You can now configure the cookie expiration period from 1 to 5 years, while the default remains as 6 months. The encrypted cookie stored on an Large Scale VPN (LSVPN) satellite expires after every 6 months. This causes the VPN tunnels associated with the satellite to go down, causing an outage until the satellite is re-authenticated to the LSVPN portal or gateway and a new cookie is generated. A re-authentication every six months causes administrative overhead, affecting productivity, network stability, and resources of the company.

To reduce administrative overhead, we’ve extended the cookie expiration period from 6 months to 5 years.

One type of source NAT is Dynamic IP and Port (DIPP). Some applications, such as VoIP, video, and others, use DIPP and may require Session Traversal Utilities for NAT (STUN) protocol. DIPP NAT uses symmetric NAT, which may have compatibility issues with STUN. To alleviate those issues, persistent NAT for DIPP provides additional support for connectivity with such applications. When you enable persistent NAT for DIPP, the binding of a private source IP address and port to a specific public (translated) source IP address and port persists for subsequent sessions that arrive having that same original source IP address and port.

The Advanced Routing Engine supports IPv4 multicast on logical routers. This engine supports PIM sparse mode (PIM-SM), PIM source-specific mode (PIM-SSM), and Internet Group Management Protocol (IGMP) on NGFW interfaces. You can also configure static routes over which to reverse-path forward (RPF) from the NGFW to the source. In line with the other routing protocols, multicast routing relies on profiles to parameterize PIM and IGMP. Unlike the legacy routing engine, which supports IGMPv1, the Advanced Routing Engine instead supports IGMP static joins for devices that do not support IGMPv2 or IGMPv3.

When a packet with an IP address matches prefixes in Security policy rules that have overlapping wildcard masks, you can have the firewall choose the first fully matching rule in top-down order (rather than match the rule with the longest prefix in the mask). Thus, more than one rule has the potential to be enforced on different packets.

The number of wildcard address objects supported per virtual system is increased to 5,000 on PA-5220, PA-5250, PA-5260, and PA-5280 firewalls.

PAN-OS 10.2 offers an advanced routing engine that uses an industry-standard configuration methodology to reduce your learning curve. It allows the creation of profile-based filtering lists and conditional route maps, all of which can be used across logical routers. These profiles provide finer granularity to filter routes for each dynamic routing protocol and improve route redistribution across multiple protocols.

The Advanced Routing Engine provides new BGP capabilities:

The Advanced Routing Engine provides new OSPFv3 and OSPFv2 capabilities: