Issue ID | Description
--- | ---
PAN-330995 | Within GCP NSI environments, egress traffic logs fail to accurately reflect the designated NAT IP addresses.
PAN-330964 | In PA-VM deployed on GCP instances, it is observed that the gVNIC interfaces appear inactive after enabling jumbo frames.
PAN-330906 | On Panorama, the configuration Push Scope might not include the shared Devices object entries, even though these objects are visible in the staged configuration changes for the specified administrator and device group.
PAN-330902 | After restarting MongoDB (mdb) on Panorama using the request mongo set mongo-update-sort-limit CLI command, push to devices (both full push and selective push) fails. Workaround: Restart configd on Panorama.

PAN-330836

(`VM-Series software firewalls with 16 GB of memory and 16 vCPUs only`) Starting in PAN-OS 12.1.5, memory usage increases to approximately 6 GB for firewalls running a maximum configuration, compared to approximately 5 GB in PAN-OS 12.1.2. This increase eliminates the available memory buffer, leaving no capacity to absorb additional memory demand during peak load. The firewall may become unstable or unresponsive under high-load conditions.
Firewalls operating with 12 dp cores, or processing more than 512K sessions, are specifically at risk for memory issues. To ensure continued stability for firewalls matching this criteria, Palo Alto Networks recommends an increase of overall memory allocation by 2 GB.

PAN-329146 | Within GCP NSI environments, it is observed that the Prisma AIRS license activates geneve parsing as a default setting, permitting intraVPC traffic flow regardless of NSI status. Hence, you will not be able to disable this feature through CLI.

PAN-313669

(PA-5500 Series firewalls in cluster configurations only) When a firewall node is removed from a PA-5500 Series cluster, after the cluster commit and reboot, the node starts in standalone mode with a default virtual wire (vwire) configuration loaded. This default configuration is missing zone assignments for ports eth1/1 and eth1/2, which causes commit operations to fail. Even if zones are manually assigned to these ports, subsequent commit attempts will fail with a "no UUId for rule1" error.
Workaround: To resolve this, either:

- Manually assign zone configurations to ports eth1/1 (e.g., untrust) and eth1/2 (e.g., trust), then open and close security policy rule1 without making changes, and Commit.
- Delete the default rule and the default virtual wire Ethernet interfaces, then commit.

PAN-312143

(Firewalls in active/passive high availability (HA) configurations only) When attempting to synchronize the running configuration with an HA peer, particularly during script runs involving different topology builds (e.g., during a smoke runlist), the synchronization process fails. This results in an error indicating that the running configuration could not be synchronized with the HA peer.

PAN-311601 | If the node is seen stuck with fault "session clearing fault". Node reboot is the workaround to get the node back in online state after all other fault conditions are removed.
PAN-310328 | If the node is seen stuck with fault "session clearing fault". Node reboot is the workaround to get the node back in online state after all other fault conditions are removed.
PAN-300667 | Panorama cannot display Threat log entries (Monitor > Logs > Threat) when the managed log collector is running a lower PAN-OS release than Panorama. Workaround: Upgrade the log collectors to the same version as Panorama.
PAN-300230 | (NGFW Cluster) In an NGFW cluster, your pings to the HSCI-B link might fail, even when the link indicates it is up. In the event that the HSCI-A link is brought down or unplugged, the cluster node will transition to failed state, avoiding split brain as both HSCI links are down in this case. Workaround: Reboot the cluster node to resolve the HSCI-B ping issue.
PAN-299562 | When a client sends a Client Hello with Transport Layer Security (TLS) 1.3 or TLS 1.2, using only the p-192 elliptic curve and some non-perfect forward secrecy (PFS) ciphers, the firewall discards the Client Hello. The firewall should allow the connection to proceed using TLS 1.2, maintaining backward compatibility with previous releases.
PAN-298083 | Draft for review: After you change the system mode on an M-700 appliance from Panorama mode to PAN-DB private cloud mode, the snmpd process fails to work.

PAN-295946

When a Panorama appliance (running PAN-OS 12.1.2 or higher) manages firewalls running PAN-OS versions lower than 12.1.2, and an NTP server configuration template includes SHA256 or SHA512 as the authentication mechanism, pushing this template to the firewalls running PAN-OS versions lower than 12.1.2 will cause the commit operation to fail. Workaround: Create two separate templates: one for firewalls running PAN-OS 12.1.2 or higher (which can include SHA256/SHA512 authentication) and another for firewalls running PAN-OS versions lower than 12.1.2 (which should use other authentication algorithms such as SHA1, MD5, or Autokey). Then, push the appropriate template to the corresponding devices from Panorama.

PAN-293718 | Draft for review: When high speed logging is enabled on a PA-5560 device, the expected warning message is not displayed on the web interface. This prevents administrators from being notified that logs can only be viewed from Panorama.

PAN-292601

PAN-OS 12.1.2 and later 12.1 releases support a Load Balanced DNS configuration for an address object. If there are two address objects with same FQDN, but one object has Load Balanced DNS enabled and other object has Load Balanced DNS disabled, then the policy match for the removed IP addresses doesn't work as expected. Workaround: Enable (or disable) Load Balanced DNS consistently for an FQDN that is used with multiple address objects.

PAN-289524 | In PAN-OS 12.1.2 and later 12.1 releases, PAN-OS can obtain resolved IP addresses from a Load balanced DNS server and use them in a policy match. However, this functionality does not work as intended when the DNS cache reuse flag is enabled. When the DNS cache reuse flag is enabled, the DNS resolution works as if the Load balanced DNS flag (for an Address object) is disabled.

PAN-283028

The following error is thrown when an existing template overrides the SD-WAN configuration followed by the commit and push from Panorama to the firewall.
BGP is invalid. AS number does not fit in 2 byte AS format
This issue occurs because different AS formats are present on the Panorama and the firewall (the firewall configuration is generated by the SD-WAN plugin). That is, both the hub and branch firewall must have the same AS format in hub-and-spoke topology. In full mesh topology, all the firewalls must have the same AS format.