>
    Strata Copilot
    Changes to Default Behavior in PAN-OS 11.0
    Focus
    Download PDF
    Focus
    1. Home
    2. PAN-OS
    3. PAN-OS Release Notes
    4. Changes to Default Behavior
    5. Changes to Default Behavior in PAN-OS 11.0
    Download PDF

    Changes to Default Behavior in PAN-OS 11.0

    Table of Contents
    End-of-Life (EoL)

    Changes to Default Behavior in PAN-OS 11.0

    What default behavior changes impact PAN-OS 11.0?
    The following table details the changes in default behavior upon upgrade to PAN-OS® 11.0. You may also want to review the Upgrade/Downgrade Considerations before upgrading to this release.
    FeatureChange
    Authentication Override
    This change in behavior applies only if you have set the Authentication Override Cookie Lifetime value higher than the Tunnel Login Lifetime.
    On PAN-OS versions 11.0 through 11.0.6, the Authentication Override Cookie Lifetime can exceed the Tunnel Login Lifetime value.
    On PAN-OS versions 11.0.7 and later 11.0.x versions, the Authentication Override Cookie Lifetime cannot exceed the Tunnel Login Lifetime value. Even if you set the authentication override cookie lifetime to be higher, it will remain valid only for the duration of the tunnel login lifetime. This change further strengthens the security of the authentication override cookie by preventing its use after the tunnel login lifetime expires.
    Minimum System Memory Requirement for the Panorama Virtual Appliance
    Palo Alto Networks has increased the recommended Panorama virtual appliance memory requirement to a minimum of 64GB, up from 32GB. This impacts Panorama virtual appliances in Panorama and Log Collector mode to avoid any logging, management, and operational performance issues related to an under-provisioned Panorama virtual appliance.
    For new Panorama virtual appliance deployments, Palo Alto Networks recommends deploying the virtual machine with a minimum of 64GB. For existing Panroama virtual appliance deployments, See Increase the CPUs and Memory of the Panorama Virtual Appliance to increase the memory for an existing Panorama virtual appliance after successful upgrade to PAN-OS 11.0.
    Custom Syslog Format
    The maximum characters supported for a custom syslog format (DeviceServer ProfilesSyslog and PanoramaServer ProfilesSyslog) is increased to 4,096 characters.
    Panorama Memory Management
    Rather than automatically restarting the Panorama management server, a critical system log (MonitorLogsSystem) is now generated to alert that a Panorama reboot (PanoramaSetupOperations) is required when the configd process responsible for configuration management and Panorama operations encounters memory issues
    Test SCP Server Connection
    To test the SCP server connection when you schedule a configuration export (PanoramaSchedule Config Export) or log export (DeviceScheduled Log Export), a new pop-up window is displayed requiring you to enter the SCP server clear textPassword and Confirm Password to test the SCP server connection and enable the secure transfer of data.
    You must also enter the clear text SCP server Password and Confirm Password when you test the SCP server connection from the firewall or Panorama CLI.
    admin>test scp-server-connection initiate <ip> username <username> password <clear-text-password>
    Addition of the Validate option for image upload in Panorama
    (Panorama 11.0 and later releases)
    		The Upload Only to Device (Do Not Install) option has been removed from PanoramaDevice Deployment Device Deployment Software. This functionality is now replaced by the Validate option, which allows you to upload the image to the device without automatically triggering the installation process.
    Panorama Management of Multi-Vsys Firewalls
    Upgrade to PAN-OS 11.0 using Skip Software Version Upgrade only
    For multi-vsys firewalls managed by a Panorama managed server, configuration objects in the Shared device group are now pushed to a Panorama Shared configuration context for all virtual systems rather than duplicating the shared configuration to each virtual system to reduce the operational burden of scaling configurations for multi-vsys firewalls.
    As a result, you must delete or rename any locally configured firewall Shared object that has an identical name to an object in the Panorama Shared configuration. Otherwise, configuration pushes from Panorama fail after the upgrade and display the error <object-name> is already in use.
    The following configurations cannot be added to the Shared Panorama location and are replicated to the Panorama location of each vsys of a multi-vsys firewall.
    • Pre and Post Rules
    • External Dynamic Lists (EDL)
    • Security Profile Groups
    • HIP objects and profiles
    • Custom objects
    • Decryption profiles
    • SD-WAN Link Management Profiles
    Palo Alto Networks recommends that if a multi-vsys firewall is managed by Panorama, then all vsys configurations should be managed by Panorama.
    This helps avoid commit failures on the managed multi-vsys firewall and allows you to take advantage of optimized shared object pushes from Panorama.

    © 2025 Palo Alto Networks, Inc. All rights reserved.