP mappings are correctly
managed and cleared.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-318030</div></td>
<td class="entry relcol">
<div class="p">
<tt class="ph tt">VM-Series firewalls in Hyper-V only</tt>) Fixed an
issue where the throughput was reported to be twice as high as the
actual traffic rate.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-317904</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where you were unable to retrieve WildFire private
content updates with when custom certificates were configured for
authentication between the firewall and WildFire appliance.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-317858</div></td>
<td class="entry relcol">
<div class="p">
Added a CLI command to address an issue where ethernet trailer padding
was not removed during IPv4-to-IPv6 packet translation. This occurred
when the original packet contained ethernet trailers and the
translated packet exceeded the minimum MTU.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-317772</div></td>
<td class="entry relcol">
<div class="p">
Added a fix to improve performance in lossy network conditions.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-317755</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on Panorama where selective push operations failed when
plugin configurations included access-domain or log-collector
references.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-317749</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the commit scope preview for a vsys incorrectly
displayed configuration changes made in other vsys, even when the
commit only applied changes to the intended vsys.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-317648</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>PA-5450 firewalls and PA-7000 Series firewalls with 100G NPCs
only</tt
>) Fixed an issue where intermittent packet loss occurred when
traversing the dataplane after upgrading the firewall. This occurred
when a dataplane HA interface was configured in an environment where
Slot 1 was unpopulated , which resulted in a wildcard entry being
created within the QMAP table.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-317614</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where high throughput and increased packet rates caused
high dataplane CPU usage.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-317600</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Firewalls in HA configurations only</tt>) Fixed an
issue where autocommit operations took longer than expected to
complete when the firewalls were configured with multiple vsys and
EDLs. This occurred because the firewalls were unable to reach the DNS
server during the autocommit process.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-317598</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Firewalls in active/active HA configurations only</tt
>) Fixed an issue where NAT failures occurred due to the IP pool not
releasing unused resources in the Active Secondary firewall. This
occurred because the secondary firewall attempts to release a
Persistent DIPP NATed port that was originally allocated by the NAT
policy from first firewall, leading to a ownership mismatch during the
session teardown process.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-317583</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue with intermittent ICMP ping drops and packet loss in
traffic flows between a hub and branch after upgrading to an affected
PAN-OS release due to incorrect SD-WAN path monitor state.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-317466</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where SIP sessions stopped progressing after the
firewall received fragmented packets, fragmented at header field.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-317372</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where custom administrators received an
<span class="ph uicontrol">access denied</span> error when attempting
to view specific policy rule details from the
<span class="ph uicontrol">Rule Shadow</span> tab after a push from
Panorama, even when the administrator had permissions to view Security
policy rules.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-317215</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>VM-Series firewalls on ESXi with Intel E810 NICs using PCI
passthrough</tt
>) Fixed an issue where the
<span class="ph systemoutput">brdagent</span> process became
unresponsive during data port initialization. This issue caused system
instability, interface outages, HA split-brain conditions (which occur
when nodes in a cluster lose communication with each other, remain
operational, and independently assume they are the primary active
unit), and unexpected reboots during failover.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-317214</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where SNMP queries for TCP connections per second (CPS)
metrics on single vsys firewalls returned inconsistent values.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-317177</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on firewalls in DHCP Client mode where, after upgrading
to an affected release, the SNMP process unexpectedly restarted after
a commit, which led to false interface flap notifications on SNMP
managers.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-317068</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on the Panorama web interface where you were able to
enable IPv6 for IKE gateways and IPSec tunnels even when IPv6 WAN was
disabled, which resulted in an invalid configuration. To utilize this
fix, upgrade to the latest Panorama plugin.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316979</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall rebooted unexpectedly when
packet-diag logging was enabled. With this fix, the firewall maintains
stability when this logging is active.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316978</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where system log error messages were displayed after
every firewall reboot, even when the firewall functioned correctly
after the reboot.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316937</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where GlobalProtect users intermittently received
incorrect private IP addresses after connecting to a gateway behind a
Network Load Balancer (NLB).
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316922</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where BGP Conditional Router Advertisement did not
function as expected after a change was made to the BGP configuration.
With this fix, BGP Conditional Router Advertisement now behaves as
intended.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316911</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>VM-Series firewalls on Amazon Web Services (AWS) environments
only</tt
>) Fixed an issue where a newly bootstrapped firewall required a
management server restart, relicensing, or license push from Panorama
to invoke the device certificate.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316869</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where previously committed Security policy rules were
removed when a full commit was performed by a different administrator,
which led to the inadvertent loss of configuration changes. With this
fix, Security policy rules are retained as expected after a full
commit.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316856</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where an error message displayed when attempting to
delete the Logging Service certificate or view the Logging Service
customer information.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316761</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>reportd</a
>
process timeout errors occurred during a manual management server
restart.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316721</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where multiple EDL fetches were queued and did not
complete.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316720</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on log collectors where
<span class="ph uicontrol">Verify Update Server Identity</span> was
not consistently enabled and visible in the XML configuration after a
configuration push from Panorama.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316718</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall stopped forwarding logs or
generating system and configuration logs to Panorama after restarting
the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>mgmtsrvr</a
>
process.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316631</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue BGP sessions experienced short disruptions across all
peers, interfaces, and slots when a multicast event persisted longer
than the NGP negotiated hold timers.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316605</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where HIP redistribution to remote network nodes from
external gateways resulted in a large amount of error messages in
User-ID logs.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316556</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a race condition between the session ager and
packet processing resulted in memory corruption and caused the
pan_task process to stop responding, which resulted in the firewall
becoming unresponsive
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316435</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall restarted unexpectedly due to an OOM
condition after upgrading to an affected release.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316433</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on the web interface where the last digit of entries in
policy rule descriptions were truncated.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316263</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where an incorrect validation error was displayed,
falsely indicating that IKE Gateway and IPSec tunnel names can begin
with a numeral
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316120</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, after Advanced Routing was enabled, the firewall
advertised routes to internal BGP neighbors with the original external
BGP next-hop address.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316106</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Panorama appliances in Log Collector mode only</tt
>) Fixed an issue where commit validation failed after an upgrade when
the previous configuration included a
<span class="ph systemoutput">shared-optimization</span> setting.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-316070</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a BGP peer automatically established a BGP
connection after manually adding it via the CLI when Advanced Routing
was enabled.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-315965</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue to address TCP proxy fast recovery behavior to follow
RFC 5681.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-315964</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on the web interface where you were unable to sort an
AS path list by its sequencing number (**Network &gt; Routing &gt;
Routing Profiles &gt; Filters &gt; Filters AS Path Access List*).
