New Features - PAN-OS - 12.2

While inline cloud analysis for Advanced Threat Prevention provides robust command injection protection, it can restrict traffic volume and introduce 100–200 milliseconds of latency—challenging for high-throughput environments. Local Deep Learning for command injection resolves this by running the Palo Alto Networks deep learning model directly on supported NGFWs. This allows you to inspect significantly more inbound traffic locally, delivering verdicts up to 100 times faster than cloud-only analysis.

Local Deep Learning for command injection uses the same proven model that runs in the Advanced Threat Prevention cloud, optimized for on-device execution through new CPU instruction sets and memory-efficient model loading. You configure the feature in the Vulnerability Protection profile under the Inline Cloud Analysis tab—a new Local Deep Learning column lets you enable or disable the feature for the command injection ML model. Local Deep Learning is enabled by default when you enable Inline Cloud Analysis on a new Vulnerability Protection profile, giving you immediate command injection protection without additional configuration.

During operation, the NGFW evaluates suspicious HTTP traffic against the local model and processes benign verdicts instantaneously. If the model identifies a potential command injection exploit, it forwards the traffic to the cloud for a false-positive check and returns the cloud verdict when available. If the cloud is unreachable or times out, the NGFW uses the local model verdict and takes the action you configured—eliminating the fail-open gap where threats could pass uninspected. A new local packet capture option lets you retain forensic evidence for detections made when the cloud is non-responsive.

Content updates deliver the latest command injection models automatically, keeping your on device detection current without manual intervention.

You can now apply a metadata profile to each zone on your NGFW to filter the log fields forwarded to Device Security . When you specify a metadata profile, PAN-OS only forwards log data based on the cloud services enabled on your NGFW . This helps bandwidth-constrained sites, such as remote facilities or OT environments, as they only forward log data required by the cloud services instead of excess logs.

Metadata profiles map log fields to the cloud services that need them. You assign a profile to a zone with a single setting, which replaces the multi-step Log Forwarding Profile configuration previously attached to each firewall policy.

This gives you a simpler way to send the right metadata to Device Security and reduces the volume of data your firewalls push to the cloud at sites where bandwidth is limited. Existing log forwarding configurations continue to work after upgrade, so you can adopt metadata profiles on a zone-by-zone basis.

Previously, in HA Active/Passive pairs with service routes configured for Palo Alto Networks services or DNS servers, it was impossible to renew device certificates on the passive device because the passive device's dataplane functions are down. Starting with this PAN-OS® release, the passive device can have service routes configured and receive certificate updates and renewals through its HA interface connected to the active device. You do not have to configure or change your network security policy to perform this function; the process happens automatically when a certificate is near its expiry date. This allows your HA pair to maintain up to date and secure connections with Palo Alto Networks licenses and services even after a failover event.

You can verify if the passive device has successfully renewed a certificate using the following CLI command:

show device-certificate status 

Note: It's recommended that you enable encryption on the HA link, otherwise you will receive the following system log during the renewal process: HA1 link is used without encryption .

Managing user authentication for the explicit web proxy previously required SAML or Kerberos SSO infrastructure, but you can now use basic authentication to validate proxy users against Local Database, LDAP, RADIUS, TACACS+, Kerberos Pre-Authentication, or an authentication sequence.

When you make a request through the proxy, the firewall issues an HTTP 407 Proxy Authentication Required challenge. The browser prompts the user for a username and password, and the proxy validates the credentials against the configured backend. Successful authentication creates a log entry and allows the request to proceed.

You can customize the authentication realm string displayed in the browser credential prompt. The default realm is Explicit Proxy, but you can change it to identify the protection scope for your users.

To reduce repeated authentication prompts, configure IP Surrogate Minutes to cache an authenticated user's IP address for up to 600 minutes. While the cache entry is valid, subsequent requests from that IP address bypass the authentication challenge. Because the cache is stored in memory, it does not persist when the proxy restarts. Don't use IP surrogate in NAT environments or virtual desktop infrastructure (VDI) deployments where multiple users share a single IP address.

If you switch the authentication service type (for example, between Kerberos SSO and basic authentication), users must clear their browser cache and history for the change to take effect.

You can now monitor the operational health of cellular modems, signal quality, SIM cards, and network interfaces on 5G-integrated Palo Alto Networks® firewalls through your Network Management System using SNMP. By exposing cellular metrics, device health indicators, and operational statistics via SNMP, you can achieve scalable, automated monitoring across distributed 5G-integrated firewalls.

