Cloud NGFW for AWS
    : Cloud NGFW for AWS Known Issues
    Focus
    Download PDF
    Focus
    1. Home
    2. AWS
    3. Cloud NGFW for AWS
    4. Cloud NGFW for AWS Release Updates
    5. Cloud NGFW for AWS Known Issues
    Download PDF

    Cloud NGFW for AWS

    Cloud NGFW for AWS Known Issues

    Table of Contents

    Cloud NGFW for AWS Known Issues

    Cloud NGFW for AWS known issues.
    The following known issues have been identified in the Cloud NGFW for AWS.
    IDDescription
    FWAAS-12750
    Multiple Cloud NGFW tenants can be linked to a Panorama. Unlinking a single tenant causes all linked tenants to be removed. To resolve this issue, re-link the tenant using the Integrations tab in the Cloud NGFW console. This effectively re-links all tenants back to Panorama.
    Use show plugins aws cngfw-tenants to display the list of linked tenants.
    DIT-40616
    In some cases, validating a rulestack change and then committing it could cause your Cloud NGFW resource to apply an incorrect configuration. This issue can also cause an auto-scaled firewall to apply an incorrect configuration file at boot up. To resolve this issue, Palo Alto Networks recommends that you do not click Validate when making a change to your rulestack. Instead, commit the change without validation.
    FWAAS-1501
    Cloud NGFW uses the native AWS Route 53 Resolver for resolving FQDNs you configure in your rules. When used, the AWS Route 53 Resolver may resolve an FQDN to an IP address, different than what you may see when you use the Route 53 Resolver in your VPCs.
    FWAAS-2589
    When you onboard an AWS account to your Cloud NGFW tenant, you choose one of these two endpoint creation modes - customer-managed vs. service-managed. Cloud NGFW will not allow you to switch modes after completing the account onboarding process.
    FWAAS-3009Cloud NGFW allows you to use an S3 bucket as a logging destination for the NGFW resources. In AWS regions outside the US, Cloud NGFW expects you to use the S3 buckets created in the same AWS region, where you deploy the NGFW resources.
    FWAAS-5817The Panorama UI does not display any error message when cloud manager or cloud NGFW service push fails. You will only know about push failure when the firewall commit fails.
    FWAAS-5823When creating a new cloud device group, you cannot select which certificates are used for forward trust or forward untrust.
    FWAAS-6380An error message may appear when pushing an uncommitted change to a cloud device group. Commit your changes before pushing.
    FWAAS-6540An existing device group erroneously allows you to apply a different template stack after creating it. You cannot associate a different template stack for the same device group across tenants.
    FWAAS-6542
    Template stack fails to update when applying it to a different device group.
    FWAAS-6961On the Panorama AWS Plugin for Cloud NGFW service, the first time tenant linked to Panorama will not be able to see any VPCs under the Discovered VPC tab.
    Workaround: The first time tenant must click Refresh Vpc button under Discover VPC tab to get a list of VPCs.
    FWAAS-7721In a scaled environment, the AWS plugin user interface crashes when displaying IP address-to-tags payload in the Monitoring Definition dashboard.
    Workaround: Use the Panorama CLI to run command: show plugins aws details-dashboard.
    FWAAS-7766The Discovered VPC page on Cloud NGFW UI does not show the failure reason if the Monitoring Status is Failed for a discovered VPC.
    FWAAS-10971Issuing the reset command with invalid firewall resource IDs does not reset the rule usage counters. This behavior is expected.

    © 2024 Palo Alto Networks, Inc. All rights reserved.