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-315959</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">M-700 appliances only</tt>) Fixed an issue where
Panorama displayed an incorrect maximum recommended configuration size
when performing a commit.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-315958</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">PA-1410 firewalls only</tt>) Fixed an issue where
the SaaS Quality Profile HTTP/HTTPS monitoring feature failed to send
probes due to the firewall being unable to determine the correct
egress interface and source IP address for the monitoring probes.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-315919</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where GlobalProtect pre-logon tunnel session was not
cleared even after the user was logged in. With this fix, the session
is cleared after the session timeout expires.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-315913</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, after a User-ID restart on a redistribution
firewall, some expiring IP tag entries became permanent instead of
aging out as intended, which affected Dynamic Address Group policy
rule enforcement.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-315912</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the Maximum Segment Size (MSS) rewrite
functionality for packets ingressing through SD-WAN interfaces on
firewalls was not optimized.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-315820</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where User-ID XML API requests took longer than
expected to return a response, which caused the web interface and
captive portal pages to respond slowly or fail to load. this occurred
when sending XML API requests for IP address-to-user mapping.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-315683</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where certain permitted IP addresses, when pushed from
a Panorama template, remained editable on the firewall web interface.
With this fix, these template-managed IP addresses are no longer
editable on the firewall.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-315661</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where exporting policies to PDF or CSV files from
Panorama did not include all policies or resulted in out-of-order
entries when using a read-only (RO) or read/write (RW) access account.
With this fix, policy exports now include all policies and maintain
the correct order.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-315630</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where firewalls dropped new connections due to session
allocation failures, which resulted in service disruption. With this
fix, firewalls no longer dropped new connections due to session
allocation failures.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-315619</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on the web interface where the
<span class="ph uicontrol">Logging and Reporting</span> settings
remained loading indefinitely after an upgrade.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-315424</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the BGP peer filter match condition incorrectly
identified neighbors in the Advanced routing Engine, which led to
incorrect Logical Preference assignments and illogical path
selections. This occurred when a BGP Inbound Route Map was configured
to prioritize a path from a specific peer by setting its
<span class="ph uicontrol">Local Reference</span>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-315337</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where GlobalProtect throughput was reduced after an
upgrade.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-315314</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, when a push operation from Panorama to the
firewall failed, accounting logs stopped forwarding.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-315176</div></td>
<td class="entry relcol">
<div class="p">
Added an enable and disable CLI command to address an issue where the
firewall experienced increased packet drops and slower performance
after an upgrade due to high burst traffic.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-315069</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, after an upgrade, Panorama displayed 0% (N/A)
for Environmental and Device memory metrics under the Health tab,
preventing you from viewing the expected health status of your managed
devices. With this fix, Panorama now accurately displays the
Environmental and Device memory health metrics for your managed
firewalls.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-315005</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where configured RIPv2 timer parameters were not
applied when the profile was configured with custom update, expire,
and delete values, and the system continued to use the default timer
settings, which caused unexpected route removal and network
disconnections.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-315000</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the "Block Repeated Characters" setting in
Minimum Password Complexity did not prevent the use of certain
repeated special characters. With this fix, the system now correctly
blocks repeated special characters as configured.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314873</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall intermittently stopped forwarding
traffic to the internet.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314868</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a commit operation would fail after a PAN-OS
upgrade, which occurred when the virtual system (VSYS) configuration
allocator usage reached 100%. With this fix, the virtual system
configuration allocator usage is managed correctly, allowing commit
operations to complete successfully.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314818</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall dropped IPv6 packets after enabling
<span class="ph uicontrol">Strict IP Check</span> under
<span class="ph uicontrol">Zone Protection</span> in an SD-WAN
configuration.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314776</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>configd</a
>
process stopped responding after pushing configuration changes from
Panorama to the firewall.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314752</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on Panorama where, after removing a scheduled
configuration push, Panorama still initiated the push at its
previously scheduled time.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314712</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">PA-7500 Series firewalls only</tt>) Fixed an issue
where the source IP Dynamic Address Group mappings were intermittently
not displayed under
<span class="ph uicontrol">Monitor &gt; Traffic logs</span>. This
occurred even when dynamic address groups were updated via XML API
without an expiry time and no unregister requests were observed.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314635</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Firewalls in active/passive HA configurations only</tt
>) Fixed an issue where both firewalls stopped responding and
initiated multiple failovers when internal processes became
unresponsive.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314630</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall repeatedly rebooted and entered
maintenance mode, and a factory reset was required.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314624</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<span class="ph systemoutput">useridd</span> process became
unresponsive and restarted when attempting to dump the Host
Information Profile (HIP) database via CLI while the system was
actively processing HIP reports. This was caused by a lock contention.
With this fix, the process now operates as expected under these
conditions.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314623</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Firewalls in active/passive HA configurations only</tt
>) Fixed an issue where, after a failover, routing information within
OSPF protocol was not correctly translated or propagated, which
affected network path convergence and FRR capabilities.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314512</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the GlobalProtect portal became inaccessible when
the dataplane was configured with a DHCP assigned IP address.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314499</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Firewalls with site-to-site IPSec VPN tunnels only</tt
>) Fixed an issue where you were unable to access some websites over
HTTPS when Accumulation Proxy was enabled. This occurred due to the
external server's SYN-ACK packet not designating the MSS for HTTPS
sessions traversing over IPSec VPN tunnel, which prevented Client
Hello packets from forwarding correctly.
