On PAN-OS versions 10.2 through 10.2.13, the Authentication Override Cookie Lifetime can exceed the Tunnel Login Lifetime value.

On PAN-OS versions 10.2.14 and later 10.2.x versions, the Authentication Override Cookie Lifetime cannot exceed the Tunnel Login Lifetime value. Even if you set the authentication override cookie lifetime to be higher, it will remain valid only for the duration of the tunnel login lifetime. This change further strengthens the security of the authentication override cookie by preventing its use after the tunnel login lifetime expires.

Panorama can manage a firewall running a higher version of PAN-OS within the same release train. For example, a Panorama appliance running PAN-OS 10.2.7 can manage a firewall running PAN-OS 10.2.8 or later 10.2 releases, but it cannot manage a firewall running 11.0 or higher versions.

Panorama does not support any new features, optimizations, or platforms introduced in the later versions of PAN-OS or installed plugins. For information on new features, see the PAN-OS or Plugin Release Notes, and see the Compatibility Matrix for version compatibility.

It is a best practice that Panorama runs the same or a later PAN-OS version than the firewall it is managing.

After successful upgrade to PAN-OS 10.2.4 with Panorama plugin for Enterprise DLP 3.0.4 or later release installed, the default File Direction for predefined data filtering profiles (ObjectsDLPData Filtering Profiles) is Both.

In PAN-OS 9.1 and earlier versions, if you configured client certificate authentication, the firewall applied the policy rule using the domain of the certificate.

In PAN-OS 10.2 and later versions, if you configure both SAML authentication and client certificate authentication, the firewall applies the policy rule using the SAML domain.

If you do not configure the SAML domain when using both SAML and client certificate authentication, the firewall may not be able to authenticate users successfully.

If the SAML username differs from the certificate username, delete the username from the client certificate profile and commit the changes; otherwise, authentication is not successful.

Domain Fronting Detection is a feature that was released in PAN-OS 10.2 that enabled detection of a TLS evasion technique that can circumvent URL filtering database solutions and facilitate data exfiltration, contained in HTTP request payloads using HTTP/1.x and HTTP/2 protocols. Due to excessive false-positives generated by this detection when inspecting HTTP/2 requests, the firewall no longer generates threat logs alerts for HTTP/2 requests in PAN-OS 10.2.9-h8 and later PAN-OS 10.2.9 releases and PAN-OS 10.2.11 and later.

You can configure a Collector Group with two Log Collectors. When one Log Collector goes down, the Collector Group still remains operational.

The 2.0.2 version of the OpenConfig plugin is automatically installed to enable on-demand telemetry streaming. When telemetry is enabled on the device, OpenConfig establishes a connection to AIOps for NGFW. Upon successful plugin initialization, the __openconfig user becomes visible in administrative sessions, and all telemetry traffic is routed through the OpenConfig plugin.

The automated commit recovery feature default iteration and timeout values have changed. The default iteration value has changed from 1 to 5 seconds, and the timeout value has changed from 10 to 30 seconds.