The new PAN-CELLULAR-MIB provides RFC-compliant SNMP access to six data tables: modem hardware state (including firmware version, IMEI, and temperature), signal quality metrics (RSRP, RSRQ, RSSI, and SINR), SIM card status, APN/DNN profile configuration, per-interface network state and operational counters, and subinterface details. Scalar objects return total counts of modems, interfaces, subinterfaces, and APN/DNN profiles. New notification state objects let you poll current alert conditions (signal strength below the FAIR threshold and Packet Session connectivity loss) independently of trap reception.

Two SNMP traps deliver proactive alerting: one fires when signal quality drops below the FAIR threshold and another when an interface loses packet-switched connectivity. Hold-down timers (10 minutes for signal, 90 seconds for PS detach) prevent trap flooding during sustained degraded conditions.

All polled values are consistent with CLI output, and table indexes remain stable across reboots and HA state transitions. You can poll the MIB using SNMP v2c or v3 at intervals as short as 30 seconds.

Load PAN-CELLULAR-MIB.my into your SNMP manager alongside the other Palo Alto Networks SNMP MIBs to begin monitoring your cellular infrastructure. See Supported MIBs for the complete MIB reference and object group details.

Previously, a firewall could receive a credential bloom filter from only one Windows-based User-ID agent running the credential service add-on. In PAN-OS 12.2.2, the data plane supports multiple bloom filters per virtual system, one per connected credential agent. This means you can deploy a separate credential agent on each read-only domain controller (RODC) in a multi-domain or multi-forest environment and connect all of them to the same firewall. Details are available for the changes to installation and configuration.

PAN-OS introduces Subscriber and Equipment objects, giving firewall administrators a readable, reusable way to reference mobile network identities in security policy — similar to how address objects work for IP-based networks.

• Subscribers — Define mobile subscribers by IMSI, IMSI Range, or IMSI Prefix. IMSI ranges now support changes from the 4th through 15th digit (previously limited to digits 11–15), and IMSI prefixes can now be any variable length starting from the 4th digit (previously fixed at 6 digits).

• Subscriber Groups — Group one or more Subscriber objects for use in policy, improving rule readability and reducing repetition.

• Equipment — Define mobile devices by IMEI, IMEI Range, or IMEI Prefix. IMEI ranges now support 6 to 16 digits, and IMEI prefixes can be any variable length from the 6th digit (previously fixed at 8 digits).

• Equipment Groups — Group one or more Equipment objects for use in policy.

Subscribers, Subscriber Groups, Equipment, and Equipment Groups can all be referenced as match criteria in Security policy rules, allowing administrators to write policies using meaningful names instead of raw IMSI or IMEI values.

GTP Security must be enabled through DeviceSetupManagementGeneral Settings to make Subscriber and Equipment objects available.

Supported on all Gen 3–5 hardware platforms, VM-Series, and CN-Series. Not supported on Cloud NGFW or Prisma Access.

You can now enable Dynamic Host Configuration Protocol (DHCP) relay over the cellular interface to forward each device's DHCP request to a centralized DHCP server, so every device receives a unique, routable IP address.

This capability is especially valuable in IoT and operational technology (OT) environments — manufacturing floors, remote industrial sites, and healthcare facilities — where cameras, robotic arms, sensors, and medical devices all share a cellular WAN link.

To use DHCP relay over the cellular interface, you enable a DHCP relay setting directly on the cellular interface. This programs the modem with DHCP relay capability and triggers a modem reboot, which temporarily interrupts cellular traffic. You configure the DHCP relay at the interface level using the standard DHCP relay workflow.

Note: If NAT is configured on the cellular interface, you must disable it so the firewall sends the relay agent's IP as the source address in DHCP Discover packets (which the remote DHCP server requires to assign an IP from the correct address pool). Make sure that you review your network deployments and any dependencies before disabling NAT on the Cellular interface.

DHCP relay over the cellular interface is configurable from the PAN-OS® web interface, the command line, and using Panorama® templates.

When you have Panorama deployed without a public IP address, your SD-WAN devices rely solely on the SD-WAN overlay network for connectivity to Panorama. This creates a single point of failure that can result in significant outages when SD-WAN overlay issues occur. The Dedicated Tunnel to Panorama feature addresses this vulnerability by establishing persistent, dedicated IPSec tunnels from your branch devices to Panorama through designated termination devices using direct internet access (DIA) interfaces.

This feature is valuable in environments where Panorama can’t be exposed over the internet using a public IP address. With dedicated tunnels in place, even if your primary SD-WAN overlay network becomes unavailable, your devices can still reach Panorama to receive configuration updates and troubleshooting commands. This eliminates the need for manual recovery, significantly reducing downtime and operational costs.

You can configure primary and secondary termination devices with preferred and secondary DIA interfaces, ensuring redundant connectivity paths to Panorama. The solution uses a separate VPN address pool for tunnel IP address assignments that must not overlap with existing SD-WAN overlay configurations.

