If you run an SD-WAN App Performance report with the time period set to last-hour, the report window displays an "Invalid data format" error and all layout grids remain blank, preventing report results from being displayed. To work around this issue, try running the report with a different time range.

If you delete VPN clusters and SD-WAN devices and then attempt to import SD-WAN devices via CSV, the import is blocked with the error "Pending changes exist. Please commit all changes before doing cluster import." This occurs because the system retains stale pending changes even after a successful commit. To work around this issue, perform an additional commit before attempting the CSV import.

Fixed an issue where adding an upstream NAT IP address to a new subinterface in an aggregate group caused the system to duplicate the NAT IP across both subinterfaces.

Fixed an issue where a Panorama plugin upgrade failed because Panorama is in FIPS-CC mode.

If your Panorama management server runs a version newer than PAN-OS® 10.1 (such as PAN-OS 10.2) when you add a new device PAN-OS® 10.1 to SD-WAN cluster, the commit-all operation fails. To ensure a successful push, your Panorama and firewalls must run the same version for PAN-OS 10.1.x.

Fixed an issue where the Panorama Connectivity (Dedicated Tunnel) feature in the SD-WAN plugin did not support Layer3 Sub Interfaces and Aggregated Ethernet Interfaces.

(HA Deployments only) When you replace a passive device in a High Availability (HA) pair, a commit error occurs because the SD-WAN plugin continues to reference the original device's serial number instead of the replacement device.

Panorama now includes a preventative fix to ensure tunnel IP addresses remain synchronized. As part of this fix, the following CLI command is deprecated: debug plugins sd_wan drop-config-cache.

To resolve the synchronization issue, first perform a configuration push to the affected Branch node to generate the new tunnel monitor IP address. Once the push is complete, identify the new tunnel monitor IP address and manually enter it into the BGP Peer IP field for the corresponding peer in the Panorama Cloud Services plugin. Finally, perform a configuration push to the Remote Network (RN) to align the settings and restore connectivity.

Redundant 4-byte ASN entries were created in the hub configuration when connected to multiple branches with the 4-byte ASN feature enabled.

The SD-WAN plugin requires unique interface numbers across different interface types. The commit all operation on managed firewalls fails if you mix the interface types (such as, Ethernet, Cellular) with the same interface number. For example, the configuration push or commit all operation fails if your SD-WAN configuration contains Ethernet and Cellular interface types with the same interface numbers, like ethernet1/1 and cellular1/1.

Workaround: Ensure that you don't use the same interface number for different interfaces for your firewalls. Always verify interface numbering when configuring SD-WAN interfaces to prevent deployment issues.

The commit all operation in Panorama fails when a branch or hub firewall is added to an existing SD-WAN cluster.

After installing SD-WAN plugin 2.2.7 version, the SD-WAN Devices page (PanoramaSD-WANDevices) does not load intermittently.

(SD-WAN Mesh topology only) BGP connectivity cannot be established between the SD-WAN branch and hub firewalls.

In Panorama, when you configure User-ID in the zone and push the configuration to the hub firewall, the configuration does not get enabled in the firewall.

(SD-WAN hub-and-spoke deployments only) DDNS validation fails on Panorama (throwing a commit error) when one or more SD-WAN branches are configured with dynamic IP addresses and hub configured with static IP address.

In an SD-WAN cluster, when the hub and branch firewalls (connecting to that hub) does not have a matching private link types, the plugin won't be able to generate the zone information. The SD-WAN plugin displays a warning message when no zone is associated with an interface.