After panos upgrade for our explicit proxy setup to 11.1.13, several applications do not work in prod anymore
228
Created On 02/24/26 11:35 AM - Last Modified 09/02/26 22:22 PM
Symptom
The customer noticed 503 errors and 'no healthy upstream' for HTTP connections using the Explicit Proxy.
Environment
- PANW Firewall.
- Explicit Proxy
- PanOS 11.1.13
Cause
Software Issue: After DNS resolution completes and after selecting the target host, when the HTTP router attempts to acquire a connection pool to send the request upstream. At this point, the circuit breaker checks if the maximum number of connection pools has been reached. If the limit is exceeded, pool creation is blocked, upstream_cx_pool_overflow is incremented, and the request fails with 503 "no_healthy_upstream" - even though DNS succeeded and the host is healthy.
Resolution
- Upgrade to PAN-OS 11.2.10-h5 or higher
- Downgrade to the previous working version until the fix is available
Additional Information
Workaround:
- Bypass Proxy for the problematic traffic