If you use
Panorama to manage multiple firewalls, Palo Alto Networks strongly
recommends upgrading all firewalls in your Device-ID deployment
to PAN-OS 10.0 or a later version. If you create a rule that uses
Device
as
a match criteria and Panorama pushes the rule to a firewall that
uses PAN-OS 9.1 or an earlier version, the firewall omits the
Device
match
criteria because it is not supported, which may cause issues with
policy rule traffic matching.