Currently VIMS is available to enable and commit even with LV/HV PSU, which will be limited in 12.2.4

After you download new cellular firmware, the firmware does not always appear in the output of the CLI show command, although it is listed as expected in the web interface.

If Azure hotplug events occur, the firewall may experience a crash and data interfaces may transition to an unknown state, leading to traffic disruption.

When firewalls are configured in a cluster operating in default mode, IP-Tag, User-Tag, and IP-Port mappings registered on the leader node do not synchronize to the follower node. On the follower node, commands such as show object registered-ip all and show object registered-user all display no registered entries for these data types, even though they are present on the leader. This prevents Dynamic Address Group (DAG) and Dynamic User Group (DUG) based security policies, which rely on these mappings, from functioning correctly on the follower node. As a result, traffic routed through the follower node does not match these policies, leading to an inconsistent security posture across the cluster. Workaround: Configure the firewall cluster to operate in ICD mode. This enables the correct synchronization of IP-Tag, User-Tag, and IP-Port mappings between the leader and follower nodes.

On NGFW and Panorama® management server running PAN-OS 12.2.2 or earlier, the Source column for Advanced IP Defense predefined external dynamic lists (EDLs) displays the human-readable Name instead of the actual source identifier. For example, the Source column shows Palo Alto Networks - Adv. IP Defense: Exposed vulnerable services rather than panw-aipd-vuln-svcs-ip-list.

On BH (PA-54R-POE) firewalls, SCP export and import of cellular firmware files fail from the CLI. Running request cellular firmware scp-export or request cellular firmware scp-import returns a server error.

When scheduling cellular firmware downloads on Panorama (Device Deployment > Cellular Firmware > Schedule), the Files and Devices fields are not populated in the UI for PA-54R-POE-5G (BH/Eagle) devices. As a result, scheduled "Download Only" and "Download and Install" operations for cellular firmware cannot be configured through Panorama.

(PA-5510 firewalls only) When a Quality of Service (QoS) profile is configured with an Egress Max bandwidth limit on an interface, the firewall does not enforce the configured limit. Traffic throughput can exceed the specified Egress Max value. For example, if a QoS profile is set to an Egress Max of 5000 Mbps, the actual traffic throughput might be higher, such as 5.57 Gbps. Despite exceeding the configured limit, no traffic drops occur, indicating that the shaping is not active. You can observe this by using the show qos interface <interface_name> throughput <qid> command, which displays total throughput exceeding the configured maximum.

When you click the help icon (?) in the user interface to access documentation for the Advance Mode CUID feature, the system redirects you to a blank page. As a result, the required configuration documentation for this feature is not displayed.

On firewalls with 5G cellular interfaces, the default auto MTU value of 1428 bytes causes IP fragmentation errors and out-of-order packets, resulting in degraded throughput performance on cellular connections.

Workaround: Manually set the cellular interface MTU to 1500 bytes instead of using the auto MTU default.

In any 15-second interval, if connectivity (CI or management) on a GW-Node (not P-Node) changes more than once, with each change occurring on a different node and affecting a different link, the cluster loses its leader, all routing protocols fail, and traffic is blackholed if route changes occur in the network.

Workaround: Reboot nodes that are in a FAILED state or suspend and unsuspend any online GW-Node (not P-Node).

In PAN-OS 12.1.2 and later and PAN-OS 12.2.2 and later releases, PAN-OS can obtain resolved IP addresses from a load-balanced DNS server and use them in a policy match. However, this functionality does not work as intended when the DNS cache reuse flag is enabled. When the DNS cache reuse flag is enabled, the DNS resolution works as if the load-balanced DNS flag (for an address object) is disabled.