</div>
<div class="p">
To use this fix, run the CLI command
<span class="ph systemoutput"
>set deviceconfig setting tcp use-min-mss yes</span
>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314477</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where committing configuration changes failed due to
the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>routed</a
>
process not responding.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314435</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on the Panorama web interface where custom application
tags for cloud applications were not consistently displayed in the
Application Filter or application details even though the tags were
configured via CLI and successfully enforced traffic blocking policy
rules.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314399</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where Layer 3 (L3) recovery did not activate on
firewalls when a cellular interface was transmitting data but not
receiving any, which prevented the firewall from re-establishing
connectivity. With this fix, L3 recovery now properly initiates under
these conditions.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314385</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Firewalls in active/passive HA clusters only</tt>)
Fixed an issue where high dataplane CPU usage occurred and traffic
offloading decreased when a failover occurred from the active firewall
to the passive firewall, and then back to the active firewall.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314372</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, when SSL Inbound Decryption was enabled, the
inbound SMTP email delivery to an internal mail server failed due to
the firewall silently dropping application packets containing SMTP
commands after successful decryption.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314365</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>logrcvr</a
>
process stopped responding for traffic containing multiple XFF headers
when URL XFF header logging was enabled along with additional XFF
header logging, which caused subsequent commits to fail.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314319</div></td>
<td class="entry relcol">
<div class="p">
Added a CLI command to enable and disable AHO software offload
optimization.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314300</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall continued to send LLDP learned
information via SNMP for an interface even after disabling LLDP on
that interface. This occurred when a third-party tool polled SNMP and
it received outdated topology information.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314223</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the Panorama web interface did not display all
Security policy rules when using a Chromium-based browser, and you
were unable to scroll to the bottom of the page to view the complete
list.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314147</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where SSL traffic was dropped on SD-WAN DIA interfaces
with member having different MTU.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314142</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where establishing log forwarding connections to the
Strata Logging Service (SLS) took longer than expected, which resulted
in delayed log visibility on SLS.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314126</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where session rematch did not properly apply updated
Security policy rules to existing traffic flows after committing
changes, which caused traffic to still be allowed when a new Security
policy was set to <span class="ph uicontrol">Deny</span>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314104</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where running BCM counter commands from the
administrative shell did not consistently return output, and commands
to modify queue sizes did not take effect.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314061</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where traffic was disrupted during IPSec rekey
operations due to a 2 second delay in sending the DELETE message for
the previous Security Association (SA) to the peer gateway after a new
SA was negotiated.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314050</div></td>
<td class="entry relcol">
<div class="p">
(Firewalls in a High Availability (HA) configuration) Fixed an issue
where your Firewalls experienced HA split-brain, unexpected system
restarts, and the routing process repeatedly stopped responding,
leading to significant disruption of production traffic. This occurred
when you enabled the Advanced Routing Engine, which also caused High
Availability (HA) keep-alive connections to become unavailable and an
out-of-memory condition. With this fix, your Firewalls maintain stable
operation after you enable the Advanced Routing Engine.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314020</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall did not decapsulate GENEVE packets
when DNS Security retransmitted a DNS query after receiving a verdict
from the cloud.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-314018</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">VM-Series firewalls in AWS environments only</tt>)
Fixed an issue where the decrypt mirror port did not function
expected, which prevented decrypted traffic from reaching the intended
destination collector.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313976</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on Panorama where traffic, URL, and unified log entries
were duplicated, which led to inaccurate Security logging after
applying a time filter for the previous 6 hours.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313915</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where GlobalProtect SAML metadata exported from the
firewall displayed the gateway's IP address instead of the FQDN.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313850</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>PA-1400 Series firewalls in HA configurations only</tt
>) Fixed an issue where a split-brain condition occurred and HA1/HA2
links went down while upgrading when the HA configuration used
dataplane interfaces for HA1 and a combination of HSCI and Ethernet
interfaces for HA2.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313828</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall did not forward traffic due to
memory issues on a forwarding component.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313827</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a memory leak occurred related to the
<span class="ph systemoutput">reportd</span> process when custom
reports were run via API.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313787</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where some system log filters with the
<span class="ph systemoutput">eventid</span> operator for a BGP event
did not work.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313711</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<span class="ph systemoutput">show system environmentals power</span>
CLI command displayed duplicate slot names and associated voltage
values.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313700</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where an unexpected reboot occurred when Inline Cloud
Analysis was enabled in an Anti-Spyware and Vulnerability profile.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313623</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<span class="ph systemoutput">/opt/pancfg/mgmt/ssl/private/</span>
directory on Palo Alto Networks devices with TPM support became 100%
utilized due to an accumulation of undeleted
<span class="ph systemoutput">.pub_pem</span> files. This occurred
because executing the
<span class="ph systemoutput">show device-certificate status</span>
CLI command initiated a process that generated these files but failed
to remove them, which prevented the fetching of new device
certificates.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313606</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where Panorama pushed commits took longer than expected
to complete without displaying an error message when committing due to
slow cloud-app compilation.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313575</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where 10G connections on built-in RJ45 interfaces
(ethernet1/1 through ethernet1/5) intermittently experienced interface
flapping when connected to Cisco switchports.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313572</div></td>
<td class="entry relcol">
<div class="p">
<tt class="ph tt">VM-Series firewalls only</tt>) Fixed an issue where
the dataplane restarted due to a segmentation fault.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313523</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where generating a tech support file caused
GlobalProtect users to be forcibly logged out.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313494</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where ARP entries remained in a
<span class="ph uicontrol">complete</span> state with a TTL of 0 on
the active-secondary node, which prevented affected devices from
reliably communicating when traffic routes routed through that node.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313481</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, after configuring a PBF policy rule with return
address in a multi-vsys configured device, commit operations failed
due to the PBF return address exceeding the maximum capacity.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313443</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where firewalls acting as an accumulation proxy sent a
server hello with an earlier TCP timestamp value than a preceding ACK
packet, which prevented successful session establishment. This
occurred when the client hello messages were split across multiple
network segments.
