>
    Strata Copilot
    Known Issues in SD-WAN Plugin 3.0
    Focus
    Download PDF
    Focus
    1. Home
    2. SD-WAN
    3. Panorama Plugin for SD-WAN
    4. Panorama Plugin for SD-WAN 3.0
    5. Known Issues in SD-WAN Plugin 3.0
    Download PDF
    SD-WAN

    Known Issues in SD-WAN Plugin 3.0

    Table of Contents

    Known Issues in SD-WAN Plugin 3.0

    Known issues in the SD-WAN Plugin 3.0.
    The following list includes all known issues that impact an SD-WAN 3.0 release. This list includes both outstanding issues and issues that are addressed, as well as known issues that apply more generally or that are not identified by a specific issue ID. Refer to PAN-OS Release Notes for additional known issues affecting SD-WAN Plugin 3.0.

    PAN-220919

    Description of PAN-220919.
    Auto VPN creates a virtual SD-WAN interface named sdwan.901 for direct internet access (DIA) and creates a virtual SD-WAN interface named sdwan.9xx for VPN tunnels. When you enable Auto VPN, the SD-WAN plugin creates the SD-WAN interfaces automatically. Hence, it's not necessary for you to create SD-WAN interfaces manually. The SaaS quality profile works only with one DIA interface that is sdwan.901.
    Auto VPN also creates its own default route that uses the sdwan.901 interface as its egress interface and uses a low metric of 5, so that the sdwan.901 interface is preferred over the default route you created.
    There might be scenarios where you want to create an SD-WAN interface manually (other than what the SD-WAN plugin creates automatically) like the following:
    • Configuring SD-WAN direct internet access (DIA) links only and no VPN connections between the hub and branch locations
    • (Not recommended) Deploying SD-WAN manually between SD-WAN sites without Panorama management server
    In such cases, you must configure the manually created SD-WAN interface outside of the SDWAN.9xx range containing a route with a metric higher than the default value.

    PAN-215899

    Description of PAN-215899
    Configuration synchronization between Panorama HA peers is failing.
    Workaround: Run commit force from CLI on the passive Panorama before triggering an HA configuration sync from active Panorama. Whenever sync fails, this workaround can be used.

    PAN-215897

    Description of PAN-215897.
    In a Panorama high availability (HA) deployment, the SD-WAN interface goes down and all the tunnel interfaces disappear from the NetworkIPSec Tunnels tab when you push the configuration changes from the secondary Panorama.
    Workaround: If you have set up a HA pair in Panorama, don't push the configuration from the secondary Panorama when the primary Panorama is active. Always push the configuration changes from the primary Panorama when it's active.

    PAN-190173

    Pre-shared keys are not synchronized across the Panorama management servers in a high availability (HA) configuration, leading to tunnel flaps during an HA failover when you Push to Devices (CommitPush to Devices or CommitCommit and Push).
    This issue is addressed in SD-WAN plugin 2.2.3 and 3.1.0-h6.

    PAN-123040

    When you try to view network QoS statistics on an SD-WAN branch or hub, the QoS statistics and the hit count for the QoS rules don’t display. A workaround exists for this issue. Please contact Support for information about the workaround.

    PLUG-22582

    Description of PLUG-22582.
    An "Unspecified error during import" occurs when performing a CSV import on SD-WAN Devices.

    PLUG-21340

    Description of PLUG-21340.
    Panorama now includes a preventative fix to ensure tunnel IP addresses remain synchronized. As part of this fix, the following CLI command is deprecated: debug plugins sd_wan drop-config-cache.
    Workaround
    To resolve the synchronization issue, first perform a configuration push to the affected Branch node to generate the new tunnel monitor IP address. Once the push is complete, identify the new tunnel monitor IP address and manually enter it into the BGP Peer IP field for the corresponding peer in the Panorama Cloud Services plugin. Finally, perform a configuration push to the Remote Network (RN) to align the settings and restore connectivity.
    This issue is addressed in SD-WAN plugin 3.0.9-h1, 3.4.2 and 3.3.4.

