After you disable the shared optimization feature in Panorama, ensure that you perform a full configuration push to all managed multi-vsys devices to re-establish a baseline. Failure to include every device group associated with the multi-vsys device during this push may result in incomplete or inconsistent configurations across virtual systems.

A firewall may become unresponsive after an upgrade due to the fsck command scanning drive partitions in parallel with the root partition, causing the process to take an extended amount of time.

(VM-Series firewalls in Microsoft Azure environments only) After upgrading to an affected release, the firewall restarts continuously because the brdagent process restarts multiple times and exhausts its restart limit, resulting in a segfault error. This issue occurs when a high burst of traffic is sent to the Azure PA-VM (Palo Alto Networks Virtual Machine), and impacts production environments due to the regular reboots.

Workaround: Migrate the VM instance to Dv5 instance type. On these instance types, SYN packets are not routed to the synthetic path, avoiding this condition. Suggested direct resizing paths are:

• D3_v2/DS3_v2 to D8ds_v5
• D4_v2/DS4_v2 to D8ds_v5
• D5_v2/DS5_v2 to D16ds_v5

Palo Alto Networks next-generation firewalls may experience service disruptions due to all_task process crashes when deployed in environments having non-uniform MTU and are terminating IPSec tunnels.

During a commit, the firewall experiences an out-of-memory (OOM) condition due to a memory leak and displays an error message. This issue causes the device to crash and reboot unexpectedly.

A memory leak in the configd process might lead to an active firewall to reboot due to an Out-of-Memory (OOM) condition. This issue is observed when specific status commands, such as request log-collector forwarding status are executed at high frequencies.

(Firewalls in HA configurations only) Routed process may stop responding after changing MTU or any link parameters when OSPF and PIM are enabled on the same interface.

When performing a partial Commit and Push on Panorama, there is a risk that unintended configuration changes might be pushed to a firewall.

This issue is more likely to occur in the following scenarios:

• When you run Commit and Push operations as a single action.
• When you trigger multiple parallel commit-all jobs at the same time.
• Device groups and templates have different configuration synchronization versions.

Workaround: Perform one of the following steps:

The firewall web interface becomes inaccessible and commits fail.

A cumulative memory leak in the devsrvr process gets progressively worse whenever the CLI command show running application statistics is issued. This memory leak will gradually consume system memory and produce an out-of-memory (OOM) condition, leading to an eventual firewall reboot.

Workaround: Avoid using the CLI command: show running application statistics.

The Advanced WildFire Inline ML models OOXML and Mach-O erroneously display as being available from the CLI; however, they are only available on PAN-OS 11.1.3 and later releases.

When upgrading a ZTP firewall from PAN-OS 10.2 to PAN-OS 11.1 or later versions, if you use the To SW Version column to specify the target PAN-OS version, the upgrade process downloads and installs the intermediary base version containing an expired root certificate. This causes the ZTP firewall to lose connection with Panorama

Workaround: Follow the standard upgrade process from Panorama, which you use for non-ZTP firewalls, to upgrade to the target PAN-OS version that contains the valid root certificate.

GlobalProtect portal is not accessible via a web browser and the app displays the error ERR_EMPTY_RESPONSE.

On the Panorama management server, a user with an Admin Role is unable to modify or add filters to profiles under PanoramaNetworkRoutingRouting ProfilesFilters, despite having the necessary read and write privileges.

After upgrading a Panorama HA pair to PAN-OS 11.1, the ElasticSearch connectivity might fail to establish. The issue occurs because the client certificate on one of the Panorama devices does not have the necessary Extended Key Usage (EKU) set for server authentication, which is required for secure TLS communication.

Workaround:Contact Customer Support to renew the root client certificate.

On the Panorama management server, the Hostkey displayed as undefined undefined if you override an SSH Service Profile (DeviceCertificate ManagementSSH Service Profile) Hostkey configured in a Template from the Template Stack.

On the Panorama management server, different threat names are used when querying the same threat in the Threat Monitor (MonitorApp ScopeThreat Monitor) and ACC. This results in the ACC displaying no data to display when you are redirected to the ACC after clicking a threat name in the Threat Monitor and filtering the same threat name in the Global Filters.

Modifying the Administrator Type for an existing administrator (DeviceAdministrators or PanoramaAdministrators) from Superuser to a Role-Based custom admin, or vice versa, does not modify the access privileges of the administrator.

Certificate-based authentication for administrator accounts may be unable to log into the Panorama or firewall web interface with the following error:

The following NextGen firewalls and Panorama management server models are unable to automatically renew the device certificate (DeviceSetupManagement or PanoramaSetupManagement).

Workaround: Log in to the firewall CLI or Panorama CLI and fetch the device certificate.

admin>request certificate fetch

On the Panorama management server, the Auth Key field was erroneously displayed when you configure the Panorama Settings (DeviceSetupManagement) as part of a template or template stack configuration.

For PA-3400 Series firewalls, the default log rate is set too low and the max configurable log rate is incorrectly capped resulting in the firewall not generating more than 6,826 logs per second.

ElasticSearch may not start properly when a newly installed Panorama virtual appliance powers on for the first time, resulting in the Panorama virtual appliance being unable to query logs forwarded from the managed firewall to a Log Collector.

Workaround: Log in to the Panorama CLI and start the PAN-OS software.

admin>request restart software

On the Panorama management server, you are unable to Context Switch from one managed firewall to another.

Workaround: After you Context Switch to a managed firewall, you must first Context Switch back to Panorama before you can continue to Context Switch to a different managed firewall.

On the Panorama management server, Export Panorama and devices config bundle (PanoramaSetupOperations) fails to export. When the export fails, you are redirected to a new window and the following error is displayed:

Next-Gen Firewalls are unable to connect to a syslog server when the certificates required to connect to the syslog server are part of a Certificate Profile (DeviceCertificate ManagementCertificate Profile) if the Use OCSP setting is enabled to check the revocation status of certificates.

Workaround: Enable Use CRL to check the revocation status of certificates in the Certificate Profile.