Disclaimer

Hotfix versions were inferred because the vendor did not list them explicitly: 11.1.6-h1, 11.1.6-h2, 11.1.6-h3, 11.1.6-h4, 11.1.6-h5, 11.1.6-h6, 11.1.6-h7, 11.1.6-h8, 11.1.6-h9, 11.1.6-h10, 11.1.6-h11, 11.1.6-h12, 11.1.6-h13, 11.1.6-h14, 11.1.6-h15, 11.1.6-h16 Known affected versions were inferred from fixed-version data and were not explicitly confirmed by the vendor: 11.2.10-h13

The earliest recollection of this bug is traced back to PAN-OS 11.1.11 - August 21, 2026. This bug is fixed in PAN-OS versions 11.2.11, 11.1.11, 11.2.10, 11.1.6-h17. ( Firewalls with Hub vsys (virtual system) configurations enabled only ) Fixed an issue where, when using the Hub vsys feature to redistribute Host Information Profiles (HIP) to a non-Hub vsys, HIP policy enforcement failed intermittently on the active secondary firewall. This occurred when traffic destined for specific non-Hub vsys was routed to the active secondary, and the HIP query was not triggered due to an incorrect check for the HIP mask in the Hub vsys. For more information: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/pan-os-11-1-11-known-and-addressed-issues/pan-os-11-1-11-addressed-issues https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/pan-os-11-1-6-known-and-addressed-issues/pan-os-11-1-6-h17-addressed-issues https://docs.paloaltonetworks.com/pan-os/11-2/pan-os-release-notes/pan-os-11-2-10-known-and-addressed-issues/pan-os-11-2-10-addressed-issues https://docs.paloaltonetworks.com/pan-os/11-2/pan-os-release-notes/pan-os-11-2-11-known-and-addressed-issues/pan-os-11-2-11-addressed-issues