>
    Strata Copilot
    Mobile Network Infrastructure Feature Support
    Focus
    Download PDF
    Focus
    1. Home
    2. Compatibility Matrix
    3. Mobile Network Infrastructure Feature Support
    Download PDF
    Compatibility Matrix

    Mobile Network Infrastructure Feature Support

    Table of Contents

    Mobile Network Infrastructure Feature Support

    Palo Alto Networks Next-Generation Firewall models and PAN-OSĀ® software versions that support GTP, SCTP, 5G, 5G MEC, PFCP, and RADIUS Security, as well as 3GPP Technical Standards.
    Review the lists of Specific Palo Alto Networks firewall models and PAN-OSĀ® software versions that support GTP, SCTP, 5G, PFCP, and RADIUS Security, as well as 3GPP Technical Standards:

    PAN-OS Releases by Model that Support GTP, SCTP, and 5G Security

    The following table lists which firewall models and PAN-OS software versions support the following security methods:
    • General Packet Radio Service (GPRS) Tunnelling Protocol (GTP) security
    • Stream Control Transmission Protocol (SCTP) security
    • 5G security
    Firewall Model
    PAN-OS 9.1 (GTP and SCTP)
    PAN-OS 10.1 (GTP, SCTP, and 5G)
    PAN-OS 10.2 (GTP, SCTP, and 5G)
    PAN-OS 11.0 (GTP, SCTP, and 5G)
    PAN-OS 11.1 (GTP, SCTP, and 5G)
    PAN-OS 11.2 (GTP, SCTP, and 5G)
    		PAN-OS 12.1 (GTP, SCTP, and 5G)
    VM-Series Firewalls
    āˆš
    āˆš
    āˆš
    āˆš
    āˆš
    āˆš
    		āˆš
    CN-Series Firewalls*
    ā€”
    āˆš
    āˆš
    āˆš
    āˆš
    āˆš
    		āˆš
    PA-7500 Firewalls (Standalone only)
    ā€”
    ā€”
    ā€”
    ā€”
    āˆš
    āˆš
    		āˆš
    PA-5500 Standalone Firewallsā€”ā€”ā€”ā€”ā€”ā€”āˆš(PAN-OS version 12.1.2 only)
    PA-5410, PA-5420, and PA-5430 Firewalls
    ā€”
    ā€”
    āˆš
    āˆš
    āˆš
    āˆš
    		āˆš
    PA-5440 Firewalls
    ā€”
    ā€”
    ā€”
    āˆš
    āˆš
    āˆš
    		āˆš
    PA-5445 Firewalls
    ā€”
    ā€”
    ā€”
    ā€”
    āˆš
    āˆš
    		āˆš
    PA-5450 Firewalls
    ā€”
    āˆš
    āˆš
    āˆš
    āˆš
    āˆš
    		āˆš
    PA-3430 and PA-3440 Firewalls
    ā€”
    ā€”
    āˆš
    āˆš
    āˆš
    āˆš
    		āˆš
    PA-3410 and PA-3420
    ā€”
    ā€”
    ā€”
    ā€”
    ā€”
    ā€”
    āˆš (SCTP security only)
    PA-1410 and PA-1420
    ā€”
    ā€”
    ā€”
    ā€”
    ā€”
    ā€”
    āˆš (SCTP security only)
    PA-440, PA-450, PA-450R, PA-450R-5G, and PA-460 Firewallsā€”ā€”ā€”ā€”ā€”ā€”
    āˆš (SCTP security only)
    * CN-Series Daemonset mode supports GTP, SCTP, and 5G security in PAN-OS 10.1 and later PAN-OS versions. Additionally, CN-Series firewalls running PAN-OS 10.2 and later PAN-OS versions support GTP, SCTP, and 5G security in both K8s cloud-native network (CNF) mode and Daemonset mode.
    ** To verify that your PA-7000 Series firewall is installed with the cards that support GTP and SCTP, use the show chassis inventory CLI command. However, it is possible that cards are installed but are not functional if your firewall does not account for all dependencies. Refer to the PA-7000 Series Firewall Hardware Reference for installation instructions and to review the dependencies for each card.

