PAN-OS 10.2 uses TLS version 1.3 to encrypt the service certificate and handshake messages between Panorama, managed firewalls, and Dedicated Log Collectors. As a result, the App-ID traffic between Panorama, managed firewalls, and Dedicated Log Collectors is reclassified from

panorama

to

ssl

.

As a result, a Security policy rule is required to allow the

ssl

application. This allows Panorama, managed firewalls, and Dedicated Log Collectors to continue communication after successful upgrade to PAN-OS 10.2.

Usernames that contain all numbers are no longer valid. For example, the username

12345678

does not work.

Usernames that include at least one alphabetical or legal symbol character are valid, such as

1234_567

,

1234a789_

, and

c7897432

.

With PAN-OS 10.2 all instances of masterd in the CLI were replaced with MD.

For multi-vsys firewalls managed by a Panorama managed server, configuration objects in the Shared device group are now pushed to a Panorama Shared configuration context for all virtual systems rather than duplicating the shared configuration to each virtual system to reduce the operational burden of scaling configurations for multi-vsys firewalls.

As a result, you must delete or rename any locally configured firewall

Shared

object that has an identical name to an object in the

Panorama Shared

configuration. Otherwise, configuration pushes from Panorama fail after the upgrade and display the error

<object-name> is already in use

.

The following configurations cannot be added to the Shared Panorama location and are replicated to the Panorama location of each vsys of a multi-vsys firewall.

On upgrade to PAN-OS 10.2, it is required that all certificates meet the following minimum requirements:

See the PAN-OS Administrator's Guide or Panorama Administrator's Guide for more information on regenerating or re-importing your certificates.

With Advanced Routing enabled, by default connected peers prefer a link-local next-hop address over a global next-hop address.

On a firewall with Advanced Routing enabled, BFD session establishment for iBGP peers is changed. Any iBGP peers over a loopback address are not considered to be directly connected and therefore should enable the multihop option in the BFD profile and specify Minimum Rx TTL accordingly.

Pushing selective configuration changes to Prisma Access in Panorama Managed Prisma Access deployments is no longer supported.

To push selective configuration changes to Prisma Access:

Scheduled log exports (

Device

Log Export

) may not export logs as scheduled if multiple logs are scheduled to export at the same time.

Workaround:

When scheduling your log exports, maintain at least 6 hours between each scheduled log export.

To test the SCP server connection when you schedule a configuration export (

Panorama

Schedule Config Export

) or log export (

Device

Scheduled Log Export

), a new pop-up window is displayed requiring you to enter the SCP server clear text

Password

and

Confirm Password

to test the SCP server connection and enable the secure transfer of data.

You must also enter the clear text SCP server

Password

and

Confirm Password

when you test the SCP server connection from the firewall or Panorama CLI.