Palo Alto Networks introduces a redesigned transport architecture for cloud-delivered security services that eliminates performance bottlenecks in the Multi Inline Cloud Analysis (MICA) data forwarding channel. This architecture improves inline cloud analysis for Enterprise DLP, Advanced Threat Prevention, Advanced URL Filtering, Advanced WildFire, Prisma AIRS (AI Runtime Security), and ACE (App-ID Cloud Engine) when used alongside SaaS Security Inline, and AI Access Security.

The new architecture removes the fixed-core transport limitation that previously constrained cloud submission throughput regardless of available hardware resources. All data plane cores now natively handle payload forwarding to the cloud through a scalable connection pool. Each connection is established directly from the data plane over TLS, eliminating the intermediate process that previously serialized all cloud submissions through a single core.

The redesigned transport reduces latency by replacing protocol translation layers with a direct binary protocol between the data plane and advanced service addresses. Native PAN-OS memory pools replace the previously fixed-size memory allocation, reducing dedicated memory consumption and increasing overall system capacity. The newly introduced Advanced Forwarding discovery service dynamically assigns advanced service addresses based on your NGFW's location and configuration, improving reliability and enabling automatic failover without manual intervention.

When Advanced Forwarding is enabled, the NGFW establishes TLS connections directly from the data plane to the cloud. To use the legacy transport instead of Advanced Forwarding, you must manually disable Advanced Forwarding. The NGFW does not automatically fall back to the legacy transport method.

Enterprise Data Loss Prevention (E-DLP) supports the inspection of data in transit that is not part of a formal file upload. This non-file traffic inspection helps prevent the exfiltration of sensitive data through collaboration applications, web forms, cloud applications, and social media. However, this non-file traffic inspection is designed for transactional web traffic (HTTP/HTTPS), where the client and server exchange data in discrete, request-response cycles. In contrast, a WebSocket connection provides a persistent, bidirectional data stream over a single connection, allowing for continuous communication without the overhead of individual request-response cycles. While a WebSocket connection can provide better performance for real-time applications, it introduces unique security challenges for preventing data loss. These challenges exist because the persistent nature of the connection allows data to flow continuously rather than in distinct bursts, and can bypass traditional traffic-inspection methods.

To address these challenges, Enterprise DLP has expanded its non-file support to include inspection of WebSocket traffic. This capability allows the detection engine to examine WebSocket persistent streams in real time to identify sensitive patterns previously hidden within the open connection. Enterprise DLP supports WebSocket inspection for the following widely adopted applications that rely heavily on streaming data:

• Microsoft Copilot
• Perplexity

You can enable WebSocket inspection by editing the Enterprise DLP data filtering settings.

When you investigate suspicious web traffic, the absence of HTTP header data can force guesswork — HTTP Header Logging closes this gap by capturing any request or response headers, including custom headers, directly in URL filtering logs.

You configure HTTP Header Logging in a URL filtering profile by selecting which headers to capture. You can add individual request headers, individual response headers, or enable Log all HTTP headers to capture every header. The HTTP response status code is captured in every response log entry. Enable Enable logging of response code in HTTP response to force a response log entry even when response headers are not logged.

When you log both request and response headers, the firewall generates two URL filtering log entries per resource. A URL Index field and a Direction field correlate the pair so you can reconstruct the full exchange.

Use Max Header Length to limit how much data is captured per header value (1–4,092 bytes). The limit applies to the header value only and excludes the header name, colon, and whitespace. Enable Enable truncation of headers that exceed the max header length limit to capture headers up to the limit rather than skipping them entirely.

Request headers can contain personally identifiable information (PII) such as cookies and authorization tokens. A privacy notice appears the first time you enable request header logging — review your data privacy requirements before enabling logging for sensitive headers.

PAN-OS 12.2.2 expands DNS Proxy with complete dual-stack IPv6 support, enabling firewalls to forward DNS requests between clients and servers regardless of whether each side uses IPv4 or IPv6. Previously, only matching IP versions were supported (IPv4-to-IPv4 or IPv6-to-IPv6). Now all combinations work seamlessly. This support includes:

• Mixed IPv4/IPv6 forwarding — DNS Proxy now supports IPv4 clients resolving through IPv6 servers and IPv6 clients resolving through IPv4 servers, across all transport protocols: DNS-over-UDP, DNS-over-TCP, DNS-over-HTTPS (DoH), and DNS-over-TLS (DoT).

• Cross-version server failover — If the Primary DNS server (e.g., IPv4) becomes unreachable, the firewall can now fail over to a Secondary server configured with a different IP version (e.g., IPv6), and vice versa.

