Focus

Compatibility Matrix

Mobile Network Infrastructure Feature Support

Table of Contents

Mobile Network Infrastructure Feature Support

Palo Alto Networks Next-Generation Firewall models and PAN-OS® software versions that support GTP, SCTP, 5G, 5G MEC, PFCP, and RADIUS Security, as well as 3GPP Technical Standards.

Review the lists of Specific Palo Alto Networks firewall models and PAN-OS® software versions that support GTP, SCTP, 5G, PFCP, and RADIUS Security, as well as 3GPP Technical Standards:

PAN-OS Releases by Model that Support GTP, SCTP, and 5G Security
PAN-OS Releases by Model that Support Intelligent Security Correlation (PFCP, RADIUS, and GTP)
PAN-OS Releases by Firewall Model that Support 5G Multi-access Edge Computing Security
Subscriber and Equipment Object Capacity Limits
3G, 4G, and 5G Network Identifier Capacity for EDL and Static Entries by Firewall Model
3GPP TS References for GTP Security
3GPP TS References for 5G Security
3GPP TS References for 5G Multi-Edge Security
3GPP TS References for UE-to-IP Address Correlation with PFCP in 4G

PAN-OS Releases by Model that Support GTP, SCTP, and 5G Security

The following table lists which firewall models and PAN-OS software versions support the following security methods:

General Packet Radio Service (GPRS) Tunnelling Protocol (GTP) security
Stream Control Transmission Protocol (SCTP) security
5G security

Firewall Model	PAN-OS 9.1 (GTP and SCTP)	PAN-OS 10.1 (GTP, SCTP, and 5G)	PAN-OS 10.2 (GTP, SCTP, and 5G)	PAN-OS 11.0 (GTP, SCTP, and 5G)	PAN-OS 11.1 (GTP, SCTP, and 5G)	PAN-OS 11.2 (GTP, SCTP, and 5G)	PAN-OS 12.1 (GTP, SCTP, and 5G)
VM-Series Firewalls	√	√	√	√	√	√	√
CN-Series Firewalls*	—	√	√	√	√	√	√
PA-7500 Firewalls (Standalone only)	—	—	—	—	√	√	√
PA-5500 Standalone Firewalls	—	—	—	—	—	—	√(`PAN-OS version 12.1.2 only`)
PA-5410, PA-5420, and PA-5430 Firewalls	—	—	√	√	√	√	√
PA-5440 Firewalls	—	—	—	√	√	√	√
PA-5445 Firewalls	—	—	—	—	√	√	√
PA-5450 Firewalls	—	√	√	√	√	√	√
PA-3430 and PA-3440 Firewalls	—	—	√	√	√	√	√
PA-3410 and PA-3420	—	—	—	—	—	—	√ (`SCTP security only`)
PA-1410 and PA-1420	—	—	—	—	—	—	√ (`SCTP security only`)
PA-440, PA-450, PA-450R, PA-450R-5G, and PA-460 Firewalls	—	—	—	—	—	—	√ (`SCTP security only`)

* CN-Series Daemonset mode supports GTP, SCTP, and 5G security in PAN-OS 10.1 and later PAN-OS versions. Additionally, CN-Series firewalls running PAN-OS 10.2 and later PAN-OS versions support GTP, SCTP, and 5G security in both K8s cloud-native network (CNF) mode and Daemonset mode.

** To verify that your PA-7000 Series firewall is installed with the cards that support GTP and SCTP, use the show chassis inventory CLI command. However, it is possible that cards are installed but are not functional if your firewall does not account for all dependencies. Refer to the PA-7000 Series Firewall Hardware Reference for installation instructions and to review the dependencies for each card.

