Changes to Default Behavior

Changes to the default behavior in PAN-OS® 10.0.
The following table details the changes in default behavior upon upgrade to PAN-OS® 10.0. You may also want to review the Upgrade/Downgrade Considerations before upgrading to this release.
Session persistence during rate limiting for GTP and SCTP brute force attack signatures
In PAN-OS 9.1 and earlier, if the number of packets matching the context of the brute force signature for GTP and SCTP (including Diameter-S6a and S1AP) per-message signatures exceeded the threshold and the
, the firewall would deny any further traffic for the session and drop any subsequent packets.
In PAN-OS 10.0.2 and later, the firewall keeps the session open and drops packets on a per-session basis only if they match the brute force signature. For example, if the rate limit configuration is five packets every two seconds, the firewall allows the first four packets; the fifth and any subsequent packets are dropped for the two-second threshold duration.
Packet Buffer Protection
On all firewall models, packet buffer protection based on packet buffer utilization percentage is enabled by default globally and on each zone.
VM-Series Disk Upgrade Restriction
In PAN-OS version 9.0 and higher the recommended minimum disk size for VM-Series firewalls was 60GB, but PAN-OS did not prevent the upgrade if the minimum was not met. PAN-OS version 10.0 disallows upgrade if your VM-Series firewall disk size is less than 60GB.
Access Domain for REST API
Access domains enable administrators to manage access to specific domains on Panorama and on firewalls with multiple virtual systems. Access domain enforcement now extends to the REST API.
PAN-OS and Panorama REST API Enhancements
After you upgrade to PAN-OS version 10.0, the initial REST API access privileges for admin role profiles will default to
. If you downgrade from PAN-OS version 10.0 to 9.1, the admin role profiles will preserve the XML API access privileges, and the preserved XML API access privileges will determine the REST API access privileges.
Authentication policy
Previously, the firewall required traffic decryption before enforcing Authentication policy. Now, the firewall enforces Authentication policy for all encrypted TLS traffic without requiring decryption. To ensure that this change in behavior doesn’t block users from resources they could access prior to this change, we recommend making the following changes:
  • Decrypt all web traffic that matches your Authentication policy so that users must authenticate using Captive Portal.
  • Enable GlobalProtect clients to receive notifications to complete the authentication process.
  • If you do not use GlobalProtect and you do not want to decrypt all web traffic, modify your Authentication policy so that it excludes encrypted traffic.
  • Configure an Authentication Portal Exclude List to exclude background traffic from authentication for approved applications.
NT LAN Manager protocol
Due to the inherent security risks of this legacy protocol, the NT LAN Manager (NTLM) authentication protocol has been removed in this release. We recommend using Kerberos Single Sign-On (SSO) or Security Assertion Markup Language (SAML) for SSO authentication.
User-ID Redistribution for Dedicated Log Collectors
The Dedicated Log Collector no longer supports redistribution for User-ID information in this release. We recommend using the firewall or Panorama to redistribute information.
Collector Groups
The minimum number of Log Collectors required for a Collector Group to be operational is based on the following formula where
equals the total number of Log Collectors in the Collector Group:
For example, if you configure a Collector Group with six Log Collectors, a minimum of four Log Collectors are required for the Collector Group to be operational.
SSL Decryption profile TLS maximum version
In PAN-OS 9.1 and earlier, the default
Max Version
in the SSL Decryption profile’s SSL Protocol Settings was
so that profiles automatically used the newest TLS version without manual reconfiguration.
In PAN-OS 10.0, the default
Max Version
changed to
to prevent any service disruption of mobile applications that enforce certificate pinning.
Context Switch
After you upgrade to PAN-OS 10.0, you must assign a
Device Admin Role
that is pushed to your managed firewalls when configuring a Panorama Admin Role profile to allow Device Group and Template administrators to context switch between the Panorama and firewall web interface.
In PAN-OS 9.1 and earlier, the firewall used the Palo Alto Networks Services service route to send Enhanced Application Logs (EAL logs).