</div>
<div class="p">
To use this fix, run the CLI command
<span class="ph systemoutput"
>debug dataplane set ssl-decrypt accumulate-client-hello ts-relay
yes</span
>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313393</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, after you configured a proxy server, External
Dynamic Lists (EDL) and system software checks did not function
concurrently. This occurred when you configured service routes for
Palo Alto Networks services, which caused either EDL updates or system
software checks to fail, depending on the specific service route
configuration. With this fix, both EDL updates and system software
checks correctly utilize the configured proxy server.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313258</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where PIM multicast routing failed on appliances with
advanced routing enabled.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313218</div></td>
<td class="entry relcol">
<div class="p">
Added the following CLI commands to address QoS packet drops due to
bursty traffic:
</div>
<ul class="ul">
<li class="li">
<span class="ph systemoutput"
>debug dataplane set qos-setting qos-param qlimit 300</span
>
</li>
<li class="li">
<span class="ph systemoutput"
>debug dataplane set qos-setting qos-param red low 50 high
90</span
>
</li>
</ul>
<div class="p">
To utilize this fix, change the parameters, disable QoS, commit
changes, enable QOS, and then re-commit changes.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313216</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where firewalls with Prisma Access incorrectly
displayed some traffic as unsanctioned in traffic logs for cloud
applications that were tagged as
<span class="ph systemoutput">sanctioned</span>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313193</div></td>
<td class="entry relcol">
<div class="p">
<tt class="ph tt">Firewalls in Layer 2 mode only</tt>) Fixed an issue
where the new sessions were not able to be established due to the
firewall intermittently dropping valid MAC address entries for
specific VLANs when a manual switchover sent a high volume of traffic
to the firewall.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313190</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">VM-Series firewalls only</tt>) Fixed an issue where
content updates and configuration commits failed with the error
message
<span class="ph systemoutput"
>client device phase 1 failure error</span
>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313048</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the BGP default route was lost from the
forwarding table during a failover, which caused a temporary service
interruption.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-313036</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall dataplane continuously accumulated
packets in the <span class="ph systemoutput">ctd_pkt_queue</span> and
packet buffers, which caused resource exhaustion and prematurely
terminated sessions.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312870</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on Panorama where
<span class="ph uicontrol">Apps Seen</span> was not updated in
Security policy rules even when the firewall correclty recorded the
**Last App Seen* timestamp and Panorama received monitor logs.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312844</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a TLSv1.3 handshake did not complete when SSL
Forward Proxy was enabled. This occurred when a large ClientHello
message was split across multiple TCP segments and the final segment
contained only one byte.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312725</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where no warning message was displayed during commits
for improperly formatted FQDN or IP address values in the
GlobalProtect Enforcer configuration. This fix requires a compatible
content version on the firewall.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312706</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewalls restarted due to a function lacking
a NULL-pointer sanity check.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312697</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where firewalls intermittently failed to send all logs
to the SLS.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312685</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where committing a scheduled configuration push on
Panorama caused the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>configd</a
>
process to stop responding unexpectedly.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312618</div></td>
<td class="entry relcol">
<div class="p">
(PA-3420, PA-3430, PA-3440 firewalls only) Fixed an issue where the
firewall was unable to activate GlobalProtect client software and
displayed <span class="ph systemoutput">SW LIMIT</span> messages
related to max-profiles and unsupported major and minor versions in
the downgrade list, which prevented successful software installation.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312514</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where correlation logs were not forwarded via syslog or
email.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312354</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where Captive Portal authentication redirects failed
for HTTPS traffic when a user attempted to access internal HTTPS
websites via URL, which led to
<span class="ph uicontrol">ERR_CONNECTION_RESET</span> error messages
in the browser with SSL decryption and CTD handshake inspection
enabled.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312330</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Firewalls in active/passive HA configurations only</tt
>) Fixed an issue where the Clientless VPN applications failed to load
due to the firewall dataplane incorrectly processing session
information.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312277</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, after manually restarting the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>mgmtsrvr</a
>
process caused the firewall to stop generating or forwarding system
and configuration logs to Panorama, and a reboot was required to
restore logging functionality.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312267</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall lost its MAC entry which caused IPv6
traffic sessions to become unresponsive or drop. This occurred when
PBF rules were configured with symmetric return and
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>no-pbf</a
>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312157</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, during a commit, the firewall intermittently
stopped sending SNMP messages, which caused interface counters to stop
updating for brief periods of time.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312156</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where firewalls did not correctly apply SD-WAN policy
rules, which caused traffic to be incorrectly routed via local
breakout instead of VPN backhaul.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-312021</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where API responses included an unexpected NUL
character when retrieved using API clients, which interfered with the
processing of the response.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311988</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Firewalls in FIPS mode only</tt>) Fixed decryption
issues that occurred after an upgrade to an affected release.
</div>
<div class="p">
To enable this fix, run the CLI command
<span class="ph systemoutput"
>debug dataplane set ssl-decrypt low-memory-throttle enable</span
>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311822</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where system processes would unexpectedly terminate on
Prisma Access instances during a configuration commit operation when
TLS 1.3 proxy settings were configured. With this fix, system
processes remain stable during configuration commits.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311658</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>reportd</a
>
process stopped responding, which caused the firewall to reboot.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311624</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on Panorama where, when an Aggregate Ethernet interface
was configured in override mode within a template stack, changing its
management profile unexpectedly overrode other interface-specific
variables.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311567</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where device-group and template admin sessions failed
to time out, causing an accumulation of active sessions. With this
fix, administrator sessions now terminate as expected.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311512</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where HIP (Host Information Profile) reports were
blocked on GlobalProtect when
<span class="ph uicontrol"
>Authentication Cookie Usage Restrictions</span
>
was enabled and the Prisma Access Agent protocol was in use. This
occurred because the system failed to correctly process HIP messages
that were relayed via IPSec tunnels with a Virtual IP as the source,
leading to their rejection.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311506</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on Panorama where scheduled Saas Application usage
reports and on-demand reports generated using
<span class="ph uicontrol">Run Now</span> displayed different results.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311456</div></td>
<td class="entry relcol">
<div class="p">
Enhanced the SCP-based export script by adding comprehensive logging
to identify and diagnose the root cause for failed or incomplete
traffic log exports.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311449</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where global search did not return comprehensive
results after an upgrade and only displayed top-level objects.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311435</div></td>
<td class="entry relcol">
<div class="p">
(VM-Series firewalls in Azure Public Cloud only) Fixed an issue where
DHCP client IP addresses were unexpectedly cleared on interfaces after
an upgrade and a subsequent configuration push from Panorama,
particularly when committing certain configuration changes, which
resulted in interface IP loss and service disruption. With this fix,
DHCP client IP addresses are retained as expected after upgrades and
configuration pushes.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311419</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the recommended filter for identifying traffic
from unidentified users in traffic logs reported an incorrectly low
number of results.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311412</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<span class="ph systemoutput">show advanced-routing resource</span>
CLI command failed to execute successfully when invoked through the
XML API and returned an error message.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311352</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue in SD-WAN deployments where DIA traffic was disrupted
when DIA AnyPath was enabled during path transitions from the SD-WAN
VIF to the physical interface. With this fix, the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>drop the packet even on zone change</a
>
configuration is not needed to prevent interrupted DIA traffic during
path switching.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311285</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a memory leak occurred related to the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>ospfd</a
>
process, which caused RAM usage to continuously increase until the
device stopped responding.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311261</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall generated duplicate URL Filtering
logs due to an error condition&nbsp;when the new XFF feature was
enabled.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311250</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Panorama appliances and Log Collectors only</tt>)
Fixed an issue where logs from multiple devices were not visible on
Panorama even though the Elasticsearch health status on the dedicated
Log Collectors appeared green.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311248</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the ABR failed to translate and advertise the
default route (0.0.0.0/0) from an OSPF NSSA area into the OSPF
