We have changed the default IKE protocol version support from IKEv1 to IKEv2.

After upgrading to 12.1, you must change the default maintenance password using the following CLI commands:

Generate the <passwd-hash>: request password-hash password <password>

Update the maintenance password: set deviceconfig system maintenance-user password-hash <passwd-hash>

The firewall serial number is no longer valid for maintenance use.

In 12.1.2, the OpenConfig 2.1.4 plugin will be bundled with the PAN-OS release. If you upgrade to 12.1.2, the plugin will only be reinstalled automatically if you had manually installed it in the previous release. For security reasons, if you had autoinstalled in the prior release, the plugin will not be installed.

A minimum of 8GB of memory is required to upgrade to PAN-OS version 12.1.2 from any prior PAN-OS version. If you are upgrading to PAN-OS 12.1.2 with memory configurations of 8GB-14GB, then the session capacity reduces.

Starting with PAN-OS 12.1.2, the maximum number of supported sessions has been reduced.

For Flex Licenses:

For Fixed Licenses:

Starting in PAN-OS 12.1.2, the VM Panorama requires a minimum 224GB disk. Before upgrading to 12.1.2, you must perform a disk migration to 224GB.

A new prompt for confirmation is displayed when a saved config is loaded.

This new prompt was added to avoid losing uncommitted changes in case of system/process restart. We recommend that you commit pending changes both before and after partial config load operations.

Until PAN-OS 11.2, the firewall successfully decrypted SSL Forward Proxy sessions where a client and server negotiated a TLSv1.3 connection using only the P-192 curve.

Starting in PAN-OS 12.1.2, these sessions will fail,because the firewall will no longer be able to decrypt this specific use of P-192 with TLSv1.3. This will result in a session failure for clients that exclusively use this weak configuration.

Workaround: S​​et TLSv1.2 as the maximum supported TLS version in the decryption profile. Apply the profile to the decryption policy rules that handle traffic from clients to servers that only negotiate the P-192 curve.

show system resources process names get truncated at 8 characters compared to 10 characters in earlier releases. The change was due to a kernel upgrade in PAN-OS 12.1.2.

Starting in PAN-OS 12.1.8, firewalls running in FIPS-CC mode exclusively advertise rsa-sha2-512 for RSA host key authentication on the management SSH server. The previously supported ssh-rsa and rsa-sha2-256 algorithms are no longer permitted in FIPS-CC mode. This change is not applicable to normal (non-FIPS-CC) operation mode.

This restriction is required to comply with the collaborative Protection Profile for Network Devices Version 4.0 (NDcPPv4.0e).

SSH clients that do not support rsa-sha2-512 (OpenSSH older than 7.2 or SecureCRT older than 9.0) will fail to connect to a firewall running PAN-OS 12.1.8 or later in FIPS-CC mode using default RSA host keys.

Workaround: Configure the default SSH host key for management SSH to an ECDSA key type and commit. ECDSA-based host key authentication is not restricted by this change.