BugZero | Palo Alto Networks BugID PAN-297321 - ( Firewalls in active/active HA configurations onl...

OPERATIONAL DEFECT DATABASE

...

BugZero | Palo Alto Networks BugID PAN-297321 - ( Firewalls in active/active HA configurations onl...

Palo Alto Networks - Defect ID: PAN-297321

( Firewalls in active/active HA configurations only ) Fixed an issue where return packets from a phone gateway looped between the HA pair instead of being encapsulated into the GlobalProtect tunnel. This occurred when the inner session and the outer IPSec tunnel terminated on different nodes, which led to excessive retries and packet drops.

Palo Alto Networks - Defect ID: PAN-297321

( Firewalls in active/active HA configurations only ) Fixed an issue where return packets from a phone gateway looped between the HA pair instead of being encapsulated into the GlobalProtect tunnel. This occurred when the inner session and the outer IPSec tunnel terminated on different nodes, which led to excessive retries and packet drops.

Last updated on October 30th, 2025

BugZero Risk Score
6.3 Medium

Overall: 6.3

Severity: 6.4

Community: 3.7

Lifecycle: 10.0

What is the BugZero Risk Score?

Palo Alto Networks Integration

Learn more about where this data comes from

Palo Alto Networks Integration

Learn more

Bug Scrub Advisor

Streamline upgrades with automated vendor bug scrubs

Bug Scrub Advisor

Learn more

BugZero Enterprise

Wish you caught this bug sooner? Get proactive today.

BugZero Enterprise

Learn more

Bug Details

Description

The earliest recollection of this bug is traced back to PAN-OS 11.2.10 - October 30, 2025. This bug is fixed in PAN-OS versions 11.2.10. ( Firewalls in active/active HA configurations only ) Fixed an issue where return packets from a phone gateway looped between the HA pair instead of being encapsulated into the GlobalProtect tunnel. This occurred when the inner session and the outer IPSec tunnel terminated on different nodes, which led to excessive retries and packet drops. For more information: https://docs.paloaltonetworks.com/pan-os/11-2/pan-os-release-notes/pan-os-11-2-10-known-and-addressed-issues/pan-os-11-2-10-addressed-issues

Change history

2025-10-30 Added: 11.2.10

Top Palo Alto Networks Defects

6.3Defect ID: PAN-291883
Fixed an issue where Prisma Access logs were not visible in the Security Logging Service (SLS) and Panorama.
6.3Defect ID: PAN-292019
Fixed an issue on the Panorama web interface where cloud applications were not displayed under Objects > Applications after a new content upgrade and Cloud App Catalog download, and were only visible in application groups, security policy rules, and the CLI.
6.3Defect ID: PAN-297321
( Firewalls in active/active HA configurations only ) Fixed an issue where return packets from a phone gateway looped between the HA pair instead of being encapsulated into the GlobalProtect tunnel. This occurred when the inner session and the outer IPSec tunnel terminated on different nodes, which led to excessive retries and packet drops.
6.3Defect ID: PAN-298252
Fixed an issue where Data Loss Prevention (DLP) inspection of chunked transfer encoding over TLS resulted in incomplete file downloads on Outlook Web App (OWA) due to the WIF page size limit, which led to corrupted or incomplete PDF attachments.
6.3Defect ID: PAN-298684
Fixed an issue where an Application Override policy rule was not applied using an IPv4 source IP address with IPv6 enabled and Network > Zones > Pre-NAT Identification enabled.

Ready to prevent the next vendor outage?

Get a demo

OPERATIONAL DEFECT DATABASE

Palo Alto Networks - Defect ID: PAN-297321

Palo Alto Networks - Defect ID: PAN-297321

Last updated on October 30th, 2025

BugZero Risk Score6.3 Medium

Bug Details

Links

Top Palo Alto Networks Defects

Ready to prevent the next vendor outage?

BugZero Risk Score
6.3 Medium