| Cloud lookup not returning verdicts | The firewall is querying Advanced IP Defense asynchronously but is not receiving verdicts to populate the local cache. The firewall continues to fail open on cache misses, allowing potentially malicious initial sessions to pass. | Verify network connectivity to Advanced IP Defense endpoints on TCP 443. Check whether a proxy server is required and properly configured. Investigate network routing and firewall policies that may block outbound connectivity. |
| DNS cache at maximum capacity | The firewall's local DNS cache reached its maximum capacity for storing DNS response records. The firewall fails open on direct-to-IP detection and doesn't take action on direct-to-IP traffic until capacity is available. | Monitor DNS cache utilization. Review whether all zones require direct-to-IP detection or if you can limit it to high-risk zones. |
| IP not in cloud database | Advanced IP Defense has no attributes for the queried IP. Not all publicly routable IPs have assigned attributes. | No action required. This is expected behavior for IPs that have not been observed in threat intelligence feeds or classified by Advanced IP Defense. |
| Private IP address | The destination IP is a private (RFC 1918) address. Advanced IP Defense only evaluates publicly routable IPv4 addresses. Private IPs are automatically allowed without any cloud lookup or attribute check. | No action required. This is expected behavior. Advanced IP Defense is designed to protect against threats on public IP address space only. |
| No Advanced IP Defense profile attached to zone | Traffic passes through a security zone that doesn't have an Advanced IP Defense profile attached. No attribute lookup or direct-to-IP detection occurs for traffic in that zone. | Verify that an Advanced IP Defense profile is attached to all security zones where you want IP-based threat protection. |
| EDL not referenced in security rules (PAN-OS 11.1.x and later) | On PAN-OS 11.1.x and later, Advanced IP Defense uses predefined EDLs. If no security policy rule references these EDLs, traffic to malicious IPs isn't blocked. | Verify that your security policy rules reference the predefined Advanced IP Defense EDLs in the source or destination address fields. |
| Direct-to-IP false positive after DNS TTL expiration | A connection to a previously-resolved IP is flagged as direct-to-IP because the DNS record's TTL expired. The client is connecting to a cached IP without re-resolving DNS. | If the flagged IP is a known service your organization uses, add it to the direct-to-IP allow list as an IP-based exception. |
| Content package outdated | The content package on the firewall is outdated, which means the category and attribute definitions may not reflect the latest Advanced IP Defense capabilities. | Install the latest content package on the firewall or schedule automatic content updates. |
| Shared IP hosting causes missed detections | A malicious C2 server is hosted on a shared IP that also hosts legitimate domains. Because DNS resolution to the shared IP prevents direct-to-IP flagging, the C2 connection is not detected as direct-to-IP. | Rely on IP attribute-based rules (such as Malware C2 or High Risk categories) to detect and block connections to known malicious IPs regardless of DNS history. |
| Direct-to-IP false positives from asymmetric routing | In asymmetric routing environments, a client resolves a domain through one firewall but initiates the connection through a second firewall. The second firewall has no local DNS history for the IP and flags it as direct-to-IP. The shared per-tenant cloud DNS Seen Table mitigates this over time, but synchronization delays can cause intermittent false detections. | Use alert mode (not block) for direct-to-IP rules in environments with asymmetric routing. If false positives persist, consider disabling direct-to-IP detection on the affected zones or consolidating DNS and data paths through the same firewall. |
| Cold cache after HA failover | After an Active-Passive failover, the newly active firewall starts with an empty Advanced IP Defense cache because cache data does not synchronize between HA peers. All IP lookups result in cache misses until the cache repopulates. | No immediate action required. The firewall defaults to fail-open during cache-miss periods, allowing traffic to pass while asynchronous cloud lookups execute. The cache repopulates as traffic flows and cloud verdicts are returned. Monitor logs for any enforcement gaps during the cache warm-up period. |
