Multiple Cloud NGFW tenants can be linked to a Panorama. Unlinking a single tenant causes all linked tenants to be removed. To resolve this issue, re-link the tenant using the Integrations tab in the Cloud NGFW console. This effectively re-links all tenants back to Panorama.

In some cases, validating a rulestack change and then committing it could cause your Cloud NGFW resource to apply an incorrect configuration. This issue can also cause an auto-scaled firewall to apply an incorrect configuration file at boot up. To resolve this issue, Palo Alto Networks recommends that you do not click Validate when making a change to your rulestack. Instead, commit the change without validation.

Cloud NGFW uses the native AWS Route 53 Resolver for resolving FQDNs you configure in your rules. When used, the AWS Route 53 Resolver may resolve an FQDN to an IP address, different than what you may see when you use the Route 53 Resolver in your VPCs.

When you onboard an AWS account to your Cloud NGFW tenant, you choose one of these two endpoint creation modes - customer-managed vs. service-managed. Cloud NGFW will not allow you to switch modes after completing the account onboarding process.

Template stack fails to update when applying it to a different device group.

Workaround: The first time tenant must click Refresh Vpc button under Discover VPC tab to get a list of VPCs.

Workaround: Use the Panorama CLI to run command: show plugins aws details-dashboard.