backbone area as a Type-5 LSA.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311235</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the management interface became temporarily
disconnected after a commit.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311218</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on Panorama where a system health check Security policy
rule was applied to <span class="ph uicontrol">any</span> zones
instead of <span class="ph uicontrol">Public</span> or
<span class="ph uicontrol">Private</span>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311205</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where XML queries failed when you attempted to compare
configuration versions.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311192</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>device-telemetry collect-now</a
>
process became unresponsive when the process was initiated multiple
times with other processes running concurrently, which prevented
subsequent telemetry collection.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311166</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall rebooted unexpectedly to the
<span class="ph systemoutput">all_task_1</span> process repeatedly
restarting.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311113</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall was unable to clear sessions using
the CLI command
<span class="ph systemoutput">clear session all filter rule</span>
when the specified rule name exceeded 32 characters, even though the
limit is 63 characters.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311098</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where firewalls entered a nonfunctional state due to L7
running out of resources due to a high volume of traffic.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311074</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where GRE tunnels took significantly longer to
establish when the hold timer was configured to a value of 10 or
higher, which resulted in a tunnel requiring more successful keepalive
packets than expected to transition to an
<span class="ph uicontrol">Up</span> state.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-311040</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>all_task</a
>
process stopped responding and caused the firewall to reboot
unexpectedly.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310939</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Firewalls in HA active/active configurations only</tt
>) Fixed an issue where the firewall experienced random reboots due to
a memory leak in the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>ikemgr</a
>
process triggered by configuration pushes. The leak occurred when an
IKE Gateway was configured on a loopback interface using a floating IP
address, leading to repeated socket bind failures on the secondary
device.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310851</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where firewalls experienced
<span class="ph systemoutput">snmpd</span> log flooding with messages
such as
<span class="ph systemoutput"
>update_ifTable_utilization_rates(pan_interfacecache.c:1720): Last
time is 0 for dedicated-ha2.</span
>, which caused the <span class="ph systemoutput">snmpd</span> log to
overflow and be cleared every five minutes. This occurred because the
<span class="ph systemoutput">snmpd</span> process attempted to
calculate interface utilization rates without first verifying if the
interface had valid
<span class="ph systemoutput">sysd</span> configuration data, as the
code incorrectly assumed all interfaces in the MIB would possess valid
<span class="ph systemoutput">sysd</span> data.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310743</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where you were unable to change an administrator's
authentication profile to <span class="ph uicontrol">None</span>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310736</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where importing a profile that included a source
address would not correctly display the source address on the policy
page. With this fix, the source address now displays as expected after
profile import.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310699</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall stripped the Authentication Key
Identifier (AKID) from certificates using SSL decryption, which
prevented clients from authenticating server certificates and resulted
in decryption failures.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310627</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where Inline Cloud Analyzer (ICA) did not correctly
apply custom URL categories configured as exceptions for traffic
detection. With this fix, ICA correctly applies the configured custom
URL category exceptions.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310622</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where customized destination pages displayed content
improperly formatted. With this fix, customized destination pages
display content correctly.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310618</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where you were unable to import the GlobalProtect app
welcome page on Panorama using SCP or TFTP from the CLI.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310526</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where you were unable to download cellular firmware
through Panorama.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310473</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where committing configuration changes to an Advanced
Logical router caused a 20-30 second loss of management access in the
firewall when IPv4 and IPv6 default static routes were configured with
identical attributes including interface, next-hop, and metrics, which
triggered an unnecessary routing table refresh.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310472</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on the web interface where checkboxes for
<span class="ph uicontrol">default information originate</span> and
ABR in OSPF NSSA configurations were automatically enabled which
resulted in unexpected configuration changes.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310362</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where IPv6 Routed HA did not function correctly when
the HA1 (control link) was configured with an IPv6 routed connection.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310267</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a process stopped responding during Go garbage
collection (GC).
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310263</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">VM-Series firewalls only</tt>) Fixed an issue where
enabling TLS1.3 in a decryption profile prevented access to websites.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310240</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where software packet buffers were completely utilized
when performing a Data Loss Prevention longevity test.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-310218</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where NFS hidden files accumulated in a log directory
and led to high disk utilization, which prevented the system from
automatically purging them. With this fix, the system properly manages
and purges the files.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-309960</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a memory leak related to the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>useridd</a
>
process on the passive device led to an OOM condition.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-309944</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where an error message was incorrectly displayed
instead of a debug message.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-309927</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on Panorama where the
<span class="ph systemoutput">multi-clone</span> XML API operation
reported a successful configuration change even when the specific
device group did not exist.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-309831</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where an AI Runtime Security Firewall rebooted when
processing Cursor traffic.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-309676</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on Panorama where a database component unexpectedly
stopped when Panorama was deployed using an .ova file or
upgraded/downgraded to an affected PAN-OS version. This occurred due
to a required directory not being created during the initial
provisioning workflow. With this fix, the necessary directory is
created automatically during deployment.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-309493</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the URL cloud connection was impacted, which
caused a traffic outage.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-309306</div></td>
<td class="entry relcol">
<div class="p">
Fixed a rare issue on Octeon Dataplane platforms where the firewall
experienced an unexpected dataplane restart due to a race condition
that occurred during session teardown for traffic undergoing
software-based Content Threat detection.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-309217</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on the Panorama web interface where refreshing or
configuring settings in the
<span class="ph uicontrol">Response Pages</span> tab caused the web
interface to respond more slowly when navigating to other tabs.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-309014</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where an internal interface identifier became invalid
following real-time threat analysis processing. This caused traffic to
be misrouted or improperly handled. With this fix, the system
correctly manages interface identifiers during threat analysis,
ensuring consistent traffic flow.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-308928</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where OSPF routes did not install correctly when you
performed a traffic switch between firewalls with the Advanced Routing
Engine enabled, which led to routing instability.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-308876</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where upgrades to managed firewalls from Panorama
failed.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-308812</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where firewalls using the Real-Time update setting for
WildFire intermittently generated system alerts indicating a failure
to connect to the WildFire real-time cloud. With this fix, these
alerts are no longer generated.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-308775</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Firewalls in active/passive configurations only</tt
>) Fixed an issue where NTP status intermittently showed as rejected
on the active firewall, which prevented the firewalls from
synchronizing time.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-308769</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where BGP connections intermittently dropped and
entered a <span class="ph uicontrol">Connect</span> state, leading to
service outages for traffic routed over Large Scale VPN (LSVPN)
tunnels. This occurred because the firewall performed an incorrect
route lookup for BGP traffic over an Internet Protocol Security
(IPSec) tunnel. With this fix, BGP connections remain stable.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-308732</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Multi-vsys firewalls only</tt>) Fixed an issue
where GlobalProtect clients were unable to use custom source region
objects for gateway selection criteria due to region objects defined
in Panorama not being correctly recognized or displayed in the
GlobalProtect Portal configuration.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-308711</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where superusers with read-only privileges on Panorama
were unable to execute
<span class="ph systemoutput">show device-certificate</span> CLI
commands.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-308710</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where Advanced DNS Security telemetry utilized only one
processing stream even when multiple processing streams were
available.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-308651</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on the firewall web interface where the TLSv1.3_Default
certificate setting and SSL/TLS profile were not displayed."