    PLUG-20905

    Description of PLUG-20905.
    (HA Deployments Only) You can now perform local commits on Panorama for HA pairs where both peers are active, even if they are disconnected, and these devices are part of an SD-WAN VPN cluster. Previously, the SD-WAN plugin blocked local commits for such HA and connectivity combinations.
    This issue is addressed in SD-WAN plugin 3.0.9 and 3.2.4-h1.
    After this fix, you can now perform local commits on active/active HA pairs simultaneously. Also, you can commit on Panorama locally regardless of connectivity status between HA pair members.
    Panorama blocks commits only when both HA peers are connected and an actual configuration error exists. If one device is offline, Panorama proceeds with the commit and shows only a warning instead of blocking it.
    When you perform a commit all is performed while one device while one of the HA pair is disconnected, the changes are not automatically synchronized to the disconnected device HA pair. It is the administrator's responsibility to You must manually push the latest configuration to the disconnected device once it is back online and in the correct state (active/passive). This ensures full synchronisation synchronization and a stable HA pair.

    PLUG-20267

    Description of PLUG-20267.
    Your local commit on Panorama will fail when an invalid HA pair is present in your SD-WAN cluster, as the SD-WAN plugin does not support active/active HA configurations within VPN clusters.
    This issue is addressed in SD-WAN plugin 3.2.4 , 3.0.9 and 3.3.3-h2.

    PLUG-19165

    Description of PLUG-19165.
    All the hub and branch firewalls in the SD-WAN cluster must show the same HA status for the active and passive Panorama. SD-WAN plugin displays the following error when the firewalls of the SD-WAN cluster shows different HA status:
    The active Panorama's MongoDB -is not synchronized with the passive Panorama. Please get them in-sync
    This issue is addressed in SD-WAN plugin 2.2.7-h5, 3.2.3-h1, and 3.3.3.
    After installing the SD-WAN plugin 3.2.3-h1, 2.2.7-h5, or 3.3.3 version, follow these steps:
    1. Perform a minor change on active Panorama followed by a commit or commit force from active Panorama CLI.
    2. Execute debug plugins sd_wan mongo-db sync-db-to-peer from the active Panorama CLI.
      After running this command, if the CLI displays the following message (that the MongoDB synchronization is still in progress), then you must restart the configd on active Panorama using debug software restart process configd and again synchronize the MongoDB using debug plugins sd_wan mongo-db sync-db-to-peer from the active Panorama. 
      MongoDB collection sync is in-progress. Please sync the collections after sometime.
    3. Execute the synchronization job or request high-availability sync-to-remote running-config from the active Panorama CLI.

    PLUG-18873

    Description of PLUG-18873.
    In Panorama, when you configure User-ID in the zone and push the configuration to the hub firewall, the configuration does not get enabled in the firewall.
    This issue is addressed in SD-WAN plugin 3.2.3 , 3.2.4, 3.4.0, 3.0.9 and 3.3.4.

    PLUG-17704

    Description of PLUG-17704.
    The SD-WAN plugin enforces all the HA firewalls in the SD-WAN cluster to be in a complete functional state. Due to this enforcement, even when one firewall goes nonfunctional, the SD-WAN plugin prevents making configuration changes to any of the HA firewalls in the SD-WAN cluster.
    This issue is addressed in SD-WAN plugin 2.2.7 and 3.0.9.

    PLUG-17571

    Description of PLUG-17571.
    In an SD-WAN cluster, when the hub and branch firewalls (connecting to that hub) does not have a matching private link types, the plugin won't be able to generate the zone information. The SD-WAN plugin displays a warning message when no zone is associated with an interface.
    This issue is addressed in SD-WAN plugin 3.2.4, 3.4.0, and 3.0.9.

    PLUG-17418

    Description of PLUG-17418.
    The SD-WAN plugin does not support the 4-byte ASN number.
    This issue is addressed in SD-WAN plugin 3.2.2-h1 and 3.0.9. After the fix, the SD-WAN plugin generates the configuration with the 4-byte ASN number (when the AS format for the template is not configured).

    PLUG-16507

    Description of PLUG-16507.
    (HA deployments only) You may observe SD-WAN tunnel flapping and changes to the SD-WAN interfaces when you perform a commit operation after any of the following:
    • HA failover
    • PAN-OS upgrade or downgrade
    • Reboot the HA pair
    This issue is addressed in SD-WAN plugin 3.3.2, 3.3.1 , 3.2.2, 3.0.8 , and 2.2.7.

    PLUG-16141

    Description of PLUG-16141.
    The SD-WAN log files are overwritten and the critical events does not get captured in the system logs that cause difficulty in debugging the SD-WAN plugin-related issues.
    This issue is addressed in SD-WAN plugin 2.2.7, 3.0.8 , 3.2.2, and 3.3.2. After the fix, the following critical events are added to the system logs.
    • PSK creation or PSK change for a VPN cluster
    • Tunnel name, IP address creation, or IP address change

    PLUG-16048

    Description of PLUG-16048.
    (HA deployments only) Passive Panorama makes changes to the SD-WAN plugin database cache entries.
    This issue is addressed in SD-WAN plugin 2.2.7, 3.0.8 , 3.2.2, and 3.3.2.

    PLUG-15823

    Description of PLUG-15823.
    (Full mesh topology only) The SD-WAN devices neither go out-of-sync nor show up in the commit scope when a new hub device gets added to the full mesh VPN cluster.
    This issue is addressed in SD-WAN plugin 2.2.7, 3.0.7-h2, 3.0.8, 3.2.2, 3.3.1, and 3.3.2.

    PLUG-15761

    Description of PLUG-15761.
    In some cases, after HA failover followed by a commit and commit push from the Panorama will result in the tunnel going down. It's because a new tunnel IP address gets generated for the firewall after a HA failover.
    Workaround: After committing the configuration changes to Panorama, perform a commit and push on the all the SD-WAN devices in the SD-WAN VPN cluster even if the templates are in synchronization with the Panorama management server.
    This issue is addressed in SD-WAN plugin 2.2.7, 3.0.8, 3.2.2, 3.3.1, and 3.3.2.

    PLUG-15526

    Description of PLUG-15526.
    The SD-WAN trend collection does not get recapped when you execute a command to recap the collection.
    This issue is addressed in SD-WAN plugin 3.0.7-h2 and 3.3.1.

    PLUG-15525

    Description of PLUG-15525.
    It's not possible to revert to any of the earlier pre-shared keys except the current pre-shared key.
    This issue is addressed in SD-WAN plugin 2.2.7, 3.0.8 , 3.2.2, and 3.3.2. After the fix, you can revert to any of the earlier pre-shared keys (if it's available).

    PLUG-15415

    Description of PLUG-15415.
    (HA deployments only) The HA synchronization failure occurs on the passive Panorama when you either upgrade or downgrade the HA Panorama. The issue is caused due to HA failover between the active and passive SD-WAN devices.
    This issue is addressed in SD-WAN plugin 2.2.7, 3.0.8, , 3.2.2, 3.3.1, and 3.3.2.

    PLUG-15330

    Description of PLUG-15330.
    The commit all operation fails on all the corresponding branch devices when you attempt to enable multiple virtual router feature on the hub device without enabling BGP on the hub device.
    This issue is addressed in SD-WAN plugin 3.0.7-h2.

    PLUG-15276

    Description of PLUG-15276
    (Full mesh topology only) In the SD-WAN VPN cluster, an SD-WAN branch cannot create a VPN tunnel with another SD-WAN branch firewall if the branch firewall is configured behind the NAT device.
    This issue is addressed in SD-WAN plugin 3.0.7-h2, 3.1.3 , 3.2.1, 3.3.0, and 3.3.1.

    PLUG-14809

    Description of PLUG-14809
    A commit error will be thrown when you attempt to disable multiple virtual routers feature on the SD-WAN hub by executing the following CLI command:
    set plugins sd-wan devices device-serial-number multi-vr-support no

    PLUG-14580

    Description of PLUG-14580.
    (HA deployments only) During HA synchronization, the SD-WAN database cache synchronizes back from passive Panorama to active Panorama.
    This issue is addressed in SD-WAN plugin 3.0.7 and 3.2.1. After this fix, the SD-WAN database cache synchronization from passive Panorama to active Panorama is disabled.

    PLUG-14559

    Description of PLUG-14559.
    A commit failure occurs when you attempt to rename the vsys to a name other than vsys1 for a multi-vsys firewall with private link type (in an SD-WAN Interface Profile).
    This issue is addressed in SD-WAN plugin 3.0.7, 3.1.3 , 3.2.1 , and 3.3.0.

    PLUG-14499

    Description of PLUG-14499
    (Panorama HA deployments only) The firewalls managed by HA active and passive Panorama would go out of synchronization when you make any changes to an active Panorama SD-WAN configuration (such as modifying the VPN cluster name). After this, even when the SD-WAN configuration changes are pushed from active Panorama to the firewalls, the firewalls remains out of synchronization on passive Panorama. This issue does not occur when changing a non-SD-WAN related configuration.
    Workaround: In a Panorama HA deployment, if you make any changes to an existing SD-WAN configuration:
    1. Commit the SD-WAN configuration changes on an active Panorama (where the HA synchronization happens on the passive Panorama automatically)
    2. Trigger manual synchronization from active Panorama to passive Panorama by executing the following CLI command:
      request high-availability sync-to-remote running-config
    3. Push to the firewalls from active Panorama
    This issue is addressed in SD-WAN plugin 3.0.7, 3.1.3 , and 3.2.1. However, it is required to follow the workaround when you wish to modify the active Panorama SD-WAN configuration.

    PLUG-14475

    Description of PLUG-14475
    PAN-OS does not support forwarding traffic in clear text (when the VPN Data Tunnel Support is disabled on the SD-WAN Interface Profile) outside of the SD-WAN VPN tunnel when multiple virtual routers support on the SD-WAN hub feature is enabled.

    PLUG-14413

    Description of PLUG-14413.
    (HA Deployments only) If the HA environment is not configured correctly or when either of HA pair is not present, then no proper commit failure is displayed for troubleshooting.
    This issue is addressed in SD-WAN plugin 2.2.7, 3.0.8, 3.2.2, and 3.3.2. After the fix, the improved failure message helps in identifying the missing HA device in the HA deployment.

    PLUG-14402

    Description of PLUG-14402
    The return merchandise authentication (RMA) process won't be successful if you delete the replacement firewall without removing it from the SD-WAN plugin first.
    This issue is addressed in SD-WAN plugin 2.2.6, 3.0.7, 3.2.1, and 3.3.0. Follow the instructions to replace an SD-WAN device.

    PLUG-13186

    Description of PLUG-13186
    After upgrading to PAN-OS 11.0.2 and SD-WAN plugin 3.1.1, SD-WAN branches configured with dynamic IP addressing using FQDN didn't work.
    This issue is addressed in SD-WAN plugin 3.0.5 and 3.1.2. Note: When you upgrade to SD-WAN plugin 3.0.5 and 3.1.2, to receive this fix you must first Commit on Panorama and then Push to devices. You cannot upgrade directly to SD-WAN plugin 3.1.2 from any plugin version earlier than 3.1.1. If you are running SD-WAN plugin 3.1.0 or an earlier plugin version on your firewall, you must upgrade to SD-WAN plugin 3.1.1 before you upgrade to SD-WAN plugin 3.1.2.

    PLUG-13152

    Description of PLUG-13152
    The SD-WAN plugin creates predefined zones automatically that does not require any user configuration. Hence, we have removed the following predefined zones tabs from the SD-WAN plugin web interface:
    • Zone Internet
    • Zone to Hub
    • Zone to Branch
    • Zone Internal
    This issue is addressed in SD-WAN plugin 2.2.5 and 3.0.5.

    PLUG-13100

    Description of PLUG-13100
    On Prisma Access Onboarding tab, the aggregated interfaces don't get listed in the Interface drop-down.
    This issue is addressed in SD-WAN plugin 3.0.5, 3.1.3, 3.2.1, and 3.3.0.

    PLUG-12711

    Description of PLUG-12711
    A commit all from Panorama to an SD-WAN branch firewall configured with only one MPLS will result in a commit failure.
    This issue is addressed in SD-WAN plugin 2.2.5 and 3.0.5.

    PLUG-12540

    Description of PLUG-12540
    No data displays for "Link Performance-OK" under the SD-WAN monitoring tab.

    PLUG-12519

    Description of PLUG-12519.
    (Full mesh topology only) An attempt to initiate re-key simultaneously by the VPN peers lead to SD-WAN VPN tunnel flapping. This issue occurs because both the SD-WAN hub and the branch devices act as an initiator device during the IKE negotiation.
    This issue is addressed in SD-WAN plugin 3.0.7-h2 and 3.1.3.

