Limitations

The following table includes limitations associated with PAN-OS® 8.0 releases.

Issue ID	Description
PAN-68997	The WildFire® appliance cluster membership list may not be accurate if cluster members are offline or the membership list is stale. You can import a configuration from any WildFire appliance or appliance cluster into Panorama™, add any connected WildFire appliance to a cluster, and assign it a role in the cluster so that you have more flexibility when configuring and re-configuring clusters. After you import a cluster configuration, you can view the cluster members from the Panorama web interface (PanoramaManaged Wildfire Clusters) to check the cluster membership list and ensure that all listed members are nodes in the cluster and to add missing nodes to the cluster as needed. If you import a WildFire appliance that is already part of a cluster or you import a WildFire appliance and later add it to a cluster using a local configuration, the Panorama web interface displays it as a standalone appliance and shows it to be out of sync. To resolve this, add the node to the cluster, which syncs the configurations in Panorama. To avoid an inaccurate membership list, before you add a node to a cluster, make sure that any WildFire appliance you add to the cluster is not a member of another cluster. Controller and controller backup nodes perform critical cluster management tasks. If you change the controller or controller backup node, ensure that the replacement node is a cluster member. If you inadvertently add a node to more than one cluster, or if you specify a controller or controller backup node that does not belong to the cluster, the consequences vary depending on whether you push the changes to the clusters. If you did not yet commit the changes on the Panorama appliance, or if you only committed the changes but did not push them yet, then first reconfigure the cluster and Commit to Panorama to avoid unintended consequences. If you push a misconfiguration to clusters, cluster behavior is unpredictable and can affect more than one cluster if the pushed Panorama configuration includes nodes that are assigned to more than one cluster. If you inadvertently add a node to more than one cluster, make the appropriate change to correct the misconfiguration: If you have not committed the configuration on Panorama, remove the node from the cluster. If you have already committed the changes on Panorama, remove the node from the cluster and re-commit the changes to Panorama. If you have already committed the changes on Panorama and pushed the changes to managed WildFire appliance clusters, remove the node from the cluster, and then re-commit to Panorama and re-push to the WildFire appliance clusters. If you inadvertently specify a controller or controller backup node that is not a cluster member, make the appropriate change to correct the misconfiguration: If you have not committed the configuration on Panorama, specify a valid cluster node as the controller or controller backup node. If you have already committed the changes on Panorama, specify a valid cluster node as the controller or controller backup node and Commit to Panorama. If you have already committed the changes on Panorama and pushed the changes to managed WildFire appliance clusters, specify a valid cluster node as the controller or controller backup node, and then re-commit to Panorama and re-push to the WildFire appliance clusters.

Issue ID

Description

PAN-68997

The WildFire® appliance cluster membership list may not be accurate if cluster members are offline or the membership list is stale. You can import a configuration from any WildFire appliance or appliance cluster into Panorama™, add any connected WildFire appliance to a cluster, and assign it a role in the cluster so that you have more flexibility when configuring and re-configuring clusters.

After you import a cluster configuration, you can view the cluster members from the Panorama web interface (PanoramaManaged Wildfire Clusters) to check the cluster membership list and ensure that all listed members are nodes in the cluster and to add missing nodes to the cluster as needed.

If you import a WildFire appliance that is already part of a cluster or you import a WildFire appliance and later add it to a cluster using a local configuration, the Panorama web interface displays it as a standalone appliance and shows it to be out of sync. To resolve this, add the node to the cluster, which syncs the configurations in Panorama.

To avoid an inaccurate membership list, before you add a node to a cluster, make sure that any WildFire appliance you add to the cluster is not a member of another cluster.

Controller and controller backup nodes perform critical cluster management tasks. If you change the controller or controller backup node, ensure that the replacement node is a cluster member. If you inadvertently add a node to more than one cluster, or if you specify a controller or controller backup node that does not belong to the cluster, the consequences vary depending on whether you push the changes to the clusters.

If you did not yet commit the changes on the Panorama appliance, or if you only committed the changes but did not push them yet, then first reconfigure the cluster and Commit to Panorama to avoid unintended consequences.

If you push a misconfiguration to clusters, cluster behavior is unpredictable and can affect more than one cluster if the pushed Panorama configuration includes nodes that are assigned to more than one cluster. If you inadvertently add a node to more than one cluster, make the appropriate change to correct the misconfiguration:

If you have not committed the configuration on Panorama, remove the node from the cluster.
If you have already committed the changes on Panorama, remove the node from the cluster and re-commit the changes to Panorama.
If you have already committed the changes on Panorama and pushed the changes to managed WildFire appliance clusters, remove the node from the cluster, and then re-commit to Panorama and re-push to the WildFire appliance clusters.

If you inadvertently specify a controller or controller backup node that is not a cluster member, make the appropriate change to correct the misconfiguration:

If you have not committed the configuration on Panorama, specify a valid cluster node as the controller or controller backup node.
If you have already committed the changes on Panorama, specify a valid cluster node as the controller or controller backup node and Commit to Panorama.
If you have already committed the changes on Panorama and pushed the changes to managed WildFire appliance clusters, specify a valid cluster node as the controller or controller backup node, and then re-commit to Panorama and re-push to the WildFire appliance clusters.

Document:PAN-OS® Release Notes

Limitations

Limitations

Related Documentation

Document:PAN-OS® Release Notes

Limitations

Limitations

Related Documentation

WildFire Appliance Cluster Management

Configure a Cluster and Add Nodes on Panorama

WildFire Appliance Cluster Resiliency and Scale

Deploy a WildFire Cluster

Configure a Cluster and Add Nodes Locally

Known Issues Specific to the WF-500 Appliance

Remove a Cluster from Panorama Management

Managed WildFire Cluster and Appliance Administration

Managed WildFire Cluster Tasks

show cluster membership