PAN-OS Releases by Model that Support Intelligent Security Correlation (PFCP, RADIUS, and GTP)

The following table lists which firewall models and PAN-OS software versions support Intelligent Security Correlation:

Packet Forwarding Control Protocol (PFCP)
Remote Authentication Dial-In User Service (RADIUS)
General Packet Radio Service (GPRS) Tunnelling Protocol (GTP)

Firewall Model	PAN-OS 11.0 (PFCP* and RADIUS**)	PAN-OS 11.1 (PFCP and RADIUS	PAN-OS 11.2 (PFCP, RADIUS, and GTP)	PAN-OS 12.1 (PFCP, RADIUS, and GTP)
VM-Series Firewalls	√	√	√	√
CN-Series Firewalls	√	√	√	√
PA-7500 Series Firewalls	—	√ (`HA cluster with PAN-OS 11.1.5 for RADIUS only`)	√ (`HA cluster with PAN-OS 11.2.8 for RADIUS only`)	√ (`HA cluster using PAN-OS 12.1.2 for RADIUS only`)
PA-5500 Series	—	—	—	√ (`HA cluster using PAN-OS 12.1.2 for RADIUS only`)
PA-5410, PA-5420, PA-5430, PA-5440, and PA-5450 Firewalls	√	√	√	√
PA-5445 Firewalls	—	√	√	√
PA-3430 and PA-3440 Firewalls	√	√	√	√
PA-3410 and PA-3420 Firewalls	—	—	—	√
PA-1410 and PA-1420 Firewalls	—	—	—	√
PA-440, PA-450, PA-450R, PA-450R-5G, and PA-460 Firewalls	—	—	—	√

* In PAN-OS 11.0, we support only 4G CUPS architecture for Intelligent Security with PFCP.

** We support Intelligent Security with RADIUS in PAN-OS 11.0.2 and all later PAN-OS versions.

*** To verify that your PA-7000 Series firewall is installed with the cards that support PFCP, RADIUS, and GTP, use the show chassis inventory CLI command. However, it is possible that cards are installed but are not functional if your firewall does not account for all dependencies. Refer to the PA-7000 Series Firewall Hardware Reference for installation instructions and to review the dependencies for each card.

PAN-OS Releases by Firewall Model that Support 5G Multi-access Edge Computing Security

The following table lists which firewall models and PAN-OS software versions support 5G multi-access edge computing security:

Firewall Model	PAN-OS 11.0	PAN-OS 11.1	PAN-OS 11.2	PAN-OS 12.1
VM-Series Firewalls	√	√	√	√
CN-Series Firewalls on Openshift	√	√	√	√
PA-7500 Series Firewalls (Standalone only)	—	√	√	√
PA-5500 Series (Standalone only)	—	—	—	√ (`PAN-OS version 12.1.2 only`)
PA-5410, PA-5420, PA-5430, PA-5440, and PA-5450 Firewalls	√	√	√	√
PA-5445 Firewalls	—	√	√	√
PA-3430 and PA-3440 Firewalls	√	√	√	√

Subscriber and Equipment Object Capacity Limits

The maximum number of subscriber and equipment objects, groups, and members per group varies by platform. When the limit is reached, the firewall blocks the commit and displays a warning.

Platform	Max Subscriber/Equipment Entries	Max Groups	Max Members per Group
PA-7500	500,000	100,000	5,000
PA-7080 / PA-7050	100,000	20,000	5,000
PA-5580 / PA-5570 / PA-5560 / PA-5550 / PA-5540	200,000	40,000	5,000
PA-5280 / PA-5260 / PA-5250 / PA-5220	50,000	10,000	5,000
PA-5450 / PA-5445 / PA-5440 / PA-5430 / PA-5420 / PA-5410	100,000	20,000	5,000
PA-3440 / PA-3430 / PA-3420 / PA-3410	30,000	6,000	5,000
PA-1420 / PA-1410	20,000	4,000	5,000
PA-460	15,000	3,000	5,000
PA-450 / PA-450R / PA-450R-5G / PA-440	10,000	2,000	5,000
VM-Series / CN Flex Tier 4	100,000	20,000	5,000
VM-Series / CN Flex Tier 3	50,000	10,000	5,000
VM-Series / CN Flex Tier 2	10,000	2,000	5,000
VM-Series / CN Flex Tier 1	5,000	1,000	5,000

3G, 4G, and 5G Network Identifier Capacity for EDL and Static Entries by Firewall Model

The following table lists the total capacity for 3G, 4G, and 5G network identifiers by firewall model and by external dynamic list (EDL) or static entry:

