Networking Features

What new Networking features are in PAN-OS 10.2?
New Networking Feature
IPv4 Multicast for Advanced Routing Engine
PAN-OS 10.2.2 and later 10.2 releases
The Advanced Routing Engine supports IPv4 multicast on logical routers. This engine supports PIM sparse mode (PIM-SM), PIM source-specific mode (PIM-SSM), and Internet Group Management Protocol (IGMP) on NGFW interfaces. You can also configure static routes over which to reverse-path forward (RPF) from the NGFW to the source. In line with the other routing protocols, multicast routing relies on profiles to parameterize PIM and IGMP. Unlike the legacy routing engine, which supports IGMPv1, the Advanced Routing Engine instead supports IGMP static joins for devices that do not support IGMPv2 or IGMPv3.
Security Policy Rule Top-Down Order When Wildcard Masks Overlap
PAN-OS 10.2.1 and later 10.2 releases
When a packet with an IP address matches prefixes in Security policy rules that have overlapping wildcard masks, you can have the firewall choose the first fully matching rule in top-down order (rather than match the rule with the longest prefix in the mask). Thus, more than one rule has the potential to be enforced on different packets.
Increase in Wildcard Address Objects
PAN-OS 10.2.1 and later 10.2 releases
The number of wildcard address objects supported per virtual system is increased to 5,000 on PA-5220, PA-5250, PA-5260, and PA-5280 firewalls.
Advanced Routing Engine
PAN-OS 10.2 offers an advanced routing engine that uses an industry-standard configuration methodology to reduce your learning curve. It allows the creation of profile-based filtering lists and conditional route maps, all of which can be used across logical routers. These profiles provide finer granularity to filter routes for each dynamic routing protocol and improve route redistribution across multiple protocols.
If you have an existing firewall configuration that uses the legacy routing engine, the migration of that deployment to the advanced routing engine is not supported in this release. (A new firewall deployment has no configuration to migrate; therefore, such migration is not supported.)
This release does not support IPv4 multicast.
New BGP Capabilities
The Advanced Routing Engine provides new BGP capabilities:
  • Suppress/unsuppress map
  • BGP backdoor
  • Fast failover
  • Advanced filtering
  • Replace AS, allow AS, and no-prepend support for import rules
  • Increased character limit to 64 in the AS Path regular expression field for BGP Export rule
  • Enhanced community support
  • Ability to select Exact in conditional advertising
  • Conditional advertisements based on learned routes
  • More granular filter on the prefix match in export/import rules
  • Redistribution of multiple BGP prefix communities per import/export policy
  • Ability to select exact, shortest, and longest match for redistributed routes
  • Ability to re-order route redistribution profiles
  • Support for BGP graceful shutdown
New OSPFv3 and OSPFv2 Capabilities
The Advanced Routing Engine provides new OSPFv3 and OSPFv2 capabilities:
  • Granular administrative distance
  • Advanced inter-area filtering to limit what is imported to and exported from an OSPF area
  • Redistribution using a route map
  • New action on range command to substitute a route
  • Redistribute only default route from OSPF to RIP
  • MTU-ignore for OSPF interfaces
HA Cluster Behavior Change for Modular System
On an HA cluster standalone firewall node that is chassis based (such as a PA-5450 or PA-7000 Series firewall), if you restart a slot or power a slot on or off, the change in status does not trigger a failover; the firewall remains functional after it restarts or you power it on.

Recommended For You