In high-availability mode, the physical layer (PHY) on the passive firewall instance remains powered on to accelerate failover recovery. Intel verified that re-negotiation latency on passthrough NICs cannot be bypassed. Consequently, maintaining an active link state is required to achieve sub-second port initialization. Although the CLI displays a powered-down status when the firewall halts packet forwarding across these interfaces, the NIC retains an active physical link. As a result, connected upstream switches detect the interface link state as UP. This is true for single interfaces as aggregate interfaces for the passive may remain down on the connected upstream switch.

Panorama M-600 and M-700 appliances are not supported on the following releases:

• 11.1.4-h15
• 11.1.6-h4

NGFW clusters don't support Persistent NAT for DIPP.

NAT is not configurable when HA clusters are configured. HA clusters do not support NAT.

PA-7500 Series firewalls in an NGFW cluster do not support the failover of application-level gateway (ALG) sessions.

In cases where traffic flow is redirected through the IFL/HSCI between NGFW cluster nodes, you might experience packet drops and intermittent failures with the establishment of new connections if the total bandwidth throughput is over 370G if you're using 400G HSCI. If you're using100G HSCI, anything over 80G will start seeing packet drops.

(PA-7500 firewall only) Dual stacking for IPv4 and IPv6 addresses on the log ports is not supported. When enabling dual stacking, IPv4 is used by default, which disables any IPv6 log forwarding to external destinations. In order to forward logs to IPv6 endpoints, remove the IPv4 address and use an IPv6 address for the log interface.

ECMP is not supported for equal-cost routes where one or more of those routes has a virtual router or logical router as the next hop. None of the equal-cost routes will be installed in the Forwarding Information Base (FIB).

Enter any random username and password (or just press enter) in the pop-up dialog on the satellite to retrigger the authentication process in the following cases:

(PA-455 firewall only) The hardware can detect the presence of a power adapter but does not detect voltage or functionality. As a result, the firewall’s Alarm feature is unavailable to the power supply and is only raised when the device reaches temperature limits. Furthermore, the firewall does not display power supply details in system logs or the CLI.

When the preferred lifetime of the IPv6 address on the MGT interface expires, existing IPv6 sessions are disconnected. RFC 8415 indicates that existing communications must remain for the duration of the valid lifetime if the preferred lifetime expires (sessions must be active during the time between the preferred lifetime and valid lifetime). However, the NGFW limitation is that sessions are lost when the preferred lifetime expires.

(PA-415 and PA-445 firewalls) The hardware can detect the presence of a power adapter but does not detect voltage or functionality. As a result, the firewall’s Alarm feature is unavailable to the power supply and is only raised when the device reaches temperature limits. Furthermore, the firewall does not display power supply details in system logs or the CLI.