Firewall Model	Total 3G, 4G, and 5G Network Identifiers Supported by External Dynamic List	Total 3G, 4G, and 5G Network Identifiers Supported by Static Entries
PA-5580	10,000,000	200,000
PA-5570	9,000,000	200,000
PA-5560	5,000,000	200,000
PA-5550	5,000,000	200,000
PA-5540	4,000,000	200,000
PA-5440	1,200,000	100,000
PA-5430	720,000	100,000
PA-5420	500,000	100,000
PA-5410	360,000	60,000
PA-3440	250,000	50,000
PA-3430	250,000	50,000
PA-3420	220,000	30,000
PA-3410	140,000	30,000
PA-1420	140,000	20,000
PA-1410	94,500	20,000
PA-460	40,000	15,000
PA-450, PA-450R, PA-450R-5G	30,000	15,000
PA-440	20,000	10,000
VM-700	300,000	5,000
VM-500	75,000	1,000
VM-300	20,000	500
VM-100	2,000	200
VM-Series firewalls that use licenses funded with Software NGFW credits (Tier 3)* (`11.2 and later`)	1,000,000	50,000
VM-Series firewalls that use licenses funded with Software NGFW credits (Tier 4)* (`11.2 and later`)	1,400,000	100,000

3GPP TS References for GTP Security

3GPP TS references for GTP security on firewalls that support GTP security.

	Protocol	3GPP TS	3GPP TS Release
PAN-OS 10.2 PAN-OS 10.1	GTPv2-C	29.274	Up to 15.2
	GTPv1-C	29.060	Up to 15.5.0
	GTP-U	29.281	Up to 15.0.0
	—	43.129	15.0.0
	—	23.401	15.12.0
PAN-OS 9.1	GTPv2-C	29.274	Up to 15.2
	GTPv1-C	29.060	Up to 15.1
	GTP-U	29.281	Up to 15.0.0
PAN-OS 8.1 (only where supported)	GTPv2-C	29.274	Up to 13.4
	GTPv1-C	29.060	Up to 13.4
	GTP-U	29.281	Up to 13.0

3GPP TS References for 5G Security

3GPP Technical Standards references for 5G network slice, 5G subscriber ID, and 5G equipment ID security on firewalls that support GTP security.

Procedures for the 5G System (5GS)
5GS Session Management Services

	3GPP TS	3GPP TS Release
PAN-OS 10.2 PAN-OS 10.1	23.502	Up to 15.5.0
PAN-OS 10.2 PAN-OS 10.1	29.502	Up to 15.4.0

3GPP TS References for 5G Multi-Edge Security

5G Multi-Edge Security supports Packet Forwarding Control Protocol (PFCP) messages over N4 interfaces for the following technical specifications in the 3GPP TS release:

Interface between the Control Plane and the User Plane nodes

3GPP Technical Standards reference for 5G Multi-Edge Security on firewalls that support 5G MEC Security:

	3GPP TS	3GPP TS Release
PAN-OS 10.2 PAN-OS 10.1	29.244	Up to 16.5.0

3GPP TS References for UE-to-IP Address Correlation with PFCP in 4G

The below table provides the 3GPP Technical Standards reference for firewalls that leverage User Equipment (UE)-to-IP Address Correlation using the Packet Forwarding Control Protocol (PFCP) for 4G network traffic.

	3GPP TS	3GPP TS Release
PAN-OS 11.0	23.214	Up to 16.2.0
PAN-OS 11.0	29.244	Up to 16.9.1

IPv6 Support by Feature

Compatibility Matrix

Mobile Network Infrastructure Feature Support

Compatibility Matrix

Mobile Network Infrastructure Feature Support

PAN-OS Releases by Model that Support GTP, SCTP, and 5G Security

PAN-OS Releases by Model that Support Intelligent Security Correlation (PFCP, RADIUS, and GTP)

PAN-OS Releases by Firewall Model that Support 5G Multi-access Edge Computing Security

Subscriber and Equipment Object Capacity Limits

3G, 4G, and 5G Network Identifier Capacity for EDL and Static Entries by Firewall Model

3GPP TS References for GTP Security

3GPP TS References for 5G Security

3GPP TS References for 5G Multi-Edge Security

3GPP TS References for UE-to-IP Address Correlation with PFCP in 4G

Activation & Onboarding

Next-Generation Firewalls

SASE

Cloud-Delivered Security Services

Network Security

Visibility & Monitoring

Best Practices

Experts Corner