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-308564</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where packets were dropped on SD-WAN interfaces when a
proxy was enabled due to an MTU inconsistency where the firewall
failed to rewrite the maximum segment size in SYN/ACK packets based on
the SD-WAN virtual interface MTU.
</div>
<div class="p">
Note: This fix does not apply when the traffic egress interface
is&nbsp;SD-WAN Direct Internet Access (DIA) interface and proxy is
enabled.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-308563</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where multiple
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>pan_task</a
>
processes attempted to clear the packet queue of the same session.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-308509</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Panorama appliances on Google Cloud Platform only</tt
>) Fixed an issue where administrators could not establish an SSH
connection to Panorama using
<span class="ph systemoutput">ed25519</span> keys. With this fix,
<span class="ph systemoutput">ed25519</span> keys are now supported
for SSH access.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-308507</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Panorama managed firewalls only</tt>) Fixed an
issue where the firewall intermittently failed to maintain active log
forwarding streams to Strata Logging Service (SLS) even when duplicate
logging and enhanced application logging were enabled.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-308461</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the CLI command
<span class="ph systemoutput"
>request system software download to-version
&amp;lt;version&amp;gt;</span
>
failed to download multiple software images due with a
<span class="ph systemoutput"
>Download terminated due to timeout</span
>
error message.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-308444</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where pushing multiple policy rules failed when the
policy rules contained a large number of dynamic address object groups
or user groups.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-308418</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, when Advanced DNS Security was enabled and
experienced unusually high loads, DNS resolution failures occurred
with the error
<span class="ph uicontrol">resources-unavailable</span>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-308377</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>PA-7000 Series firewalls with an LFC in HA configurations only</tt
>) Fixed an issue where the firewall reached 100% disk utilization due
to the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>logrcvr</a
>
process repeatedly restarting and dumping core files due to a blocked
hints processing thread, which caused a failover.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-308305</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, when you selected a signature policy rule in the
Anti-Spyware profile and clicked
<span class="ph uicontrol">Find Matching Signatures</span>, the
automatically created filter was incorrect and prevented matching
signatures from being displayed.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-308261</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall failed to send SNMPv3 traps when the
SNMP destination was configured with an FQDN that resolved to multiple
IP address through DNS load balancing.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-308188</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, after a successful commit and push from
Panorama, the management interface SSH profile configuration was
missing or empty on Log Collectors.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-307976</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Firewalls in active/active HA configurations only</tt
>) Fixed an issue where tunnels failed to come up with the error
message
<span class="ph systemoutput"
>failed to find a socket for transmission</span
>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-307937</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on the web interface where the global filter set in
<span class="ph uicontrol">ACC &gt; Threat Activity</span> did not
apply when you navigated to the
<span class="ph uicontrol">Network Activity</span> tab.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-307933</div></td>
<td class="entry relcol">
<div class="p">
(Panorama appliances in Log Collector mode only) Fixed an issue where
the log collectors became unstable for an extended period of time when
receiving large amounts of traffic.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-307717</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on Panorama where administrators were unable to
override SNMP setup configurations within device groups due to the
configured override not being retained.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-307618</div></td>
<td class="entry relcol">
<div class="p">
Added a debug CLI command to address where remote networks for Prisma
Access tenants randomly dropped monitoring packets from peer devices,
which caused tunnels to be marked as down. This occurred when a CPU
core suddenly experienced high utilization.
</div>
<div class="p">
To utilize this fix, run
<span class="ph systemoutput"
>debug dataplane set ssl-decrypt use-new-peek-window yes</span
>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-307597</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where BGP peering sessions between a hub firewall and a
satellite firewall over GlobalProtect LSVPN failed to connect.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-307590</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where some FQDNs could not be resolved by the firewall.
This occurred even when your configured Domain Name System (DNS)
servers successfully returned valid IP addresses for the FQDNs. With
this fix, the firewall correctly processes DNS responses and resolves
FQDNs as expected.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-307491</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall entered maintenance mode after a
reboot when ZTP was enabled.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-307481</div></td>
<td class="entry relcol">
<div class="p">
Fixed a commit failure issue that occurred after migrating from Legacy
to Advanced routing on firewalls where an OSPF authentication profile
was configured to use a 16-character MD5 key with key-ID 10.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-307470</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where an External Dynamic List (EDL) fetch with an
invalid certificate was skipped on newly provisioned GlobalProtect
gateway instances.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-307190</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where LED indicators on combo ports remained off even
when the network link was active.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-306356</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>logrcvr</a
>
process on a firewall stopped responding due to a document node being
unexpectedly freed.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-306217</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on Panorama where scheduled reports with specific
queries did not include any data.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-305619</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where HTTP management access appeared to fail and
incorrectly displayed the error message
<span class="ph uicontrol">Error 503: Service Unavailable</span> even
though it functioned correctly as allowed. This occurred when an
interface was configured with an address object.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-305369</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall dropped packets due to an invalid
interface when attempting to ping the next-hop gateway from a VLAN
interface due to the firewall incorrectly resolving the ARP for the
gateway on an unintended interface.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-305327</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where SSL syslog forwarding did not work with CRL or
OCSP check enabled with a management IPv6 address with a
<span class="ph uicontrol">::</span> character.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-305240</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where User-ID redistribution clients experienced delays
in establishing initial communication with the redistribution server,
which caused connection timeouts.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-305105</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where commits involving routing related network
configuration changes experienced slower than usual completion times
or remaining at 20% completion.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-304761</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on Panorama where the SD-WAN monitoring tab displayed
incomplete names under <span class="ph uicontrol">Sites</span> and
<span class="ph uicontrol">VPN Cluster</span> and displayed
<span class="ph uicontrol">No Data</span> when viewing status details.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-304746</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Panorama appliances and Panorama virtual appliances only</tt
>) Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>configd</a
>
process restarted when committing and pushing configuration for a new
WildFire cluster.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-304718</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where OSPF and BGP outages occurred due to an
<span class="ph systemoutput">all_task</span> process restart during
clientless VPN content rewrite processing.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-304686</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>AIRS firewalls on Google Cloud Platform (GCP) environments only</tt
