firewallissues/reference/PAN-OS/addressed/10.2.16-h1.html

<table class="table colsep rowsep table-striped">
  <!--cq:include script="../../common/tablestack.jsp" /-->

  <colgroup>
    <col style="width: 46.728971962616825%" />
    <col style="width: 53.27102803738318%" />
  </colgroup>
  <thead class="thead">
    <tr class="row rowsep">
      <th class="entry">Issue ID</th>
      <th class="entry">Description</th>
    </tr>
  </thead>

  <tbody class="tbody">
    <tr class="row">
      <td class="entry">
        <div class="p"><b class="ph b">PAN-290996</b></div>
      </td>
      <td class="entry relcol">
        <div class="p">
          Fixed an issue where SNMP walks returned a value of 0 for the CPS
          (Connections Per Second) per vsys on firewalls after upgrading to
          PAN-OS 11.1.6-h3, even when active connections were present.
        </div>
      </td>
    </tr>

    <tr class="row">
      <td class="entry">
        <div class="p"><b class="ph b">PAN-290803</b></div>
      </td>
      <td class="entry relcol">
        <div class="p">
          (<tt class="ph tt"
            >VM-Series firewalls on Microsoft Azure environments only</tt
          >) Fixed an issue where firewall failed to bootstrap with a custom
          image, and VM-Series plugin information was not displayed in the
          system information.
        </div>
      </td>
    </tr>

    <tr class="row">
      <td class="entry">
        <div class="p"><b class="ph b">PAN-290088</b></div>
      </td>
      <td class="entry relcol">
        <div class="p">
          Fixed an issue where a memory leak occurred related to the
          <a
            class="term"
            href="#"
            title=""
            data-scope=""
            data-format="dita"
            data-type=""
            target="_self"
            >configd</a
          >
          process when pushing configurations from Panorama to a firewall. This
          occurred when the configurations contained shared policy rules.
        </div>
      </td>
    </tr>

    <tr class="row">
      <td class="entry">
        <div class="p"><b class="ph b">PAN-289763</b></div>
      </td>
      <td class="entry relcol">
        <div class="p">
          (<tt class="ph tt">PA-5400f firewalls only</tt>) Fixed an issue where
          SD-WAN SaaS monitoring did not work with URL monitoring.
        </div>
      </td>
    </tr>

    <tr class="row">
      <td class="entry">
        <div class="p"><b class="ph b">PAN-288929</b></div>
      </td>
      <td class="entry relcol">
        <div class="p">
          Fixed an issue where the
          <span class="ph systemoutput">preferred_wnd</span> value provided by
          CTD (Content Threat Detection) was disregarded due to TCP bandwidth
          estimation, which prevented the window from closing.
        </div>
      </td>
    </tr>

    <tr class="row">
      <td class="entry">
        <div class="p"><b class="ph b">PAN-288363</b></div>
      </td>
      <td class="entry relcol">
        <div class="p">
          Fixed an issue where the MIB ID returned an incorrect value via SNMP.
        </div>
      </td>
    </tr>

    <tr class="row">
      <td class="entry">
        <div class="p"><b class="ph b">PAN-287818</b></div>
      </td>
      <td class="entry relcol">
        <div class="p">
          Fixed an issue where sessions timed out sooner than expected due to
          the <span class="ph systemoutput">pan_proxy_accumulation</span>
          <span class="ph systemoutput">_restore_timeout</span> not initiating
          when the accumulation<span class="ph systemoutput">session_init</span>
          failed.
        </div>
      </td>
    </tr>

    <tr class="row">
      <td class="entry">
        <div class="p"><b class="ph b">PAN-287601</b></div>
      </td>
      <td class="entry relcol">
        <div class="p">
          Fixed an issue on Panorama where commits took longer than expected.
        </div>
      </td>
    </tr>

    <tr class="row">
      <td class="entry">
        <div class="p"><b class="ph b">PAN-287056</b></div>
      </td>
      <td class="entry relcol">
        <div class="p">
          Fixed an issue where BGP export policy rules with next-hop matching
          failed to block the advertisement of static routes, and the firewall
          incorrectly matched the egress interface IP address instead of the
          original next-hop IP address of the static route, which caused the
          deny rule to fail.
        </div>
      </td>
    </tr>

    <tr class="row">
      <td class="entry">
        <div class="p"><b class="ph b">PAN-287035</b></div>
      </td>
      <td class="entry relcol">
        <div class="p">
          Fixed an issue where, when an application stopped responding, a large
          file was created in the /opt/panlogs directory, which caused the
          partition to fill up.
        </div>
      </td>
    </tr>

    <tr class="row">
      <td class="entry">
        <div class="p"><b class="ph b">PAN-287023</b></div>
      </td>
      <td class="entry relcol">
        <div class="p">
          Fixed an issue where a large number of logs caused the logrcvr process
          to stop responding.
        </div>
      </td>
    </tr>

    <tr class="row">
      <td class="entry">
        <div class="p"><b class="ph b">PAN-287002</b></div>
      </td>
      <td class="entry relcol">
        <div class="p">
          A fix was made to address
          <a
            class="xref"
            href="https://security.paloaltonetworks.com/CVE-2025-0133"
            title=""
            data-scope="external"
            data-format="html"
            data-type=""
            target="_blank"
            >CVE-2025-0133</a
          >.
        </div>
      </td>
    </tr>

    <tr class="row">
      <td class="entry">
        <div class="p"><b class="ph b">PAN-286306</b></div>
      </td>
      <td class="entry relcol">
        <div class="p">
          Fixed an issue where, when getting transceiver information from ESCC
          for SFP 25G modules, the transceiver code was incorrectly updated with
          <span class="ph systemoutput">Unknown</span> instead of
          <span class="ph systemoutput">25GBase-SR</span>.
        </div>
      </td>
    </tr>

    <tr class="row">
      <td class="entry">
        <div class="p"><b class="ph b">PAN-284744</b></div>
      </td>
      <td class="entry relcol">
        <div class="p">
          A fix was made to address
          <a
            class="xref"
            href="https://security.paloaltonetworks.com/CVE-2025-4229"
            title=""
            data-scope="external"
            data-format="html"
            data-type=""
            target="_blank"
            >CVE-2025-4229</a
          >.
        </div>
      </td>
    </tr>

    <tr class="row">
      <td class="entry">
        <div class="p"><b class="ph b">PAN-278288</b></div>
      </td>
      <td class="entry relcol">
        <div class="p">
          Fixed an issue where IPv6 BGP peering established between virtual
          routers even without dataplane connectivity. This occurred because the
          firewall used the kernel for lookups instead of the dataplane.
        </div>
      </td>
    </tr>

    <tr class="row">
      <td class="entry">
        <div class="p"><b class="ph b">PAN-268787</b></div>
      </td>
      <td class="entry relcol">
        <div class="p">
          Fixed an issue where users were unable to log in to Panorama and the
          following error message was displayed:
          <span class="ph systemoutput">
            Timed out while getting config lock. Please try again</span
          >. This occurred when pushing configurations to a large number of
          devices.
        </div>
      </td>
    </tr>
  </tbody>
</table>