    PLUG-12389

    Description of PLUG-12389.
    When you import a Panorama configuration from an existing deployment to another Panorama management server, the following commit error is thrown:
    sd-wan. IP address from vpn address pool subnet/subnets are exhausted. Please add a new subnet or make changes to vpn cluster Failed plugin validation
    Workaround: Before using an existing Panorama configuration on another Panorama management server, be sure to delete the existing VPN pool and add a new pool. Optionally, you can also add one or more VPN address pools.
    This issue is addressed in SD-WAN plugin 3.0.6.

    PLUG-12224

    Description of PLUG-12224.
    For an SD-WAN tunnel between a hub and a branch, the hub/branch tunnel interface should have the same IP address on the HA active and passive firewalls, but the hub/branch has different IP addresses on the HA active and passive firewalls.
    This issue is addressed in SD-WAN plugin 2.2.4, 2.2.7, 3.0.4, 3.0.8, 3.1.0-h6 , 3.2.2, and 3.3.2. Tunnel ID changes will take effect from SD-WAN plugin 2.2.4. If you are running SD-WAN plugin 2.2.2 and upgrade to 2.2.4, you must regenerate the cluster configuration and push to devices to see those changes.

    PLUG-12156

    Description of PLUG-12156
    On the Hub-Spoke VPN cluster type, if you make any changes to an existing cluster member configuration or add a new device to the cluster, the push gets enabled for all the VPN cluster members.
    This issue is addressed in SD-WAN plugin 2.2.6 , 3.0.7-h2, 3.2.1 , and 3.3.0.

    PLUG-12126

    Description of PLUG-12126
    The VPN cluster is recreated when the name of an existing VPN cluster is modified. As a result, the pre-shared key and tunnel IP addresses changes causing failure to establish the VPN tunnel (or tunnel flaps).
    This issue is addressed in SD-WAN plugin 2.2.6, 3.0.7, and 3.1.3. After this fix, you won't be able to modify the existing VPN cluster name.

    PLUG-11789

    Description of PLUG-11789.
    Pre-shared keys are not synchronized across the Panorama management servers in a high availability (HA) configuration, leading to tunnel flaps during an HA failover when you Push to Devices (Commit > Push to Devices or Commit > Commit and Push).
    This issue is addressed in SD-WAN plugin 2.2.3, 3.0.4, and 3.1.0-h6.

    PLUG-11761

    Description of PLUG-11761.
    Prisma Access onboarding is unsuccessful using SD-WAN plugin 2.2.2 and after filling out all the required information, the plugin shows the PHP bit error. Users are unable to onboard Prisma Access on a branch firewall.
    This issue is addressed in SD-WAN plugin 2.2.3, 3.0.4, and 3.1.0-h6.

    PLUG-11453

    Description of PLUG-11453.
    A Zone Protection profile, log setting, and User-ID cannot be configured on "zone-internet" created by the SD-WAN plugin on the firewall from Panorama.
    This issue is addressed in SD-WAN plugin 2.2.3, 3.0.4, and 3.1.0-h6.

    PLUG-11383

    Description of PLUG-11383.
    SD-WAN plugin fails to get Prisma Access connection details for the onboarding process.
    This issue is addressed in SD-WAN plugin 2.2.3 and 3.0.4.

    PLUG-11290

    SD-WAN Monitoring (PanoramaSD-WANMonitoring) displays No Data for App Performance and Link Performance.
    This issue is addressed in SD-WAN plugin 3.0.3.

    PLUG-11277

    Description of PLUG-11277
    In an SD-WAN hub-and-spoke topology, where Prisma Access compute nodes (CNs) are configured as a hub connecting to the PAN-OS firewalls, the session gets established on only one compute node when ECMP is disabled. When more than one compute nodes are connected to the PAN-OS firewalls, routes get added from one of the compute nodes only. Even though the branch firewalls learn the routes through BGP from both the Prisma Access compute nodes, the branch installs only one of the BGP routes based on the BGP route selection criteria. Therefore, when a traffic passes from the other compute node, the session does not get established.
    This issue is addressed in SD-WAN plugin 2.2.6, 3.0.7, 3.1.3, and 3.2.1.