In PAN-OS 10.0 and later versions, the firewall sends EAL logs using the Data Services service route, which uses the management interface by default. Other services, such as Data Loss Prevention (DLP), also use this service route. You can configure any Layer 3 (L3) interface, including the management or dataplane interfaces, for the service route.
If your firewall currently sends EAL logs (for example, if you are using Cortex XDR), the firewall automatically uses the Data Services service route after you upgrade to PAN-OS 10.0. If you want to use a different interface for the service route, you can change the service route to any L3 interface.
If you use a log forwarding card (LFC) with the 7000 series, when you upgrade to PAN-OS 10.0, you must configure the management plane or dataplane interface for the service route because the LFC ports do not support the requirements for the service route. We recommend using the dataplane interface for the Data Services service route.
Log Forwarding
The PA-7000 series firewall utilizing a Log Forward Card does not forward logs to an M-Series appliance in Panorama or Log Collector mode with 10GB network interfaces.
To successfully forward logs from a PA-7000 series firewall utilizing a Log Forwarding Card, a network switch must be present between the PA-7000 series
interfaces of the Log Forwarding Card and the M-Series appliance for the PA-7000 series firewall.
Terminal Server (TS) agent
Previously, to exclude the IP Address and Alternative IP Addresses of a Terminal Server (TS) Agent host from IP address-to-user mappings, you needed to manually enter those IP Addresses in the Exclude list. Now, the firewall automatically excludes these IP Addresses from IP address-to-user mapping.
Previously, if User-ID could not identify a user from the existing mappings, it would send a query for updated user mappings to all User-ID agents, which was useful if there was a longer time interval between updates. Now, the agents send the mapping updates to the firewall or Panorama in real time so there is no need to send the query for new mappings.
Captive Portal (Authentication Portal)
To improve security, the firewall now generates a token parameter for the Authentication Portal URL when the user's web traffic matches an Authentication Policy rule. If you have shared or bookmarked a URL for the Authentication Portal page, after you upgrade to PAN-OS 10.0, update the bookmarked URL by removing the
parameter or disable the token generation using the following CLI command in Configure mode:
set deviceconfig setting captive-portal disable-token yes
, then commit the changes using the
Local Administrator Authentication
If you have a local administrator account that authenticates using a remote authentication server such as a SAML Identity Provider (IdP), you must ensure that the username that the authentication server sends to the firewall or Panorama doesn't contain a domain and is identical to the username in the local administrator account settings on the firewall or Panorama.
SAML Authentication
option for the Identity Provider Certificate in the SAML Identity Provider server profile has been removed in this release. To ensure the integrity of the SAML Responses or Assertions from Identity Provider (IdP), the firewall or Panorama requires an IdP certificate. The firewall or Panorama always validates the signature of the SAML Responses or Assertions against the IdP certificate that you configure.
PA-7000 Series Firewall Memory Limit for the Management Server
As of PAN-OS 10.0.1, the PA-7000 Series firewalls have new CLI commands to enable or disable resource control groups and new CLI commands to set an upper memory limit of 8G on a process (
To enable resource-control groups, use:
debug software resource-control enable
To disable resource-control groups, use:
debug software resource-control disable
To set the memory limit, use:
debug management-server limit-memory enable
To remove the memory limit, use:
debug management-server limit-memory disable
Reboot the firewall to ensure the memory limit change takes effect.
Device Administrator
Non-superuser administrators with all rights enabled can
Review Policies
Review Apps
for downloaded or installed content versions.
SSH Service Profile
In PAN-OS 9.1 and earlier releases, you could generate a new pair of public and private SSH host keys and change other SSH configuration parameters such as the default host key type from the CLI.
In PAN-OS 10.0 and later releases, you must create an SSH service profile (
Certificate Management
SSH Service Profile
) to customize management and HA SSH configurations. You can configure these profiles from the CLI or the firewall or Panorama web interface.

Recommended For You