BugZero | Palo Alto Networks BugID PAN-276525 - Resolved multiple issues affecting IPSec tunnels u...

Palo Alto Networks - Defect ID: PAN-276525

Resolved multiple issues affecting IPSec tunnels using NAT Traversal (NAT-T) when a Dynamic NAT policy was configured (including Dynamic NAT or DIPP). During rekey events, tunnels could go down or flap due to incorrect session handling. This issue impacted both cluster and standalone deployments.

Palo Alto Networks - Defect ID: PAN-276525

Resolved multiple issues affecting IPSec tunnels using NAT Traversal (NAT-T) when a Dynamic NAT policy was configured (including Dynamic NAT or DIPP). During rekey events, tunnels could go down or flap due to incorrect session handling. This issue impacted both cluster and standalone deployments.

Last updated on March 12th, 2026

BugZero Risk Score
6.3 Medium

Overall: 6.3

Severity: 6.4

Community: 3.7

Lifecycle: 10.0

What is the BugZero Risk Score?

Palo Alto Networks Integration

Learn more about where this data comes from

Palo Alto Networks Integration

Learn more

Bug Scrub Advisor

Streamline upgrades with automated vendor bug scrubs

Bug Scrub Advisor

Learn more

BugZero Enterprise

Wish you caught this bug sooner? Get proactive today.

BugZero Enterprise

Learn more

Bug Details

Views: 2

Description

The earliest recollection of this bug is traced back to PAN-OS 11.1.10-h7 - March 12, 2026. This bug is fixed in PAN-OS versions 11.1.13, 11.2.10-h2, 11.2.11, 11.1.10-h7. Resolved multiple issues affecting IPSec tunnels using NAT Traversal (NAT-T) when a Dynamic NAT policy was configured (including Dynamic NAT or DIPP). During rekey events, tunnels could go down or flap due to incorrect session handling. This issue impacted both cluster and standalone deployments. For more information: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/pan-os-11-1-10-known-and-addressed-issues/pan-os-11-1-10-h7-addressed-issues https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/pan-os-11-1-13-known-and-addressed-issues/pan-os-11-1-13-addressed-issues https://docs.paloaltonetworks.com/pan-os/11-2/pan-os-release-notes/pan-os-11-2-10-known-and-addressed-issues/pan-os-11-2-10-h2-addressed-issues https://docs.paloaltonetworks.com/pan-os/11-2/pan-os-release-notes/pan-os-11-2-11-known-and-addressed-issues/pan-os-11-2-11-addressed-issues

Change history

2026-03-12 Added: 11.1.13, 11.2.10-h2, 11.2.11

2026-01-30 Added: 11.2.10-h2, 11.1.13

2026-01-30 Added: 11.1.13

2025-12-03 Added: 11.1.13

2025-12-03 Removed: 11.1.10-h7

2025-12-03 Added: 11.1.13

2025-12-02 Added: 11.2.10-h2, 11.1.13

2025-12-02 Added: 11.1.13

2025-10-17 Added: 11.1.10-h7

Top Palo Alto Networks Defects

6.3Defect ID: PAN-311285
( Firewalls in HA conditions only ) Fixed an issue where a memory leak occurred related to the ospfd process, which caused RAM usage to continuously increase on active devices in an HA cluster until the device stopped responding, even after an HA failover.
6.3Defect ID: PAN-302654
( Firewalls in active/passive HA configurations only ) Fixed an issue where, when the HA configuration had multiple logical routers, static or connected routes redistributed into OSPF aged out in the LSDB, which caused the routes to be removed on peer OSPF neighbors.
6.3Defect ID: PAN-301731
Fixed an issue where, when the firewall was unable to establish an SCM connection due to the discovery service returning a 404 error when the device was not yet known to the service, the firewall did not retry the attempt as expected.
6.3Defect ID: PAN-274742
( VM-Series firewalls only ) Fixed an issue where the task-queue dump CLI command returned incorrect information in multi-nic mode.
6.3Defect ID: PAN-275047
( VM-Series firewalls only ) After an upgrade, the firewall is unable to send logs to the Strata Logging Service (SLS) when using a specific proxy server, and the SSL connection status displays as failed when attempting to forward logs through the web proxy.

Ready to prevent the next vendor outage?

Get a demo

Palo Alto Networks - Defect ID: PAN-276525

Resolved multiple issues affecting IPSec tunnels using NAT Traversal (NAT-T) when a Dynamic NAT policy was configured (including Dynamic NAT or DIPP). During rekey events, tunnels could go down or flap due to incorrect session handling. This issue impacted both cluster and standalone deployments.

Palo Alto Networks - Defect ID: PAN-276525

Resolved multiple issues affecting IPSec tunnels using NAT Traversal (NAT-T) when a Dynamic NAT policy was configured (including Dynamic NAT or DIPP). During rekey events, tunnels could go down or flap due to incorrect session handling. This issue impacted both cluster and standalone deployments.

Last updated on March 12th, 2026

BugZero Risk Score6.3 Medium

Bug Details

Links

Top Palo Alto Networks Defects

Ready to prevent the next vendor outage?

BugZero Risk Score
6.3 Medium