    PLUG-11223

    Description of PLUG-11223.
    In a high availability (HA) deployment, the SD-WAN tunnel will go down due to a key ID mismatch when the following events occur in sequence:
    • An HA failover
    • The SD-WAN plugin cache removes the current HA pair relation from the database when debug plugins sd_wan drop-config-cache all command is executed
    • A commit and push fails on either the hub or a branch active node
    In certain scenarios, replacing one of the HA devices during the RMA process can cause the SD-WAN tunnel to go down due to a key ID mismatch. For more details, refer to Replace an SD-WAN Device.
    Workaround: Resolve the Key ID mismatch by ensuring that the Peer Identification of the hub firewall matches with the Local Identification of the branch firewall and the Local Identification of the hub firewall matches with the Peer Identification of the branch firewall.
    1. Log in to the hub or a branch firewall where the SD-WAN tunnel is down due to Key ID mismatch and select NetworkNetwork ProfilesIKE Gateways.
    2. Select the IKE gateway of the hub firewall and click Override at the bottom of the screen.
    3. Copy the Local Identification value from the hub firewall to the Peer Identification value in the branch firewall.
    4. Copy the Peer Identification value from the hub firewall to the Local Identification value in the branch firewall.
    5. Click OK and Commit your changes.
    This issue is addressed in SD-WAN plugin 2.2.5 , 2.2.7, 3.0.8, 3.1.3 , 3.2.1, 3.2.2 , 3.3.0, and 3.3.2.
    After this fix, the key ID may change after the Panorama commit. Therefore, you must ensure to commit and push to all the devices in the VPN cluster or clusters.

    PLUG-11062

    Description of PLUG-11062.
    When configuring upstream NAT on the SD-WAN plugin, the drop-down does not list AE interface or subinterface, even though the firewall is configured with AE interface or subinterface.
    This issue is addressed in SD-WAN plugin 2.2.3 and 3.0.4.

    PLUG-10796

    On the Panorama management server, a commit (CommitCommit to Panorama) hangs at 99% and causes the commit queue to fill up, preventing any subsequent commits on Panorama.
    This issue is addressed in SD-WAN plugin 2.2.2 and 3.0.2.

    PLUG-10457

    After successful upgrade to SD-WAN 2.1.0 and later releases, the Panorama management server takes 10 minutes to commit (CommitCommit to Panorama) configuration changes regardless of what configuration change was made.
    This issue is addressed in SD-WAN plugin 2.2.2 and 3.0.2.

    PLUG-10433

    On the Panorama management server, commits (CommitCommit to Panorama) fail if any managed firewall (PanoramaManaged DevicesSummary) is Disconnected when the SD-WAN plugin is installed.
    This issue is addressed in SD-WAN plugin version 3.0.2.

    PLUG-10432

    The SD-WAN plugin is unable to retrieve the Prisma Service IP, preventing the onboard of Prisma Access tenants.
    This is addressed in SD-WAN plugin 2.2.2 and 3.0.2.

    PLUG-10274

    Panorama 10.2.1 may fail to synchronize configuration between high availability (HA) peers after commit when SD-WAN plugin 3.0.1 is installed. When the secondary Panorama HA peer fails to synchronize after committing, the HA status becomes unsynchronized. In this case, a commit error is thrown for synchronization failure between HA peers.
    This issue is addressed in SD-WAN plugin 3.0.2.

    PLUG-10165

    On the Panorama management server, commits (CommitCommit to Panorama) fail if your SD-WAN firewalls associated with the SD-WAN plugin (PanoramaSD-WAN) configuration are removed from Panorama management (PanoramaManaged DevicesSummary).
    Workaround: Remove the SD-WAN configuration after you remove your SD-WAN firewalls from Panorama management.
    1. Log in to the Panorama web interface.
    2. Select PanoramaPlugins and search for sd_wan.
    3. Remove Config.
    4. Click OK to confirm removing the SD-WAN configuration from Panorama.
    This is addressed in SD-WAN plugin 2.2.2 and 3.0.2.

    PLUG-3343

    The SD-WAN plugin fails to display any of the monitoring for a site and cluster with a space in the name.
    Workaround: Remove the space from the name and Commit.

    © 2026 Palo Alto Networks, Inc. All rights reserved.