• Cross-version encrypted-to-cleartext fallback — When an encrypted DNS attempt (DoT/DoH) fails, the firewall can fall back to cleartext DNS even if the fallback server uses a different IP version than the client.

• Faster TCP failover — The DNS-over-TCP connection timeout has been reduced from a hardcoded 2 minutes to 4 seconds (connection) and 30 seconds (data transfer), significantly improving failover speed to secondary servers.

Note: Interfaces assigned to a DNS Proxy object must have both an IPv4 and an IPv6 address configured if both IPv4 and IPv6 upstream DNS servers are in use.

VM-Series firewalls with at least 32GB of system memory now support up to 100,000 concurrent web proxy sessions, up from the previous limit of 40,000. The firewall dynamically calculates the specific session capacity based on its memory resources.

Use the following command to view the maximum number of web proxy sessions currently supported by your firewall.

 debug secure-web-gateway show-session-count

To resolve issues regarding session caps when using web proxy on virtual platforms, we have expanded the session limit for certain VM flex models by optimizing memory utilization. This enhancement provides improved throughput and reliability for deployments managing large traffic scales. The following are few supported session numbers in VM-Flex 12.2.2:

• Less than 32G memory
  • Undecrypted Sessions - Max 40,000
  • Decrypted Sessions - Max 40,000
• 32G memory
  • Undecrypted Sessions - Max 100,000
  • Decrypted Sessions - Max 70,000
• 64G memory
  • Undecrypted Sessions - Max 100,000
  • Decrypted Sessions - Max 82,500

When you need to consolidate your network infrastructure, the Layer 2 Switching feature on Next-Generation Firewalls allows you to operate your firewall as a fully functional Layer 2 switch. This feature introduces comprehensive switching capabilities directly on the firewall, enabling you to configure access and trunk VLANs per port, deploy Multiple Spanning Tree Protocol (MSTP) for robust loop avoidance, utilize Link Aggregation (LAG), and apply Storm Control to mitigate excess broadcast, unknown unicast, and multicast traffic.

You can leverage this capability primarily to achieve a branch in a box deployment, which is specifically targeted at small to medium-sized network environments such as retail locations, healthcare facilities, and financial branch offices. By merging your traditional standalone switch, router, and firewall into a single appliance, you significantly reduce overall hardware costs and simplify your ongoing network management.

Furthermore, this architecture empowers you to implement micro-segmentation and Zone-Based Forwarding (ZBFW) for lateral traffic, allowing you to secure east-west communication within and across VLAN boundaries.

When the same IP block is reused across sites or virtual systems, Device Security can misidentify devices, mix device behavior across locations, and deliver incorrect Device-ID verdicts to your firewalls — breaking policy enforcement for every affected segment. Multi-vsys support for device identification and Device-ID solves this by letting you define named network segments in PAN-OS and associate each virtual system with a specific segment, so Device Security tracks and delivers device context separately for each logical partition of your network.

Network segments can be configured in Panorama as shared objects and pushed to firewalls through templates, the same way other Panorama -managed features work. Once a virtual system is assigned to a segment, Device Security receives the vsys-to-segment mapping from PAN-OS and generates a unique segment ID for each network segment. That ID travels with every verdict, so Edge delivers device context only to the firewalls that belong to the corresponding segment. For devices in non-overlapping IP space, Restrict Context Sharing gives you control over whether device context learned in one segment is visible to firewalls in other segments, or kept private to the segment where the device was discovered.

If your organization currently uses the Device Security -managed network segment configuration from an earlier release, you can migrate to PAN-OS device security segments through the Device Security portal. After migration, segment definitions are owned entirely by Panorama, and the portal displays them in read-only mode. Devices already learned through existing segments are preserved in your asset inventory — only the management of segment definitions moves to Panorama. Devices in shared IP blocks always receive scoped verdicts regardless of the context sharing setting, preserving isolation between segments that operate on overlapping address space.

Previously, 5G-integrated firewalls were limited to a single APN (access point name) or DNN (data network name) session per interface, forcing all enterprise cellular traffic through one undifferentiated path and preventing network-level traffic segmentation. Beginning with PAN-OS® 12.2.2, you can configure up to eight concurrent APN sessions (4G) or four concurrent DNN sessions (5G) on a single cellular interface, each mapped to a separate subinterface with its own IP context, routing domain, and security policy.

Each additional APN or DNN is provisioned as a cellular subinterface (for example, Cellular1/1.1 through Cellular1/1.7 for SIM 1, or Cellular1/1.8 through Cellular1/1.14 for SIM 2). Subinterfaces maintain independent IP addresses, default gateways, and DNS servers, and can each be assigned to a distinct security zone and virtual router.

