Panorama 11.2.3-h3 VMware Tools running but guest heartbeat remains red

[KASU-Meteor]

Hello,

We deployed a new Panorama virtual appliance from the official VMware OVA. The appliance is running PAN-OS 11.2.3-h3 on VMware vSphere/ESXi 7.0 Update 3.

Panorama itself operates normally, and all management-plane processes are running. However, VMware reports that the guest heartbeat is continuously red, even though VMware Tools are shown as installed and running.

ESXi reports:

toolsStatus = "toolsOk"
toolsRunningStatus = "guestToolsRunning"
toolsVersionStatus = "guestToolsUnmanaged"
toolsVersion = "12320"
guestHeartbeatStatus = "red"

PAN-OS reports:

Process vm_agent running

The ESXi vmware.log records the following sequence every 20 seconds:

GuestRpcSendTimedOut: message to toolbox timed out.
TOOLS: appName=toolbox, oldStatus=1, status=2, guestInitiated=0.
TOOLS: appName=toolbox, oldStatus=2, status=1, guestInitiated=0.

The log also occasionally reports:

VIX_E_TOOLS_NOT_RUNNING

The heartbeat counter itself continues to increase, and the last heartbeat is normally reported as received 0–3 seconds ago. Nevertheless, guestHeartbeatStatus remains red.

We have confirmed the following:

• The issue has existed since the initial OVA deployment.

• It is not caused by vMotion.

• It persists after a complete Panorama system restart.

• The VM has no snapshots.

• There are no snapshot quiesce, filesystem freeze, or thaw events in vmware.log.

• The Panorama vm_agent process is running.

• VMware Tools are appliance-managed and cannot be reinstalled from vSphere.

• The supported PAN-OS CLI command for restarting individual processes does not offer vm_agent as a restartable process.

• Panorama management, logging, and managed firewalls otherwise operate normally.

Because vSphere HA VM Monitoring interprets the missing guest heartbeat as an application failure, it could unnecessarily reset an operational Panorama appliance. We have therefore temporarily disabled VM Monitoring only for this VM while retaining normal HA protection against ESXi host failure.

Questions:

1. Is this a known issue with the VMware OVA or vm_agent included in PAN-OS 11.2.3-h3?

2. Is the red VMware guest heartbeat expected for a Panorama appliance?

3. Is there a supported method to restart or repair vm_agent without rebooting the appliance?

4. Has this issue been fixed in a later PAN-OS 11.2 maintenance release, and if so, in which version?

Thank you.