Networking Features
Focus
Focus

Networking Features

Table of Contents

Networking Features

What new Networking features are in PAN-OS 11.0?
New Networking FeatureDescription
Software Cut Through Support for PA-400 and PA-1400 Series Firewalls
(PAN-OS 11.0.4 and later 11.0 releases)
The PA-400 and PA-1400 Series firewalls have significantly improved latency.
PA-5420 Firewall Supports Additional Virtual Routers
(PAN-OS 11.0.4 and later 11.0 releases)
The number of virtual routers supported on a PA-5420 firewall increased from 50 to 65. This increase allows you to have a virtual router for each virtual system on the firewall in the event that you configure more than 50 virtual systems.
Improved Throughput with Lockless QoS
(PAN-OS 11.0.3 and later 11.0 releases)
The Palo Alto Networks QoS implementation now supports a new QoS mode called lockless QoS for PA-3410, PA-3420, PA-3430, PA-3440, PA-5410, PA-5420, PA-5430, and PA-5440 firewalls. For firewalls with higher bandwidth QoS requirements, the lockless QoS dedicates CPU cores to the QoS function that improves QoS performance, resulting in improved throughput and latency.
Increased Maximum Number of Security Zones for PA-1400 Series Firewalls
(PAN-OS 11.0.2 and later 11.0 releases)
(PA-1400 Series firewalls only) The maximum number of security zones supported has increased from 50 to 150. The maximum number of security rules supported has increased from 1,500 to 5,000.
LSVPN Cookie Expiry Extension
(PAN-OS 11.0.1 and later 11.0 releases)
You can now configure the cookie expiration period from 1 to 5 years, while the default remains as 6 months. The encrypted cookie stored on an Large Scale VPN (LSVPN) satellite expires after every 6 months. This causes the VPN tunnels associated with the satellite to go down, causing an outage until the satellite is re-authenticated to the LSVPN portal or gateway and a new cookie is generated. A re-authentication every six months causes administrative overhead, affecting productivity, network stability, and resources of the company.
To reduce administrative overhead, we’ve extended the cookie expiration period from 6 months to 5 years.
PPPoE Client Support on a Subinterface
(PAN-OS 11.0.1 and later 11.0 releases)
The firewall extends PPPoE IPv4 client support to a subinterface so that the firewall can connect to an ISP that uses an IEEE 802.1Q VLAN tag on its PPPoE connections. The firewall as a PPPoE client receives its IPv4 address and other information from the PPPoE server. The firewall encapsulates PPPoE packets from a host in an 802.1Q frame before sending them to the ISP, and decapsulates PPPoE packets from the 802.1Q frame before sending them to the host.
Increased Maximum Number of Security Zones for PA-3400 Series Firewalls
(PAN-OS 11.0.1 and later 11.0 releases)
(PA-3400 Series firewalls only) The maximum number of security zones supported on the PA-3410 and PA-3420 firewalls has increased from 40 to 200. The maximum number of security zones supported on the PA-3430 firewall has increased from 100 to 200.
Poll Timeout Improvement for PA-3400 and PA-5400 Series Firewalls
(PAN-OS 11.0.1 and later 11.0 releases)
The PA-3400 and PA-5400 Series firewalls have improved latency when operating under low load.
Web Proxy
(PAN-OS 11.0.0 and later 11.0 releases)
Some networks are designed around a proxy for compliance and other requirements. The Web Proxy capability available in PAN-OS 11.0 allows these customers to migrate to NGFW without changing their proxy network to secure web as well as non-web traffic. With web proxy available for both NGFW and Prisma Access, Palo Alto Networks helps you transition to a single, integrated security stack for web security across on-premises and cloud-delivered form factors. By configuring seamless synchronization between your on-premises proxy device and the cloud-based proxy, you can enable Prisma Access as a SASE solution for your SWG-based network architecture to ensure consistent policy application regardless of location.
DHCPv6 Client with Prefix Delegation
The firewall now supports a stateful DHCPv6 Client to obtain IPv6 addresses and other parameters. This feature also supports Prefix Delegation by assigning prefixes received from the DHCP server to configured pools. A prefix from the pool is distributed using SLAAC to a host-facing (inherited) interface.
IPSec Transport Mode
In addition to the default tunnel mode, you can now configure IPSec tunnels to use Transport Mode when encrypting host-to-host communications. Transport mode encrypts only the payload while retaining the original IP header. You can use Transport mode to encrypt the management traffic with the most secure protocols.
Multicast Source Discovery Protocol on Advanced Routing Engine
The Advanced Routing Engine adds support for MSDP. MSDP interconnects multiple IPv4 PIM Sparse-Mode (PIM-SM) domains, enables the discovery of multicast sources in other PIM-SM domains, and reduces the complexity of interconnecting multiple PIM-SM domains by allowing PIM-SM domains to use an interdomain source tree.
BFD Support on PA-400 Series Firewalls
Bidirectional Forwarding Detection (BFD) support is extended to the PA-400 Series firewalls (PA-410, PA-440, PA-450, and PA-460 firewalls) for both the legacy routing engine and Advanced Routing Engine.
IPv4 and IPv6 Address Families Supported over a Single BGP Peering on Advanced Routing Engine
On the Advanced Routing Engine, BGP peer groups and peers now support both an IPv4 address family (AFI profile) for unicast SAFI and an IPv6 AFI profile for unicast SAFI over a single peering. This means that, regardless of whether the BGP local address and peer address are IPv4 or IPv6, the peering supports both IPv4 and IPv6 unicast routes being carried over a single BGP session that uses IPv4 or IPv6.
Power Over Ethernet (PoE)
PoE enables you to transfer electrical power from a supported firewall to a powered device. Using interfaces that have been configured for PoE, you can allocate power to multiple powered devices while still maintaining data transfer over an Ethernet connection. PoE is supported on many of the new models introduced with PAN-OS 11.0, including PA-1420, PA-1410, PA-445, and PA-415.
Persistent NAT for DIPP
Some applications, such as VoIP and video, use DIPP source NAT and may require STUN. DIPP NAT uses symmetric NAT, which may have compatibility issues with STUN. To alleviate those issues, persistent NAT for DIPP provides additional support for connectivity with such applications. When you enable persistent NAT for DIPP, the binding of a private source IP address and port to a specific public (translated) source IP address and port persists for subsequent sessions that arrive having that same original source IP address and port.