APN and DNN profiles are now centrally managed under NetworkNetwork ProfilesCellularAPN/DNN Profile .

To configure multiple APNs or DNNs, see Configure Multiple APNs or DNNs. See the Mobile Network Infrastructure Feature Support compatibility matrix for the list of supported 5G-integrated firewall models and PAN-OS versions.

You can now license Hyperscale Security Fabric (HSF) clusters in air-gapped or internet-restricted environments, eliminating the need for HSF nodes to contact the Customer Support Portal directly during licensing. Previously, HSF licensing required each cluster node to reach the Customer Support Portal to validate and activate its subscription — a workflow that fails in secure data centers, government networks,and private cloud environments where firewall nodes have no outbound internet access.

HSF Offline Licensing routes all license operations through Panorama, which acts as the license distribution point for the entire cluster. You generate a Panorama Air-Gap license file from the Customer Support Portal on any internet-connected machine, upload it to Panorama, and Panorama distributes license credentials to each P-Node and S-Nodeduring bootstrap. The same license file covers both node types — the file procures the correct number of credits from the Customer Support Portal based on the CPU core count of each instance. Each node still receives a unique serial number, and the cluster operates with full security inspection capability from the moment it comes online.

You can use offline licensing to manage the full license lifecycle without exposing your cluster to the internet. This includes license renewals, HSF subscription changes, node deactivation, and credit reclaim. When you modify the number of planned vCPUs per firewall or add subscriptions in the Customer Support Portal, download the updated Panorama Air-Gap file and re-upload it to your existing offline license profile on Panorama to keep all nodes current.

The PA-1500 Series is Palo Alto Networks' next-generation firewall platform designed for organizations that require high-performance security, integrated networking, and simplified branch infrastructure. It introduces a modern hardware architecture with built-in Layer 2 switching and Power over Ethernet (PoE), allowing customers to consolidate security and access switching into a single 1RU appliance.

The PA-1500 Series consists of three models: PA-1510-POE, PA-1520-POE, and PA-1530-POE — each powered by x86 embedded processors. Each platform provides 32 front-panel Ethernet ports with up to 16 PoE-enabled ports supporting IEEE 802.3af/at/bt devices and delivering up to 90W per port. Available PoE power budgets scale from 485W to 724W, enabling support for wireless access points, IP cameras, digital signage, and point-of-sale devices without requiring a separate PoE switch.

Integrated Layer 2 switching capabilities, including VLANs, 802.1X Port-Based Network Access Control (PNAC), and MAC-based authentication, reduce branch infrastructure complexity by eliminating the need for a dedicated access switch in many deployments. Zero Touch Provisioning (ZTP) further streamlines remote deployments, allowing sites to be securely brought online with minimal or no local IT involvement.

The series delivers 20 to 35 Gbps of App-ID™ throughput and 9 to 27 Gbps of Threat Prevention throughput, providing ample performance headroom for distributed enterprise branches.

The PA-3500 Series represents the fifth generation of ML-powered next-generation firewalls within the Strata™ Cybersecurity Portfolio. The PA-3500 Series consists of the PA-3510, PA-3520, PA-3530, and PA-3540 firewalls, and is designed to address growing performance demands at network perimeters, branch offices, and datacenter locations. You can deploy these platforms to secure both North-South and East-West traffic while achieving up to double the threat prevention performance of previous generation models at similar or slightly higher price points.

The PA-3500 Series supports multiple interface types to accommodate diverse network requirements. The PA-3510 and PA-3520 provide eight 1Gbps/2.5Gbps/5Gbps/10Gbps RJ-45 copper ports, eight 1Gbps/10Gbps SFP+ fiber ports, eight 25Gbps SFP28 fiber ports, and two 40/100Gbps QSFP+/QSFP28 ports. The PA-3530 and PA-3540 expand this to include twelve 1Gbps/10Gbps SFP+ ports, eight 25Gbps SFP28 ports, and four 40Gbps/100Gbps QSFP+/QSFP28 ports that support breakout configurations.

The platforms deliver firewall throughput ranging from 20Gbps to 50Gbps for App-ID™ HTTP traffic and threat prevention throughput from 12Gbps to 30Gbps HTTP across the model range. Maximum session capacity scales from 2 million to 6 million concurrent sessions depending on the specific model you deploy. These platforms utilize a custom ASIC architecture, which integrates flow engine functionality with hardware acceleration for IPsec, MACsec, QoS, and SSL operations. All models support front-to-back airflow and include redundant hot-swappable power supplies with both AC and DC options.

