PAN-OS & Panorama

1. Update the content release version to 9157-10279 or later.
2. Verify that Advanced Forwarding is active on the firewall.

   Advanced Forwarding is enabled by default on PAN-OS 12.2.2 and later. You can validate the Advanced Forwarding configuration through the CLI.

   If you manage firewalls through Panorama, you can also verify the status from the Panorama management server:

   • Web interface—Select PanoramaManaged DevicesSummary and check the Advanced Forwarding Mode column for each firewall.
   • CLI—Run the following command:

     admin@Panorama> show devices connected | match "Advanced Forwarding mode:"
       Advanced Forwarding mode: yes

   If Advanced Forwarding is not active, configure Advanced Forwarding settings on the managed firewalls.
3. Select ObjectsSecurity ProfilesVulnerability Protection.
4. Click Add to create a new profile or select an existing profile to modify.
5. Select the Frontier Virtual Patching tab.

6. Enable the Enable Frontier Virtual Patching checkbox.

   The detection table displays three severity categories (Critical, High, and Medium) with their current actions.
7. For each severity category, choose the action to apply when a predisclosure signature of that severity matches traffic.

   The default action for all severity categories is alert. You can set a different action for each severity level independently.
8. Click OK to save the profile.
9. Commit your changes.

   After you commit, the firewall begins downloading the pre-filter and pre-filtering traffic. You can review Frontier Virtual Patching detections in the threat log.
10. (Optional) Create exceptions for individual Frontier Virtual Patching signatures.

    You can change the action for individual Threat IDs or exclude specific signatures from enforcement. For details, see Frontier Virtual Patching Exceptions.