PAN-OS 10.2.17 HA A/P - Mgt interface reported as duplicate IP of data interface

[LeeFrancis2]

After installing PAN-OS 10.2.17 to a PA-440 HA A/P pair  ( to address - CVE-2025-4615 PAN-OS: Improper Neutralization of Input in the Management Web Interface . ) 'duplicate IP' system logs reported where the stated MAC address appears to be the fw mgt interface. This is reported as a duplicate of the 'facing' data interface.

Example:

Received conflicting ARP on interface ethernet1/n.nn indicating duplicate IP n.n.n.n, sender mac 8c:36:nn.nn.nn

Anyone else experienced this behaviour ?

[reaper]

did you make sure to set the internal dataplane interface to a unique ip with sufficiently sized subnetmask (e.g. 10.0.0.1/24) and the management interface on a different unique ip with identical subnetmask (e.g. 10.0.0.2 255.255.255.0) ?

[LeeFrancis2]

I can confirm the ip addressing of both mgt and (its dft gw) data plane interface is appropriate ( unique address same subnet/mask )

Also this device has been operational on several previous PAN-OS versions with this configuration,  and only start logging dup IP after upgrade to 10.2.17.

I am in the process of getting a PAN case raised via my distributor, and suspect this is a bug.

Wanted to get feedback/assistance from Live contributors, but posted as perhaps early warning to others.

KR,

Lee

[mghazzi]

it was working perfectly with PanOS 10.2.16-h1, (upgraded HA PA-VM on ESX 7) to PanOS 10.2.17 started to see the above message, rolled back to 10.2.16-h1 ARP error stopped.

[R.Colella]

Hi all, i'm experiencing the same issue on all my Panos 10.2.17 series 220 and 820. 
The message is only for the Port 1 of the firewall
Received conflicting ARP on interface ethernet1/1 indicating duplicate IP 192.168.153.2, sender mac c4:24:56:91:f1:00

The strange thing is that the first part of the mac address is the same of the mac address of the HA ports (in both case with dedicated and not dedicated ports)
The interface is configured as 192.168.153.2/24 and the HA ports are 192.168.254.1/30 so even if they are similar they are not overlapping. Also the HA cables are direct plugged to FW ports with no switch between them.

[LeeFrancis2]

Disappointing slow progress with PAN support ( through Disti ) after 2 remote support sessions and TSF submissions, no yet an acceptance of a bug.. This thread clearly supports the bug claim,  so thank you for replies.

Also - we identified and previous bug- from release notes addressed Issues 10.2.4:
PAN-209346 Fixed an issue where, after upgrading to PAN-OS 10.2.3, HA peers received conflicting ARP messages that indicated a duplicate IP address.

The symptoms suggest PAN development of the now heavily fragmented 10.2 versions has allowed a previously fixed bug to be included in the 10.2.17 release build. Seems to me there are questions to be asked of PAN release build process.