Focus

VM-Series and Panorama Plugins Release Notes

Features Introduced in SD-WAN Plugin 3.0

Table of Contents

Features Introduced in SD-WAN Plugin 3.0

New features introduced in SD-WAN plugin 3.0 releases.

The SD-WAN Administrator’s Guide 3.0 provides information about how to use the SD-WAN plugin features in this release.

What's New in SD-WAN Plugin 3.0.8
What's New in SD-WAN Plugin 3.0.7
What's New in SD-WAN Plugin 3.0.6
What's New in SD-WAN Plugin 3.0.5
What’s New in SD-WAN Plugin 3.0.4
What’s New in SD-WAN Plugin 3.0.3
What’s New in SD-WAN Plugin 3.0.2
What’s New in SD-WAN Plugin 3.0.1
What’s New in SD-WAN Plugin 3.0.0

What's New in SD-WAN Plugin 3.0.8

New Feature	Description
SD-WAN Plugin Improvements	Earlier to SD-WAN plugin 3.0.8 version, the SD-WAN generated configurations (such as the IKE ID and tunnel names) uses the active firewall's serial number. Therefore, whenever a HA failover occurs, the SD-WAN generated configurations would reset with the active firewall's serial number that results in temporary tunnel flaps. We have improved the SD-WAN plugin 3.0.8 version by using the lower serial number among the HA devices for generating the SD-WAN configurations that remove tunnel flaps. This improvement also introduces the following SD-WAN configuration changes: the IKE key ID is formed with the lower serial number between the HA devices. the SD-WAN generated configurations, such as route table entry in virtual router, tunnel name, IKE gateway name, BGP import rule name, routing profile, BGP peer, and BGP filtering profile will be reset. Tunnel names and corresponding IP address would change as the tunnel names are created from a lower serial number among the two HA devices.
MongoDB HA Synchronization CLI Commands	We have introduced the following mongoDB related HA peer synchronization commands that must be executed only on the active HA peer: debug plugins sd_wan mongo-db sync-db-to-peer—Use this command to synchronize the SD-WAN mongo database from active HA peer with the passive HA peer. You must execute this command in the following cases: when the mongo database of HA peers goes out of synchronization. when you convert the standalone Panorama to a HA Panorama. when the HA synchronization job of the passive HA peer fails with The active DB's is not synchronized with passive's error message. We recommend you to check the status of the operation log by executing debug plugins sd_wan mongo-db sync-status command before executing debug plugins sd_wan mongo-db sync-db-to-peer command. Because, the SD-WAN mongo DB operation log synchronization must be successful before you synchronize the HA peers. debug plugins sd_wan mongo-db sync-status—Use this command to check the synchronization status of the operation log (oplog). This command only checks the operation logs.

New Feature

Description

SD-WAN Plugin Improvements

Earlier to SD-WAN plugin 3.0.8 version, the SD-WAN generated configurations (such as the IKE ID and tunnel names) uses the active firewall's serial number. Therefore, whenever a HA failover occurs, the SD-WAN generated configurations would reset with the active firewall's serial number that results in temporary tunnel flaps.

We have improved the SD-WAN plugin 3.0.8 version by using the lower serial number among the HA devices for generating the SD-WAN configurations that remove tunnel flaps. This improvement also introduces the following SD-WAN configuration changes:

the IKE key ID is formed with the lower serial number between the HA devices.
the SD-WAN generated configurations, such as route table entry in virtual router, tunnel name, IKE gateway name, BGP import rule name, routing profile, BGP peer, and BGP filtering profile will be reset.
Tunnel names and corresponding IP address would change as the tunnel names are created from a lower serial number among the two HA devices.

MongoDB HA Synchronization CLI Commands

We have introduced the following mongoDB related HA peer synchronization commands that must be executed only on the active HA peer:

debug plugins sd_wan mongo-db sync-db-to-peer—Use this command to synchronize the SD-WAN mongo database from active HA peer with the passive HA peer. You must execute this command in the following cases:
- when the mongo database of HA peers goes out of synchronization.
- when you convert the standalone Panorama to a HA Panorama.
- when the HA synchronization job of the passive HA peer fails with The active DB's is not synchronized with passive's error message.
We recommend you to check the status of the operation log by executing debug plugins sd_wan mongo-db sync-status command before executing debug plugins sd_wan mongo-db sync-db-to-peer command. Because, the SD-WAN mongo DB operation log synchronization must be successful before you synchronize the HA peers.
debug plugins sd_wan mongo-db sync-status—Use this command to check the synchronization status of the operation log (oplog). This command only checks the operation logs.

What's New in SD-WAN Plugin 3.0.7

New Feature	Description
Multiple Virtual Routers Support on SD-WAN Hubs	Supports multiple virtual routers on the SD-WAN hubs that enable you to have overlapping IP subnet addresses on branch devices connecting to the same SD-WAN hub. Multiple virtual routers can run multiple instances of routing protocols with a neighboring router with overlapping address spaces configured on different virtual router instances. Multiple virtual router deployments provide the flexibility to maintain multiple virtual routers, which are segregated for each virtual router instance.

New Feature

Description

Multiple Virtual Routers Support on SD-WAN Hubs

Supports multiple virtual routers on the SD-WAN hubs that enable you to have overlapping IP subnet addresses on branch devices connecting to the same SD-WAN hub. Multiple virtual routers can run multiple instances of routing protocols with a neighboring router with overlapping address spaces configured on different virtual router instances. Multiple virtual router deployments provide the flexibility to maintain multiple virtual routers, which are segregated for each virtual router instance.

What's New in SD-WAN Plugin 3.0.6

Key features introduced with the SD-WAN plugin 3.0.6 release:

Bug and performance fixes.

What's New in SD-WAN Plugin 3.0.5

Key features introduced with the SD-WAN plugin 3.0.5 release:

Bug and performance fixes.

What's New in SD-WAN Plugin 3.0.4

Key features introduced with the SD-WAN plugin 3.0.4 release:

Bug and performance fixes.

What’s New in SD-WAN Plugin 3.0.3

Key features introduced with the SD-WAN plugin 3.0.3 release:

Bug and performance fixes.

What’s New in SD-WAN Plugin 3.0.2

Key features introduced with the SD-WAN plugin 3.0.2 release:

Bug and performance fixes.

What’s New in SD-WAN Plugin 3.0.1

Key features introduced with the SD-WAN plugin 3.0.1 release:

New Feature	Description
Copy ToS Header Support	SD-WAN hubs and branches allow you to automatically copy the ToS or Differentiated Services Code Point (DSCP) markings from the inner IPv4 header to the VPN header of packets so that traffic going through the VPN tunnel can preserve that information for QoS.

What’s New in SD-WAN Plugin 3.0.0

Key features introduced with the SD-WAN plugin 3.0.0 release:

New Feature	Description
SD-WAN Plugin Upgrade	Upgrade to the SD-WAN plugin to increase reliability. SD-WAN plugin 3.0 is required to upgrade to PAN-OS 10.2 and is only supported on PAN-OS 10.2 and later releases.

Panorama Plugin for SD-WAN 3.0

Changes to Default Behavior in SD-WAN Plugin 3.0.8