>
    Strata Copilot
    Addressed Issues in Prisma SD-WAN ION Release 6.3
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma SD-WAN
    3. Prisma SD-WAN ION Device Release 6.3
    4. Addressed Issues in Prisma SD-WAN ION Release 6.3
    Download PDF
    Prisma SD-WAN

    Addressed Issues in Prisma SD-WAN ION Release 6.3

    Table of Contents

    Addressed Issues in Prisma SD-WAN ION Release 6.3

    Learn about the issues addressed in Prisma SD-WAN ION release 6.3.x.
    Learn more about the issues addressed in Prisma SD-WAN ION device release 6.3.

    Addressed Issues in Prisma SD-WAN ION Device Release 6.3.6

    The following section lists the issues addressed in Prisma SD-WAN ION Device Release 6.3.6 and various Hotfixes.

    Release 6.3.6

    Issue IDDescription
    CGSDW-27822Resolved an issue where global prefix advertisements were set to "None" when local BGP configurations were present. This occurred due to incorrect data handling during global configuration updates. The system now correctly preserves advertisement settings during BGP global updates.
    CGSDW-34703Resolved an issue where mem leak as one of the bwm_server worker threads stuck on some recv_msg call.
    CGSDW-33141Resolved an issue where Transit Traffic to dst port 67/68/69 are not forwarded by ION (Hub) to its core.
    CGSDW-32037Resolved an issue where Scan traffic should not cause the device to crash/reboot.
    CGSDW-33282Resolved an issue where Archive and save logs directory after any process crash or device reboot.
    CGSDW-31944Resolved an issue where snmpd: High Memory Usage.
    CGSDW-31702Resolved an issue where Hello, and the dead timer for LLDP on our ION is 30 seconds.
    CGSDW-33237Resolved an issue where Control Plane Traffic prioritisation in ION.
    CGSDW-31862Resolved an issue where Split brain for 3 minutes after fp-rte crash - 6.3.5-b4.
    CGSDW-32903Resolved an issue where Flow getting ESTABLISHED with SYN and SYN-ACK only.
    CGSDW-32621Resolved an issue where After upgrade from 6.1.x to 6.3.5-b4 Standby IONs are losing connectivity to controller.
    CGSDW-32172Resolved an issue where Legitimate DIA traffic flows cause DPDK cores to be overutilized.
    CGSDW-32075Resolved an issue where Stale route entry present when we have route learnt over Mutliple service links.
    CGSDW-32551Resolved an issue where App-engine Crash: slice bounds out of range [:-1].
    CGSDW-31832Resolved an issue where frr closes bgp socket configured over servicelink when it flaps.
    CGSDW-31959Resolved an issue where 6.3.5-b4 app-engine crash dhcp.go line 99 nil pointer dereference.
    CGSDW-31858Resolved an issue where App-probe is disabled on element level, but we are still sending probes in 6.3.5-b4.
    CGSDW-31505Resolved an issue where Stats are getting exported with label as private-direct for LAN to LAN traffic.
    CGSDW-31320Resolved an issue where Avoid adding 0.0.0.0 to DNS based app-maps.
    CGSDW-31237Resolved an issue where Propagate the fix to 6.3.6 from 5.6 release.
    CGSDW-30883Resolved an issue where rtr_mgr_api exception observed due to timing issue in handling wanpaths update & delete.
    CGSDW-29556Resolved an issue where FIPS: Cgnxinfra, remote login and service link connections are failing.
    CGSDW-30069Resolved an issue where the ADEM probe was not working for the private app over the secure fabric.
    CGSDW-30052Resolved an issue where ION not populating ARP responses on the WAN interface.