    PAN-OS Releases by Model that Support Intelligent Security Correlation (PFCP, RADIUS, and GTP)

    The following table lists which firewall models and PAN-OS software versions support Intelligent Security Correlation:
    • Packet Forwarding Control Protocol (PFCP)
    • Remote Authentication Dial-In User Service (RADIUS)
    • General Packet Radio Service (GPRS) Tunnelling Protocol (GTP)
    Firewall Model
    PAN-OS 11.0 (PFCP* and RADIUS**)
    PAN-OS 11.1 (PFCP and RADIUS
    PAN-OS 11.2 (PFCP, RADIUS, and GTP)
    		PAN-OS 12.1 (PFCP, RADIUS, and GTP)
    VM-Series Firewalls
    āˆš
    āˆš
    āˆš
    		āˆš
    CN-Series Firewalls
    āˆš
    āˆš
    āˆš
    		āˆš
    PA-7500 Series Firewalls
    ā€”
    āˆš
    (HA cluster with PAN-OS 11.1.5 for RADIUS only)
    āˆš
    (HA cluster with PAN-OS 11.2.8 for RADIUS only)
    āˆš
    (HA cluster using PAN-OS 12.1.2 for RADIUS only)
    PA-5500 Series ā€”ā€”ā€”
    āˆš
    (HA cluster using PAN-OS 12.1.2 for RADIUS only)
    PA-5410, PA-5420, PA-5430, PA-5440, and PA-5450 Firewalls
    āˆš
    āˆš
    āˆš
    		āˆš
    PA-5445 Firewalls
    ā€”
    āˆš
    āˆš
    		āˆš
    PA-3430 and PA-3440 Firewalls
    āˆš
    āˆš
    āˆš
    		āˆš
    PA-3410 and PA-3420 Firewallsā€”ā€”ā€”āˆš
    PA-1410 and PA-1420 Firewallsā€”ā€”ā€”āˆš
    PA-440, PA-450, PA-450R, PA-450R-5G, and PA-460 Firewallsā€”ā€”ā€”āˆš
    * In PAN-OS 11.0, we support only 4G CUPS architecture for Intelligent Security with PFCP.
    ** We support Intelligent Security with RADIUS in PAN-OS 11.0.2 and all later PAN-OS versions.
    *** To verify that your PA-7000 Series firewall is installed with the cards that support PFCP, RADIUS, and GTP, use the show chassis inventory CLI command. However, it is possible that cards are installed but are not functional if your firewall does not account for all dependencies. Refer to the PA-7000 Series Firewall Hardware Reference for installation instructions and to review the dependencies for each card.

    PAN-OS Releases by Firewall Model that Support 5G Multi-access Edge Computing Security

    The following table lists which firewall models and PAN-OS software versions support 5G multi-access edge computing security:
    Firewall Model
    PAN-OS 11.0
    PAN-OS 11.1
    PAN-OS 11.2
    		PAN-OS 12.1
    VM-Series Firewalls
    āˆš
    āˆš
    āˆš
    		āˆš
    CN-Series Firewalls on Openshift
    āˆš
    āˆš
    āˆš
    		āˆš
    PA-7500 Series Firewalls (Standalone only)
    ā€”
    āˆš
    āˆš
    		āˆš
    PA-5500 Series (Standalone only) ā€”ā€”ā€”āˆš (PAN-OS version 12.1.2 only)
    PA-5410, PA-5420, PA-5430, PA-5440, and PA-5450 Firewalls
    āˆš
    āˆš
    āˆš
    		āˆš
    PA-5445 Firewalls
    ā€”
    āˆš
    āˆš
    		āˆš
    PA-3430 and PA-3440 Firewalls
    āˆš
    āˆš
    āˆš
    		āˆš

