Cloud NGFW does not support dynamically adding new CIDRs to an IP address pool that is already in use. If you add a new CIDR block to an existing, associated pool, the Cloud NGFW resource will not recognize or use the new IP addresses.

After overriding the default intrazone security policy from Panorama, the change may not apply correctly on the Cloud NGFW. The firewall continues to use its local intrazone-default deny policy, which takes precedence and results in unexpected denial of same-zone traffic. Additionally, traffic logs for this denied traffic are not visible.

After a new V2 subscription in the three opt-in AWS regions (af-south-1, ap east-1, and me-south-1), creating a firewall may cause a delay for a few hours. This issue can also cause a delay in the delivery of the latest content and threat intelligence updates to the existing firewalls in these regions.

When you onboard an AWS account to your Cloud NGFW tenant, you choose one of these two endpoint creation modes - customer-managed vs. service-managed. Cloud NGFW will not allow you to switch modes after completing the account onboarding process.

On the Panorama AWS Plugin for Cloud NGFW service, the first time tenant linked to Panorama will not be able to see any VPCs under the Discovered VPC tab.