    Hotfix Release 6.3.6-b14

    Issue IDDescription
    CGSDW-39647Resolved an issue where the primary WAN interface forwarding table became non-operational, preventing traffic routing.
    CGSDW-39561Resolved an issue where the ION 3000 device experienced a process failure during activation after an upgrade with active traffic, requiring a process restart to restore VPN connectivity.
    CGSDW-39505Resolved an issue with flow statistics synchronization.
    CGSDW-39417Resolved an issue where the ION device became unresponsive and required a manual reboot to restore service.
    CGSDW-39415Resolved an issue where DPDK consumption reached 100% on ION 3000 branch device when HTTP traffic was sent across 600 VPNs.
    CGSDW-39346Resolved an issue where the high availability keepalive process terminated, preventing the branch ION from becoming active after a failover event.
    CGSDW-39106Resolved an issue where internal flow for the controller connectivity were not correctly identified.
    CGSDW-38087Resolved an issue where device certificate renewal failed due to TPM key creation failure.
    CGSDW-37984/CGSDW-37622Resolved an issue where ION devices in China required the China-specific Certificate Authority chain to support device identity features and management by the China Controller.
    CGSDW-37978Resolved an issue where the ION 3200 device experienced a process failure during LAN-to-WAN traffic initialization with custom application traffic, requiring a reboot to restore service.
    CGSDW-37977Resolved an issue where the ION device restarted unexpectedly when deleting and creating VPNs.
    CGSDW-37856Resolved an issue where the ION device restarted unexpectedly due to memory management errors during extended operation.
    CGSDW-37837Resolved an issue where the high availability state flapped because the HA transfer process accepted connections from sources other than the configured HA peer.
    CGSDW-37836Resolved an issue where VLAN-tagged traffic sent from the LAN interface included the DEI (Drop Eligible Indicator) bit, causing older Cisco switches to drop packets and resulting in controller connectivity loss.
    CGSDW-37798Resolved an issue with Marvell CPSS hardware compatibility by adding kernel IOMMU passthrough parameters.
    CGSDW-37642Resolved an issue where Layer 7 system applications such as WhatsApp were incorrectly identified as SSL when TLS 1.3 traffic lacked Server Name Indication (SNI), causing the cached application mapping to be replaced.
    CGSDW-37475Resolved an issue where the ION device experienced an application engine failure after upgrading to release 6.3.6-b6.
    CGSDW-37411Resolved an issue where LAN prefixes advertised from branch sites to the data center were incorrectly learned back via WAN peering, causing a routing loop.
    CGSDW-37331Resolved an issue where application reachability probes were generated for the global VRF interface instead of the custom VRF network when reachability failed.
    CGSDW-37295Resolved an issue where the device registration service terminated unexpectedly during the device claim process.
    CGSDW-37047Resolved an issue where the device registration service became unresponsive after a connection interruption, preventing reconnection to the controller.
    CGSDW-36879Resolved an issue where both active and standby devices in a branch high availability configuration sent IPv6 Router Advertisement messages when IPv6 prefix distribution was enabled.
    CGSDW-36797Resolved an issue where the application identification probe process terminated unexpectedly, affecting application visibility.
    CGSDW-36775Resolved an issue where, in a data center cluster, when a primary branch site's BGP peering recovered after a failure, the secondary branch site did not withdraw its route advertisements, causing both data center ION devices to continue advertising the same prefixes.
    CGSDW-36220Resolved an issue where ION devices in China required the China-specific Certificate Authority chain to support device identity features and management by the China Controller.
    CGSDW-35936Resolved an issue where, in a data center cluster, when a primary branch site's BGP peering recovered after a failure, the secondary branch site did not withdraw its route advertisements, causing both data center ION devices to continue advertising the same prefixes.
    CGSDW-34404Resolved an issue where the device registration service terminated unexpectedly during the device claim process.
    CGSDW-33589Resolved an issue where BGP aggregated routes were not added to the forwarding table, preventing traffic from reaching connected subnets under the aggregated prefix.
    CGSDW-33431Resolved an issue where overlapping IP address subnets for Internet traffic were not routed correctly, causing connectivity failures.
    CGSDW-32258Resolved an issue where both active and standby devices in a spoke high availability configuration sent IPv6 Router Advertisement messages when IPv6 prefix distribution was enabled.
    CGSDW-31637Resolved an issue where the device registration service became unresponsive after a connection interruption, preventing reconnection to the controller.
    CGSDW-28219Resolved an issue where the ION device experienced a process failure during activation after an upgrade with active traffic, requiring a process restart to restore VPN connectivity.