>) Fixed an issue where the firewall displayed a Kubernetes cluster ID
of 0 in the traffic logs in SCM when traffic was denied for Kubernetes
workloads, even though the traffic zone was correctly identified with
the corresponding non-zero cluster ID.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-304360</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall did not redistribute its application
routes to BGP peers. This occurred in multi-mesh deployments with the
multi-cloud networking feature enabled.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-303662</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where PA-455 firewalls running PAN-OS 11.2.4-h7
intermittently failed to generate system logs and trigger an HA
failover when a link-monitored interface was unplugged, despite the
interface's status being reflected as down on the GUI.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-303173</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Firewalls in Advanced Routing mode only</tt>) Fixed
an issue where OSPF sessions using MD5 authentication experienced
intermittent flapping due to out-of-order packets.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-302790</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, with Sender Side Loop Detection enabled, BGP
WITHDRAWAL updates were not sent to peers after a route was removed,
which caused stale routes to persist in the BGP table of neighboring
firewalls.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-302512</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">Log Collectors in HA configurations only</tt>)
Fixed an issue where log collectors displayed a disconnected inter-log
collector status.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-302175</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, after upgrading an LSVPN portal/gateway to an
affected release, the portal was unable to issue and transfer
certificates to the satellite firewalls, which led to repeated
certificate requests and prevented the satellite firewalls from
authenticating to the gateway.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-301756</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where ACC logs displayed a discrepancy in SSL traffic
information between Panorama and the firewall. With this fix, the SSL
traffic information in ACC logs now aligns correctly.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-301513</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on Panorama managed multi-vsys firewalls where, when
the shared-to-shared feature was enabled, shared objects reverted to
an older configuration after a selective push to a vsys.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-301430</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the web server did not specify the content type
in the header for font files, which could allow a browser to
misinterpret the content and potentially lead to cross-site scripting
(XSS) vulnerabilities.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-300615</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>pan_comm</a
>
process stopped after multiple content versions were installed and the
memory limits were reached.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-300445</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall downloaded an Antivirus package but
did not automatically install it.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-300423</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where Data Processing Cards (DPCs) installed in slots 5
and 6 remained stuck in a starting state with the error
<span class="ph uicontrol"
>Signal detected for port xeS5-DP0 but Link Down</span
>
alerts, which resulted in device instability.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-300055</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall experienced high disk utilization in
the /opt/pancfg/mgmt/content-preview directory due to older content
data not being automatically removed when an error occurred during the
process.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-299910</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where unintended ARP packets were sent out from the
dataplane interface when the service route setting for DNS was
configured to use that interface.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-299623</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Panorama appliances in Management Only mode only</tt
>) Fixed an issue where the firewall incorrectly allowed access to the
web interface on a blocked port. Additionally, after configuring a
custom certificate, Panorama continued to present the self-signed
certificate on the blocked port.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-298960</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall continuously rebooted when the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>useridd</a
>
process repeatedly restarted.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-297880</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where WildFire Analysis reports failed to load,
displaying a
<span class="ph uicontrol">500 Internal Server Error</span> when the
system attempted to retrieve reports for certain files. With this fix,
WildFire Analysis reports load as expected.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-297782</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on Panorama where reassociating a vsys from one device
group to another in a multi-vsys environment resulted in another vsys
from the same firewall being removed from the original device group.
This resulted in the device being moved into the
<span class="ph uicontrol">no device groups attached</span> group, a
superuser was required to manually reattach the device.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-297749</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the redistribution agent status was blank on the
web interface on both the firewall and Panorama, even though the CLI
showed the agent as connected.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-297245</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>VM-Series firewalls in AWS environments configured with IMDSv2
only</tt
>) Fixed an issue where Elastic Network Interface (ENI) IDs were not
displayed by a diagnostic command, which occurred when Instance
Metadata Service Version 2 (IMDSv2) was the only metadata service
enabled for the instance. With this fix, the command now correctly
displays ENI IDs.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-296543</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a memory leak related to the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>configd</a
>
process occurred when committing configurations related to WildFire
Cloud Services or WildFire appliance settings.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-296246</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where policy cache corruption led to unexpected policy
rule behavior or operational instability. This occurred when an
internal system process restarted while a commit was in progress or
when a commit operation failed.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-295806</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where memory leaks on the
<span class="ph systemoutput">configd</span> process occurred due to a
hash insert operation failing during connection management and SSL
connections.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-295309</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where OSPF session using MD5 authentication experienced
intermittent flapping due to out-of-order packet processing.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-295082</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on the Panorama web interface where you were unable to
delete or change a logical router for tunnel, SD-WAN, VLAN, or
loopback interfaces under a template.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-295047</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>staticd</a
>
process stopped responding.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-294998</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the LogDB incorrectly reported that the database
quota for <span class="ph systemoutput">extpcap</span> logs was
reached.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-294434</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where memory leaks occurred. These leaks were caused by
two distinct scenarios: the failure to deallocate memory for a nodeset
when a new nodeset was assigned to the same variable, and the failure
to free a UUID hash table during error conditions.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-294001</div></td>
<td class="entry relcol">
Fixed an issue where Panorama®-managed firewalls logged
<span class="ph systemoutput">Failed in get_pwchange_required</span>
error messages in the <span class="ph systemoutput">authd</span> logs
when locally defined administrators authenticated.
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-293586</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Panorama virtual appliances and M-600 appliances only</tt
>) Extended IDMgr support to 3.5 million entries.
</div>
<div class="p">
To utilize this feature, use the following commands. If you are in an
HA deployment, execute these steps on both devices:
</div>
<div class="p">
To enable the feature:
<span class="ph systemoutput"
>debug user-id idmgr set-max-vsys-user-to-3600000 yes</span
>
</div>
<div class="p">
To disable the feature:
<span class="ph systemoutput"
>debug user-id idmgr set-max-vsys-user-to-3600000 no</span
>.
</div>
<div class="p">Note:</div>
<ul class="ul">
<li class="li">
You must restart the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>useridd</a
>
process after running these commands for the changes to take effect.
