>
    Changes to Default Behavior in PAN-OS 10.2
    Focus
    Download PDF
    Focus
    1. Home
    2. PAN-OS
    3. Changes to Default Behavior
    4. Changes to Default Behavior in PAN-OS 10.2
    Download PDF

    Changes to Default Behavior in PAN-OS 10.2

    Table of Contents

    Changes to Default Behavior in PAN-OS 10.2

    What default behavior changes impact PAN-OS 10.2?
    The following table details the changes in default behavior upon upgrade to PAN-OSĀ® 10.2. You may also want to review the Upgrade/Downgrade Considerations before upgrading to this release.
    FeatureChange
    Managed Device Traffic to Panorama
    PAN-OS 10.2 uses TLS version 1.3 to encrypt the service certificate and handshake messages between Panorama, managed firewalls, and Dedicated Log Collectors. As a result, the App-ID traffic between Panorama, managed firewalls, and Dedicated Log Collectors is reclassified from panorama to ssl.
    As a result, a Security policy rule is required to allow the ssl application. This allows Panorama, managed firewalls, and Dedicated Log Collectors to continue communication after successful upgrade to PAN-OS 10.2. Review the Ports Used for Panorama for more information on the destination ports required for managed device communication with Panorama.
    Administrator Login
    Usernames that contain all numbers are no longer valid. For example, the username 12345678 does not work.
    Usernames that include at least one alphabetical or legal symbol character are valid, such as 1234_567, 1234a789_, and c7897432.
    Masterd Rename
    With PAN-OS 10.2 all instances of masterd in the CLI were replaced with MD.
    Panorama Management of Multi-Vsys Firewalls
    For multi-vsys firewalls managed by a Panorama managed server, configuration objects in the Shared device group are now pushed to a Panorama Shared configuration context for all virtual systems rather than duplicating the shared configuration to each virtual system to reduce the operational burden of scaling configurations for multi-vsys firewalls.
    As a result, you must delete or rename any locally configured firewall Shared object that has an identical name to an object in the Panorama Shared configuration. Otherwise, configuration pushes from Panorama fail after the upgrade and display the error <object-name> is already in use.
    The following configurations cannot be added to the Shared Panorama location and are replicated to the Panorama location of each vsys of a multi-vsys firewall.
    • Pre and Post Rules
    • External Dynamic Lists (EDL)
    • Security Profile Groups
    • HIP objects and profiles
    • Custom objects
    • Decryption profiles
    • SD-WAN Link Management Profiles
    Palo Alto Networks recommends that if a multi-vsys firewall is managed by Panorama, then all vsys configurations should be managed by Panorama.
    This helps avoid commit failures on the managed multi-vsys firewall and allows you to take advantage of optimized shared object pushes from Panorama.
    Certificates
    On upgrade to PAN-OS 10.2, it is required that all certificates meet the following minimum requirements:
    • RSA 2048 bits or greater, or ECDSA 256 bits or greater
    • Digest of SHA256 or greater
    See the PAN-OS Administrator's Guide or Panorama Administrator's Guide for more information on regenerating or re-importing your certificates.
    Advanced Routing Engine
    With Advanced Routing enabled, by default connected peers prefer a link-local next-hop address over a global next-hop address.
    Advanced Routing Engine and BFD
    On a firewall with Advanced Routing enabled, BFD session establishment for iBGP peers is changed. Any iBGP peers over a loopback address are not considered to be directly connected and therefore should enable the multihop option in the BFD profile and specify Minimum Rx TTL accordingly.
    Auto Web Interface Refresh for XML API
    PAN-OS 10.2.5 and later releases
    		When making successful XML API calls on a firewall, the web interface will refresh after an interval of 10 seconds.
    Selective Push for Prisma Access (Panorama Managed)
    PAN-OS 10.2.2 and later releases
    Pushing selective configuration changes to Prisma Access in Panorama Managed Prisma Access deployments is no longer supported.
    To push selective configuration changes to Prisma Access:
    1. CommitCommit to Panorama and select only the configuration changes you want to push.
    2. Push your configuration changes to Prisma Access.
    Scheduled Log Export
    Scheduled log exports (DeviceLog Export) may not export logs as scheduled if multiple logs are scheduled to export at the same time.
    Workaround: When scheduling your log exports, maintain at least 6 hours between each scheduled log export.
    Test SCP Server Connection
    PAN-OS 10.2.4 and later releases
    To test the SCP server connection when you schedule a configuration export (PanoramaSchedule Config Export) or log export (DeviceScheduled Log Export), a new pop-up window is displayed requiring you to enter the SCP server clear textPassword and Confirm Password to test the SCP server connection and enable the secure transfer of data.
    You must also enter the clear text SCP server Password and Confirm Password when you test the SCP server connection from the firewall or Panorama CLI.
    admin>test scp-server-connection initiate <ip> username <username> password <clear-text-password>
    Enterprise data loss prevention (DLP) Predefined Data Filtering Profiles
    After successful upgrade to PAN-OS 10.2.4 with Panorama plugin for Enterprise DLP 3.0.4 or later release installed, the default File Direction for predefined data filtering profiles (ObjectsDLPData Filtering Profiles) is Both.
    Authentication for SAML and client certificate
    In PAN-OS 9.1 and earlier versions, if you configured client certificate authentication, the firewall applied the policy rule using the domain of the certificate.
    In PAN-OS 10.2 and later versions, if you configure both SAML authentication and client certificate authentication, the firewall applies the policy rule using the SAML domain.
    If you do not configure the SAML domain when using both SAML and client certificate authentication, the firewall may not be able to authenticate users successfully.
    If the SAML username differs from the certificate username, delete the username from the client certificate profile and commit the changes; otherwise, authentication is not successful.
    Domain Fronting Detection
    PAN-OS 10.2.9-h8 and later PAN-OS 10.2.9 releases
    PAN-OS 10.2.11 and later
    Domain Fronting Detection is a feature that was released in PAN-OS 10.2 that enabled detection of a TLS evasion technique that can circumvent URL filtering database solutions and facilitate data exfiltration, contained in HTTP request payloads using HTTP/1.x and HTTP/2 protocols. Due to excessive false-positives generated by this detection when inspecting HTTP/2 requests, the firewall no longer generates threat logs alerts for HTTP/2 requests in PAN-OS 10.2.9-h8 and later PAN-OS 10.2.9 releases and PAN-OS 10.2.11 and later.
    Default User-ID TLS VersionTo improve security and reduce the risk of vulnerabilities, the default TLS version that the firewall uses is upgraded to TLS version 1.3 when you upgrade to PAN-OS 10.2 from a previous version.
    Name change for User-ID ApplicationThe name of the application the firewall uses for User-ID changes from "paloalto-userid-agent" to "ssl" when you upgrade to PAN-OS 10.2 from a previous version. If you have any security policy rules to allow traffic for "paloalto-userid-agent" you must update them to allow traffic for "ssl" instead and commit the changes to the configuration. This change also applies to the traffic logs.
    Collector Groups
    PAN-OS 10.2.9 and later 10.2 releases
    You can configure a Collector Group with two Log Collectors. When one Log Collector goes down, the Collector Group still remains operational.

    © 2024 Palo Alto Networks, Inc. All rights reserved.