    Hotfix Release 6.3.6-b10

    Issue IDDescription
    CGSDW-38328Resolved an issue in validating the certificates.
    CGSDW-38592Resolved an issue in IPv6 packet handling.

    Hotfix Release 6.3.6-b9

    Issue IDDescription
    CGSDW-37487Resolved an issue where the system incorrectly removed a Supplicant (STA) from the switch FDB table during a RADIUS idle timeout. This occurred because hostapd failed to validate the MAC address due to an incorrect binary path in swinspect and a failure in the grep logic, which searched for a standard address instead of a compact MAC string.
    CGSDW-37382Resolved an issue where Serial Inline High Availability (HA) ION devices failed to respond to ARP requests after a switchover. A software synchronization error prevented the system from clearing the IP address on the bypass interface during an Active-to-Backup transition.
    CGSDW-36754Resolved an issue where a race condition between the data path thread and the metrics thread caused a FC metrics failure and an ifspd process crash.
    CGSDW-36339Resolved an issue where the wanpaths_vni database failed to migrate correctly during an upgrade from 6.2.x or 6.1.x to 6.3.x.
    CGSDW-36237Resolved an issue where LAN-to-WAN traffic dropped even when VPN paths remained active. This occurred because missing service labels caused the Layer 3 (L3) reachability state to incorrectly report as down.
    CGSDW-36123Resolved an issue where IPv6 BGP peer reset requests from the controller UI were not correctly handled, preventing BGP reset from occurring. This issue only affected IPv6 peers and not IPv4 peers.
    CGSDW-36098Resolved an issue where performing a hard or soft reset of a BGP peer from the Controller UI would fail. This occurred because stale operation entries remained in the database if a reset was attempted while a site was disabled, preventing the routing manager from processing subsequent requests.
    CGSDW-35936Resolved an issue where, in a data center cluster with two data center IONs (DC1 and DC2), both IONs advertised the same prefixes learned from a branch site, even after the original route from the primary branch was restored. This occurred when a secondary branch site advertised the same prefixes to a data center ION while the primary branch site was down, and the routes from the secondary branch were not withdrawn after the primary branch recovered.
    CGSDW-32071Resolved an issue where the firewall unexpectedly rebooted due to a supervisord process exception. The exception occurred during parsing.
    CGSDW-31637Resolved an issue where the MRLservice could become unresponsive background thread encountered an exception and terminated without being automatically restarted.

    Hotfix Release 6.3.6-b6

    Issue IDDescription
    CGSDW-35903Resolved an issue where 6.3.6-b3 SNMP Counters ifInOctets and ifOutOctets are stalled causing BW utilization update issue for customers.
    CGSDW-35884Resolved an issue where the PPPoE manager in the element manager (emif) process leaked resources, including memory and goroutines.
    CGSDW-35843Resolved a memory leak in the bwm_server process caused by a worker thread becoming stuck on a recv_msg system call.
    CGSDW-35784Resolved an issue where Port to 6.3.6 - SDWAN Element - Vulnerability: SHA1 deprecated setting for SSH.
    CGSDW-35761Resolved an issue where 6.3.6 Porting : ION3200> admin status is incorrect from snmpwalk retrievals.
    CGSDW-35701Resolved an issue where LAN egress out route table entry was missing in Active ION post switch-over.
    CGSDW-35622Resolved an issue where data traffic was leaving out of the controller port of the DC ION because the controller prefix was not getting updated with the core peer IP.
    CGSDW-35415Resolved a memory leak in the multicast process observed during continuous multicast traffic and join requests.
    CGSDW-34795Resolved an issue where the default VRF remained down following an HA failover or upgrade.
    CGSDW-34214Validated support for vION on Alibaba Cloud.

    Addressed Issues in Prisma SD-WAN ION Device Release 6.3.5

    The following section lists the issues addressed in Prisma SD-WAN ION Device Release 6.3.5 and various Hotfixes.