</li>
<li class="li">
The system must meet the 64GB RAM minimum requirement for this fix.
</li>
</ul>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-292363</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the built-in actions under Log Settings for
GlobalProtect did not work when configured via the CLI, which
prevented the use of tags on GlobalProtect logs for automated Security
actions.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-292191</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall dropped packets related to call
recording and voice calls, which resulted in communication failures,
retransmissions, and disconnected calls. This occurred when the
firewall was positioned between a Private Branch Exchange and an AES
server and users registered phones across different data centers.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-291785</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>all_task</a
>
process stopped responding.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-290712</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt">PA-7500 Firewalls in cluster mode only</tt>) Fixed
an issue where the firewall incorrectly advertised BGP routes back to
the external BGP peer, which resulted in routing inefficiency.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-290663</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Panorama managed firewalls in HA configurations only</tt
>) Fixed an issue where the firewall did not enforce serial number
validation during HA deployment or replacement, which resulted in
pairs being established even when the serial numbers configured on
Panorama did not not match the serial number of the devices.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-290117</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Firewalls in active/passive HA configurations only</tt
>) Fixed an issue with high dataplane CPU utilization on both active
and passive firewalls.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-289822</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the Policy Optimization feature did not display
values correctly when the language was not set to English.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-289460</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the timestamp value in SNMPv3 trap headers was
incorrect.
</div>
<div class="p">
To use this fix, run the CLI command
<span class="ph systemoutput"
>debug log-receiver enginetime-from-snmptime yes</span
>.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-289413</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where dataplane interfaces went down and configurations
were lost after a reboot.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-286889</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a website would intermittently fail to load in
Mozilla Firefox after authentication when AURL inline cloud was
active, which was caused by an interaction with the inline cloud
analysis process. With this fix, websites now load consistently.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-286492</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on Panorama where logs were not forwarded to syslog
servers due to missing CLI options to configure the syslog queue size
and threads.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-286386</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where GlobalProtect users were unable to connect
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-285862</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where repeated unexpected terminations of a system
component would cause the Data Plane to restart. With this fix, the
Data Plane maintained stability.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-285327</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where a memory leak occurred when processing device and
vsys tags.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-285213</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where proxy requests for certificate status (OCSP/CRL)
from
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>sslmgr</a
>
contained incorrect values that caused unknown certificates to be
blocked.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-283774</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall placed UDP sessions into a
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>Discard</a
>
state when a DNS Sinkhole/Block action occurred, which prevented
subsequent DNS requests from reusing the same session and caused
DNS-related outages.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-283429</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where Panorama presented default certificates during
vulnerability scans even when
<span class="ph uicontrol">Allow Custom Certificate Only</span> was
enabled.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-282336</div></td>
<td class="entry relcol">
<div class="p">
(<tt class="ph tt"
>Firewalls in Multi-Chassis Link Aggregation Group (MCLAG)
configurations only</tt
>) Fixed an issue where port counters for aggregated Ethernet member
interfaces displayed incorrect received packet counts. With this fix,
the counters now increment steadily and accurately.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-282170</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on the web interface where the
<span class="ph uicontrol">Managed Devices</span> page took longer
than expected to load. With this fix, the system now incorporates a
global find usage-based search implementation, which improves page
load performance.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-279552</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where configuring a custom vulnerability object
signature condition failed to commit when the
<span class="ph uicontrol">negate</span> option was disabled on the
condition, and changes made to a custom vulnerability object were
successfully committed to Panorama but not pushed to the firewall.
This occurred when a vulnerability object contained two signatures.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-278688</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where DNS Security threat logs were not displayed on
the firewall when packet capture was enabled and the domain name
length was 62 characters.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-278561</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where TLSv1.3 session resumption continued to function
even when
<span class="ph uicontrol"
>Bypass Server Certificate Verification</span
>
was enabled in the profile.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-273487</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>distributord</a
>
process restarted on firewalls in multi-vsys environments with User-ID
configured and Panorama as a redistribution client. This occurred when
a large volume of IP address-to-user mappings were learned.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-267067</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where VXLAN traffic failed and packet loss occurred in
networks sensors after upgrading to an affected release.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-264762</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the firewall showed the status of SFP+ interfaces
as not up, or up but not configured, when a PAN-SFP-PLUS-SR cable was
connected.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-264508</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where Cloud Identity Engine did not fetch user-mapping
details for XML API users. This occurred when the firewall learned the
same IP-user mapping multiple times within a short period. With this
fix, the Cloud Identity Engine now accurately fetches these
user-mapping details.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-260303</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where internal memory profiling did not utilize
specific allocation and in-use intervals. With this fix, internal
memory profiling now operates with these defined parameters.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-257879</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where, after a system event, selecting a configuration
file from maintenance mode loaded the incorrect configuration.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-250445</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where DLP logs accumulated in the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>logrcvr</a
>
cache when using DLP in mirror mode.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-250339</div></td>
<td class="entry relcol">
<div class="p">
Added an improvement to automatically clean up idle HTTP connection
pools to address an issue where idle connection pools accumulated when
a circuit breaker limit was reached, which caused client requests to
fail with a 503
<span class="ph systemoutput">no_healthy_upstream</span> error.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-246699</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue on Panorama where
<span class="ph uicontrol">Rule Usage</span> and
<span class="ph uicontrol">Apps Seen</span> under Security policy
rules stopped incrementing.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-241887</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where log usernames were truncated, which caused users
to be identified improperly on predefined SaaS reports.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-240066</div></td>
<td class="entry relcol">
<div class="p">
Fixed a duplicate MAC address issue where an ethernet interface sent
out Gratuitous ARP (GARP) messages for an IP address that was not
configured on it.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-239917</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where the
<a
class="term"
href="#"
title=""
data-scope=""
data-format="dita"
data-type=""
target="_self"
>configd</a
>
process experienced an OOM condition during extended operations with
XML API calls.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-234302</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where commit operations took longer than expected to
complete due to EDL timeouts occurring on passive nodes when a service
route was enabled.
</div>
</td>
</tr>
<tr class="row rowsep">
<td class="entry"><div class="p">PAN-233967</div></td>
<td class="entry relcol">
<div class="p">
Fixed an issue where decryption logs for DNS over HTTPS (DoH) traffic
were not consistently generated when a forward trust decryption
profile was applied, resulting in incomplete visibility of
web-browsing application traffic.
</div>
</td>
</tr>
</tbody>
</table>
Reference in new issue View Git Blame Copy Permalink