You can configure these firewalls for NGFW Clustering to achieve horizontal scaling and redundancy for up to 2 members, while additional members will be available in a future release. The PA-3510 and PA-3520 use dedicated 100Gbps QSFP28 HSCI ports and the PA-3530 and PA-3540 use 100Gbps QSFP28 HSCI ports for inter-cluster communication, eliminating the need for traditional HA1 links. NGFW Clustering provides session synchronization and failover capabilities while maintaining independent control planes on each cluster member.

The PA-3500 Series supports the same PAN-OS® software subscriptions as other next-generation firewall platforms, including Advanced Threat Prevention, Advanced URL Filtering, Advanced WildFire, DNS Security, and Enterprise DLP. You configure and manage these firewalls through the standard web interface, CLI, or Panorama® management platform.

Industrial facilities, transportation infrastructure, and mobile vehicle deployments require network security in environments that exceed the operating specifications of standard firewall appliances. These environments subject the system to temperature extremes, dust, moisture, constant vibration, and fluctuating power systems. Standard firewall appliances designed for climate-controlled data centers and office environments cannot operate reliably under these conditions, leaving critical industrial control systems, manufacturing networks, and mobile assets without adequate security controls. The PA-50R Series addresses these requirements with ruggedized next-generation firewall appliances across extended temperature ranges.

The PA-50R Series consists of the PA-52R-5G, PA-54R-POE, PA-54R-POE-D-5G, and PA-56R-POE-5G. These platforms support PAN-OS® versions 12.2 and onwards. The PA-54R-POE provides twelve 1Gbps RJ45 ports with four of them being power over Ethernet (PoE) ports that support a total PoE budget of 150W, as well astwo fiber 1Gbps SFP ports. The PA-54R-POE-D-5G shares the same ports as the PA-54R-POE and also includes two 5G modems operating in active-active mode with dedicated GPS receivers. The dual modem is well suited for mission critical use cases, such as for maintaining connectivity in financial institutions. The PA-56R-POE-5G offers sixteen RJ-45 ports in a 2 RU form factor with a single 5G modem. Lastly, the PA-52R-5G provides eight RJ-45 ports with a 5G modem. Depending on the model, the PA-50R Series firewalls support installation on a DIN rail, rack, or wall. The hardware is designed from the ground up to be mountable in vehicles, including cars, trucks, trains, and planes.

The PA-54R-POE, PA-54R-POE-D-5G, and PA-56R-POE-5G deliver 2Gbps of App-ID™ throughput and 1Gbps of threat prevention throughput with support for 200,000 concurrent sessions. The PA-52R-5G provides 1Gbps App-ID throughput and 500 Mbps threat prevention throughput with 64,000 concurrent sessions. Power inputs accept 12 to 48 volts DC for PA-52R-5G and 48 to 125 volts DC for stationary installations with dual input support and automatic failover. The PA-54R and PA-56R have options for both 12-48 and 48-25 volts DC.

The cellular interfaces support standard PAN-OS configuration including APN profiles and dual SIM management with active-standby failover on single modem platforms. Zero Touch Provisioning (ZTP) enables automated onboarding over Ethernet interface 1/1 or the cellular interface.

When your enterprise branch loses its wired WAN connection, operations stop — the PA-520-5G eliminates that risk by embedding a 5G Sub-6 GHz cellular modem directly into the compact PA-520 chassis, so you get a built-in backup or primary internet link without adding separate hardware.

The PA-520-5G fits enterprise branch, retail, and managed services environments. It delivers 3.0 Gbps App-ID™ throughput, 1.5 Gbps threat prevention, and 150,000 concurrent sessions while adding integrated 5G connectivity through an embedded Sierra EM9293 modem. Dual nano SIM slots operate in active/standby mode, so you can provision two carriers and enable failover if the primary SIM loses signal.

You decide how to deploy the cellular interface: as a primary WAN link when no wired connection is available, as a standby backup that activates when the primary fails, or as a secondary link running in parallel with wired WAN. The firewall applies the same security policy across traffic profiles regardless of which interface carries it.

Two SFP ports extend your fiber connectivity options, and a built-in fail-to-wire port pair supports inline bypass deployment. Zero Touch Provisioning (ZTP) works over both the cellular and Ethernet interfaces simultaneously, so the firewall can receive its configuration before a wired WAN link is established. You can also upgrade cellular modem firmware over the air, reducing the operational overhead of managing branch deployments at scale.

The PA-5510, PA-5520, and PA-5530 are the latest entries in the Strata™ Cybersecurity Portfolio. These ML-powered devices are designed to secure network perimeters and data center environments as well as protect both North-South and East-West traffic flows. You can use these firewalls to replace existing PA-5400 Series deployments, as they provide approximately two times the threat prevention performance of previous generation models at similar or slightly higher price points. This performance improvement allows you to maintain security effectiveness as your network bandwidth requirements increase without proportional increases in hardware costs.