    Release 6.3.5

    Issue IDDescription
    CGSDW-33555Resolved an issue on PA-9000 Series Hub devices where the processes crashed repeatedly.
    CGSDW-31958Resolved an issue on ION devices where virtual interfaces encountered buffer exhaustion.
    CGSDW-31611Resolved a process crash in the init_lan_to_wan_direction function on ION 3200 devices.
    CGSDW-28329Resolved an issue where Backup-DC also advertising branch prefixes when the vyos peer flaps.
    CGSDW-28214Resolved an issue where interface connected via bypass pair on ION2 goes down when ION1 is powered down.
    CGSDW-28049Resolved an issue where dump-support all command does not capture syslog if there is a softlink.
    CGSDW-28036Resolved an issue where The VPN OIDs are changing for each polling request.
    CGSDW-27728Resolved an issue where fp-rte crash on 6.3.4-b2 leading to HA failover HW 5200.
    CGSDW-26686Resolved an issue where Not seeing mss clamping happening for PPPoE interface with dpdk on 6.1.6.
    CGSDW-27527Resolved an issue where the Fast Path CPU reached 100% utilization when processing custom AppMix traffic.
    CGSDW-29116Resolved an issue where fp-rte restart is seen when fec applied exceeds the max limit.
    CGSDW-29042Resolved an issue where LAN sub-interface on passive ION sending ARPs causing LAN disruption.
    CGSDW-28712Resolved an issue where ifspd - unexpected end of data and other issues noted.
    CGSDW-28187Resolved an issue where ION does not initiate SYN request over TCP 179 to establish BGP.
    CGSDW-27498Resolved an issue where Default route is missing on sub interfaces after element is rebooted.
    CGSDW-27462Resolved an issue where Flow dropped after app reclassification.
    CGSDW-27542Resolved an issue where BGP Went Down when ION1 was made active during MW.
    CGSDW-27359Resolved an issue where global stats are missing when high app thresholds are configured.
    CGSDW-27387Resolved an issue where Traffic from Standard VPN is not routed to Branch through transit DC.

    Hotfix Release 6.3.5-b13

    Issue IDDescription
    CGSDW-33696Resolved an issue where environments with large LAN subnets experienced high CPU utilization, latency, and packet loss.
    CGSDW-33608Resolved a memory leak in the data path thread that led to Flow Controller (FC) restarts.
    CGSDW-33422Resolved an issue where the log-agent, device_cert, and arp-monitor services remained active even when Device-ID was not enabled.

    Hotfix Release 6.3.5-b12

    Issue IDDescription
    CGSDW-33480Resolved an issue where the BGP TCP listen socket was incorrectly deleted on Spoke devices when a BGP view was removed.
    CGSDW-33008Resolved an issue where the fast path routing engine (fp-rte) experienced memory leaks and fragmentation under heavy workloads.
    CGSDW-32984Resolved an issue where the resourcemgmt service caused high CPU and memory consumption.

    Hotfix Release 6.3.5-b11

    Issue IDDescription
    CGSDW-33040Resolved an issue where the controller interface failed to program the default gateway following a device upgrade or reboot.
    CGSDW-32910Resolved an issue where traffic failed to pass through bypass pairs following an HA failover.
    CGSDW-32542Resolved an issue on HUB devices where the system incorrectly generated lan/state entries for every site prefix added.
    CGSDW-32648Resolved an issue where the emif process could enter a deadlock, triggering watchdog restarts and interface flaps.
    CGSDW-32270Resolved an issue where the firewall adds 0.0.0.0 to DNS-based application maps.

    Hotfix Release 6.3.5-b9

    Issue IDDescription
    CGSDW-31276Resolved an issue where the fast path routing engine (fp-rte) crashed at fp_nf_bulk_hook.

