This release offers support for PAN-OS 9.0, which includes the following new features and enhancements:

Note that the following 9.0 features are not supported:

In addition to Prisma Access’ default routing for service connections, Prisma Access allows a new choice, Hot potato routing, which changes the way routes are imported and advertised to and from Prisma Access so that traffic destined to service connections (for example, HQ or data center traffic) exits the Prisma Access network as quickly as possible.

In addition, to help ensure routing symmetry in the event of a link failure, you can choose a preferred service connection to use as a backup if a link to a service connection fails (Backup SC).

To provide additional network resiliency using redundant instances of your customer premises equipment (CPE), Prisma Access allows you to add up to four IPSec tunnels for a single remote network.

Prisma Access can advertise a default route for remote network connections using BGP; you can then use this route in your organization’s network to direct traffic to Prisma Access.

Prisma Access adds improvements to the commands you use to retrieve the public IP addresses (the source IP addresses that Prisma Access uses for requests to an internet-based source).

The API command has the following enhancements for mobile user deployments:

You can specify up to 2,000 wild card (*.example.com) URLs (including those specified in custom URL categories), an increase from 500, when you use traffic forwarding rules with service connections.

To ensure consistent Host Information Profile (HIP) policy enforcement and to simplify policy management, you can redistribute HIP information received from mobile users and users at remote networks that use the GlobalProtect app from Prisma Access to other gateways, firewalls, and Panorama appliances in your enterprise, including the Panorama that manages Prisma Access.