These platforms deliver threat prevention throughput ranging from 40Gbps on the PA-5510 to 60Gbps on the PA-5530, with App-ID™ performance scaling from 80Gbps to 125Gbps respectively. Each model supports between 8 million and 16 million concurrent sessions, enabling you to handle high-volume traffic environments while maintaining comprehensive security inspection.

All PA-5500 Series models occupy 2 rack units and include dual redundant power supplies in either AC or DC configurations. The appliances provide extensive network interface options, including eight 1Gbps/2.5Gbps/5Gbps/10Gbps copper ports, twelve 1Gbps/10Gbps fiber ports, eight 25Gbps fiber ports, and six 40Gbps/100Gbps fiber ports. Two of the 100Gbps ports support breakout configurations to 4x10Gbps or 4x25Gbps, giving you flexibility in network connectivity. The platforms also include one management port and one logging interface.

You can implement hardware offload capabilities on these platforms to achieve L4 forwarding performance of up to 400Gbps per system. The platforms include hardware acceleration for IPsec VPN with support for up to 100Gbps throughput, MACsec encryption, quality of service functions, and SSL processing. These offload features enable you to deploy encryption and traffic management without significantly impacting overall throughput.

The PA-5510, PA-5520, and PA-5530 support both traditional active-passive high availability configurations and NGFW clustering deployments. In clustering mode, you can deploy up to two nodes, while more nodes will be available in a future release. The platforms include two dedicated 100Gbps high-speed chassis interconnect ports that support connections up to 2 kilometers, enabling you to distribute cluster members across multiple data center locations or buildings.

The systems support zero-touch provisioning for automated deployment and include AI Ops capabilities for operational monitoring. The PA-5510, PA-5520, and PA-5530 have access to the same subscription services available on previous platforms, including Advanced Threat Prevention, Advanced URL Filtering, Advanced WildFire®, DNS Security, Data Loss Prevention, and Prisma Access.

• In the PAN-OS 12.2.2 release, PAN-OS Shield is only supported for protecting GlobalProtect gateway and portal.

To ensure continual protection against critical vulnerabilities and exploits targeting your firewall, Palo Alto Networks introduces PAN-OS Shield, a built-in feature that uses Advanced Threat Prevention (ATP) to provide inline protections.

These vulnerability protection signatures are delivered via a PAN-OS Shield module as part of the standard Applications and Threats Content Package. PAN-OS Shield applies these critical vulnerability updates automatically, independent of PAN-OS release cycles, and requires no NGFW restarts or operational downtime. This automatic security update capability is built into all platforms by default and does not require an active Advanced Threat Prevention license for PAN-OS specific vulnerability protections. Additionally, when malicious traffic is detected, the NGFW executes the action defined within the PAN-OS Shield security policy and its associated vulnerability protection profile. Additionally, the NGFW automatically generates a standard Threat Log detailing the event.

To provide immediate protection out of the box, Palo Alto Networks recommends enabling PAN-OS Shield, which requires a commit, followed by a system reboot. While the base policy name and description of the pre-configured PAN-OS Shield profile cannot be modified, administrators retain the flexibility to handle false positives. If you need to bypass a specific vulnerability signature for your environment, you can navigate to your security profiles and open the built-in PAN-OS Shield Vulnerability Profile to modify its threat exceptions. When adding exceptions, you can easily filter and search specifically for "Palo Alto Networks" signatures associated with the PAN-OS Shield service.

Note: In the rare circumstances that PAN-OS Shield blocks a benign web management session, you can choose to use the PAN-OS CLI or use a bastion machine with access to the console port or manage via interface management profile configured on a dataplane port. Check PAN-OS Shield logs to determine if this is the case and contact Customer Support.

You can now prevent legitimate traffic from being silently dropped when it matches a stale discard session that never ages out. When enabled, the no-refresh-on-discard session setting stops discarded UDP sessions from being refreshed by incoming traffic, allowing them to expire naturally on their discard timeout.

Previously, when the firewall placed a UDP session in a DISCARD state, any subsequent packet matching the same 6-tuple would reset the session timeout, preventing the session from expiring. Because UDP is connectionless and reuses the same source and destination ports, a continuously talking source could keep a discarded session alive indefinitely. Legitimate traffic that later reused the same 6-tuple was silently dropped until the discard session was cleared manually. This behavior caused intermittent and difficult-to-diagnose disruptions across multiple scenarios, including DNS sinkholing with repetitive internal server requests, DHCP and SIP sessions after a tunnel or route goes down, RADIUS authentication requests, and GRE tunnel traffic after security policy changes.