    Hotfix Release 6.3.5-b8

    Issue IDDescription
    CGSDW-30481Resolved an issue on WASP and SCAM platforms where packets were being dropped and recorded as interface errors.
    CGSDW-27990Resolved an issue where the Flow Controller (FC) experienced memory leaks due to JSON object management.
    CGSDW-31065Resolved an issue where the CPU temperature was not displayed on the controller statistics page.
    CGSDW-26319Resolved an issue where the fast path routing engine (fp-rte) crashed during high-traffic scenarios.
    CGSDW-27805Resolved an issue where the SNMP agent was not responding when a higher number of VPN tunnels were monitored.

    Hotfix Release 6.3.5-b6

    Issue IDDescription
    CGSDW-30052Resolved an issue where ION not populating ARP responses on the WAN interface.

    Hotfix Release 6.3.5-b5

    Issue IDDescription
    CGSDW-28326Resolved an issue where IPv6 ping commands were unable to ping a VPN FIB host using the LAN interface IP.

    Addressed Issues in Prisma SD-WAN ION Device Release 6.3.4

    The following section lists the issues addressed in Prisma SD-WAN ION Device Release 6.3.4 and various Hotfixes.

    Release 6.3.4

    Issue IDDescription
    CGSDW-25417Resolved an issue where branch LAN prefixes were not withdrawn from the Data Center (DC) core BGP peer after WAN path updates.
    CGSDW-22259Resolved an issue where SNMPv3 not polling all interfaces on 9200s.
    CGSDW-21320Resolved an issue where DHCP Non responsive on ION1200 SVI until config change or reboot.
    CGSDW-21176Resolved an issue where Failed VLAN configuration not recovered.
    CGSDW-21115Resolved an issue where FEC Action Not Being Displayed in FB For Inbound (DC to Branch).
    CGSDW-20824Resolved an issue where Flush ipsec sa for service-link if service-link probe fails and times out.
    CGSDW-26226Resolved an issue where DC HUB does not advertise route with /25 to core in certain scenarios.
    CGSDW-26247Resolved an issue where fc-monitor crash seen in 9K with 6.3.4-a45.
    CGSDW-24262Resolved an issue where Select only bestpath as reachable route.
    CGSDW-25738Resolved an issue where Fixing issue in IPFIX socket connect.
    CGSDW-22633Resolved an issue where FC security policy build time & memory optimisation improvement.
    CGSDW-25586Resolved an issue where GRE with FIPS mode is not working.
    CGSDW-25152Resolved an issue where L3/L4 UDP apps classified as unknown post switchover.
    CGSDW-24485Resolved an issue where FC process restart on 6.1.6.
    CGSDW-24482Resolved an issue where HMAC Integrity failing for controller ca chain.
    CGSDW-24269Resolved an issue where APP CUSTOM RULE CONFLICT (GOOGLE-MEET) is raised for a system app.
    CGSDW-24112Resolved an issue where HMAC Integrity Check is skipped for python packages.
    CGSDW-24400Resolved an issue where UserID Agent crashes with IPv6 mapping.
    CGSDW-24273Resolved an issue where Interface shut is not removing v6 default route from FIB entry.
    CGSDW-24099Resolved an issue where some interfaces lack ip rule programming with 2K VRFs.
    CGSDW-22072Resolved an issue where Handling rtr_mgr_api memory increase.
    CGSDW-20234Resolved an issue where Virtual interface not passing traffic.
    CGSDW-23395Resolved an issue where Backup ION lost controller connections intermittently after upgrade.
    CGSDW-19833Resolved an issue where T-Mobile 5G IPv6 connectivity issues.
    CGSDW-23397Resolved an issue where snmp_network_discovery service is restarting every 1 hour.
    CGSDW-22389Resolved an issue where Removing firewall doesn't stop app probe for a public direct path.
    CGSDW-23221Resolved an issue where ionhwd process consuming high memory.
    CGSDW-23098Resolved an issue where Overlapping IPs is broken in VRF.
    CGSDW-22700Resolved an issue where Overlay dhcp-relay do not work with custom VRF.

    Addressed Issues in Prisma SD-WAN ION Device Release 6.3.3

    The following section lists the issues addressed in Prisma SD-WAN ION Device Release 6.3.3 and various Hotfixes.