    3G, 4G, and 5G Network Identifier Capacity for EDL and Static Entries by Firewall Model

    The following table lists the total capacity for 3G, 4G, and 5G network identifiers by firewall model and by external dynamic list (EDL) or static entry:
    Firewall Model
    Total 3G, 4G, and 5G Network Identifiers Supported by External Dynamic List
    Total 3G, 4G, and 5G Network Identifiers Supported by Static Entries
    PA-558010,000,000200,000
    PA-55709,000,000200,000
    PA-55605,000,000200,000
    PA-55505,000,000200,000
    PA-55404,000,000200,000
    PA-5440
    1,200,000
    100,000
    PA-5430
    720,000
    100,000
    PA-5420
    500,000
    100,000
    PA-5410
    360,000
    60,000
    PA-3440
    250,000
    50,000
    PA-3430
    250,000
    50,000
    PA-3420220,00030,000
    PA-3410140,00030,000
    PA-1420140,00020,000
    PA-141094,50020,000
    PA-46040,00015,000
    PA-450, PA-450R, PA-450R-5G30,00015,000
    PA-44020,00010,000
    VM-700
    300,000
    5,000
    VM-500
    75,000
    1,000
    VM-300
    20,000
    500
    VM-100
    2,000
    200
    VM-Series firewalls that use licenses funded with Software NGFW credits (Tier 3)*
    (11.2 and later)
    1,000,000
    50,000
    VM-Series firewalls that use licenses funded with Software NGFW credits (Tier 4)*
    (11.2 and later)
    1,400,000
    100,000

    3GPP TS References for GTP Security

    3GPP TS references for GTP security on firewalls that support GTP security.
    Protocol3GPP TS3GPP TS Release
    PAN-OS 10.2
    PAN-OS 10.1
    GTPv2-C
    29.274
    Up to 15.2
    GTPv1-C
    29.060
    Up to 15.5.0
    GTP-U
    29.281
    Up to 15.0.0
    ā€”
    43.129
    15.0.0
    ā€”
    23.401
    15.12.0
    PAN-OS 9.1
    GTPv2-C
    29.274
    Up to 15.2
    GTPv1-C
    29.060
    Up to 15.1
    GTP-U
    29.281
    Up to 15.0.0
    PAN-OS 8.1 (only where supported)
    GTPv2-C
    29.274
    Up to 13.4
    GTPv1-C
    29.060
    Up to 13.4
    GTP-U
    29.281
    Up to 13.0

    3GPP TS References for 5G Security

    3GPP Technical Standards references for 5G network slice, 5G subscriber ID, and 5G equipment ID security on firewalls that support GTP security.
    • Procedures for the 5G System (5GS)
    • 5GS Session Management Services
    3GPP TS3GPP TS Release
    PAN-OS 10.2
    PAN-OS 10.1
    23.502
    Up to 15.5.0
    29.502
    Up to 15.4.0

    3GPP TS References for 5G Multi-Edge Security

    5G Multi-Edge Security supports Packet Forwarding Control Protocol (PFCP) messages over N4 interfaces for the following technical specifications in the 3GPP TS release:
    • Interface between the Control Plane and the User Plane nodes
    3GPP Technical Standards reference for 5G Multi-Edge Security on firewalls that support 5G MEC Security:
    3GPP TS3GPP TS Release
    PAN-OS 10.2
    PAN-OS 10.1
    29.244
    Up to 16.5.0

    3GPP TS References for UE-to-IP Address Correlation with PFCP in 4G

    The below table provides the 3GPP Technical Standards reference for firewalls that leverage User Equipment (UE)-to-IP Address Correlation using the Packet Forwarding Control Protocol (PFCP) for 4G network traffic.
    3GPP TS3GPP TS Release
    PAN-OS 11.0
    23.214
    Up to 16.2.0
    29.244
    Up to 16.9.1

    © 2026 Palo Alto Networks, Inc. All rights reserved.