You enable this setting using the CLI command set session no-refresh-on-discard yes . This is an operational setting that is not part of the saved configuration; it persists across reboots and must be set on each firewall independently, including both peers in an HA pair. TCP sessions are not affected because a new TCP connection uses a new source port and therefore a new session, so a stale discard session simply times out on its own.

Proxy ARP and DHCP Relay Overwrite redirect traffic through the firewall for inspection and policy enforcement. For scenarios where devices share the same Layer 2 broadcast domain, they communicate at Layer 2 without passing through a Layer 3 gateway, which means the firewall lacks visibility into or control over that traffic. This lack of visibility creates a security enforcement gap that allows unrestricted lateral movement between devices. This is particularly concerning in flat network environments, such as operational technology (OT) networks, industrial control systems, and manufacturing environments, where devices like programmable logic controllers, sensors, and engineering workstations share a single broadcast domain.

The following two mechanisms address this gap but work differently depending on how devices obtain their IP addresses:

• Proxy ARP (Address Resolution Protocol) is a technique where a network device (usually a router) answers ARP queries on behalf of another device.

• DHCP Relay Overwrite modifies the subnet mask and default gateway values in DHCP responses before the firewall forwards them to clients.

Once traffic passes through the firewall, the full range of security capabilities is available for enforcement, including App-ID™, User-ID™, Device-ID, Threat Prevention, WildFire®, and Device Security.

To implement this feature, configure Proxy ARP on the Layer 3 interface and configure DHCP Relay Overwrite on the DHCP relay interface. After configuration, verify that the traffic is passing through the firewall and matching your security policy rules.

PAN-OS now supports bandwidth as a path quality metric for SD-WAN traffic distribution. You can define bandwidth thresholds and sensitivity levels within SD-WAN Path Quality profiles to ensure links have sufficient capacity before the firewall selects them for application traffic. The firewall evaluates path quality based on jitter, latency, packet loss, and bandwidth, calculating real-time usage across all dataplanes to monitor link capacity.

During session setup, the firewall compares current link usage against your configured thresholds. If a link's usage exceeds the specified threshold, the system disqualifies that path to prevent congestion. By adding bandwidth to the path selection logic, you gain granular control over traffic steering, ensuring applications use links with available capacity while maintaining performance alongside existing jitter, latency, and packet loss parameters.

Security policy cannot inspect or control intra-VLAN traffic when devices on the same VLAN communicate directly at Layer 2. This visibility gap creates a security risk in operational technology (OT) environments that utilize flat network architectures. To redirect intra-VLAN traffic through the firewall and apply granular security rules, use OT Intra-VLAN Microsegmentation. This capability allows you to control device communication within the same broadcast domain by using two integrated mechanisms:

• Proxy ARP — Enables the firewall to respond to ARP requests on behalf of other devices on the VLAN, which forces local traffic to the firewall for inspection.

• DHCP Relay Overwrite — Modifies the subnet mask and default gateway in DHCP messages to assign each client a /32 host mask, ensuring the firewall remains the gateway for all client traffic.

To implement this architecture, configure Proxy ARP on Layer 3 VLAN aggregate interfaces and enable DHCP Relay Overwrite on the DHCP relay agent. You must also enable port isolation on managed switch ports to prevent devices from bypassing the firewall at Layer 2. By transitioning to this microsegmented model, you gain full visibility and can apply consistent security policy to all internal traffic.

Authentication Portal now supports TLSv1.3 to ensure that redirected web traffic complies with modern security standards. TLSv1.3 supports only secure cipher suites and provides faster connection speeds than TLSv1.2. It is also a prerequisite for enabling post-quantum cryptography (PQC) and hybrid-PQC algorithms.

You can apply an SSL/TLS service profile that supports TLSv1.3 or PQC-TLSv1.3 to your Authentication Portal configuration. When a user must be authenticated, the firewall prioritizes TLSv1.3 to secure the redirection to the Authentication Portal. ​​Users benefit from a more seamless and secure authentication experience when this service uses TLSv1.3.

To ensure the ongoing security and compliance of Thales Luna Network (formerly SafeNet) hardware security modules (HSMs), PAN-OS 12.1 ends support for legacy Luna HSM Client versions 5.4.2 and 7.2.0. Upgrading to PAN-OS 12.1.8 or later automatically installs Luna HSM Client 10.9.2. This modern client improves HSM performance and supports the latest Luna HSM features. PAN-OS preserves your existing HSM configuration during the client upgrade.

For more information, see Set Up Connectivity with an HSM.