    Release 6.3.3

    Issue IDDescription
    CGSDW-22192Resolved an issue where core.fp-rte failure occurred during abrupt traffic stops.
    CGSDW-22281Resolved an issue where app-probe crash seen in branch device.
    CGSDW-21181Resolved an issue where vION needs support for AWS IMDSv2 for metadata.

    Addressed Issues in Prisma SD-WAN ION Device Release 6.3.2

    The following section lists the issues addressed in Prisma SD-WAN ION Device Release 6.3.2 and various Hotfixes.

    Release 6.3.2

    Issue IDDescription
    CGSDW-20631Resolved an issue where log-agent failed to process all DHCP messages.
    CGSDW-21868Resolved an issue where outbound SSH6 connections were not functioning correctly.
    CGSDW-21580Resolved an issue where backup IONs were unable to establish connection to the controller.
    CGSDW-21836Resolved an issue where SVI VRF creation failed if the name exceeded 9 characters.
    CGSDW-21116Resolved an issue where outbound SSH was not supported on controller interfaces.
    CGSDW-21607Resolved an issue where sequencing of VRF and interface config caused setup errors.
    CGSDW-21698Resolved an issue where static ARP entries were not added correctly during config updates.
    CGSDW-21300Resolved an issue where DHCP server failed with same subnet controller/LAN ports.
    CGSDW-19628Resolved an issue where return traffic from Hub to Branch was invisible in Flow Browser.
    CGSDW-21381Resolved an issue where unused App-ID element memory was not released.
    CGSDW-21025Resolved an issue where service link path was incorrectly cached post-detachment.
    CGSDW-20241Resolved an issue where ICMP traffic experienced packet loss in non-default VRFs.
    CGSDW-20382Addressed security vulnerabilities in OpenSSH (CVE-2023-51385).
    CGSDW-19542Ensured ION devices are protected against SSH Terrapin attacks.
    CGSDW-21088Resolved an issue where static ARP entries were incorrectly applied to standby devices.
    CGSDW-17904Resolved an issue where interface status command failed to display link modes.
    CGSDW-20864Resolved an issue where leaked VPN prefixes were incorrectly removed on the Hub device.
    CGSDW-20807Resolved an issue where VPN forwarding entries for global VRF were invisible post-upgrade.
    CGSDW-20649Resolved a memory leak in the SNMP daemon process.
    CGSDW-20671Resolved false RADIUS server unreachable incidents.

    Addressed Issues in Prisma SD-WAN ION Device Release 6.3.1

    The following section lists the issues addressed in Prisma SD-WAN ION Device Release 6.3.1 and various Hotfixes.

    Release 6.3.1

    Issue IDDescription
    CGSDW-17886Resolved an issue where traffic failed to flow correctly over service links.
    CGSDW-16932Resolved an issue where the Zoom Phone application definition was missing required prefixes.
    CGSDW-16269Resolved fragment reassembly performance issues.
    CGSDW-21512Resolved inconsistent bypass pair latch behavior during power-off.
    CGSDW-21119Resolved bypass ports remaining in bypass mode after device declaim.
    CGSDW-19674Resolved memory corruption in DPDK mempools.
    CGSDW-16172Resolved ZBFW treatment inconsistency for LAN traffic.
    CGSDW-19778Resolved remote access process restarts during active sessions.
    CGSDW-19466Resolved slow device-to-controller connection establishment post-reboot.
    CGSDW-15212Resolved virtual interface traffic failures on specific ION models.
    CGSDW-18816Resolved missing interface gateway IPs due to flapping post-upgrade.
    CGSDW-18954Resolved IPFIX issues with controller interface source.
    CGSDW-15661Resolved memory leak in VPN process during ZeroMQ operations.
    CGSDW-15258Resolved intermittent offline status due to FC restarts.
    CGSDW-15201Resolved zero value display for ingress bandwidth utilization.
    CGSDW-14766Resolved stale BGP config persistence after peer deletion.

    © 2026 Palo Alto Networks, Inc. All rights reserved.