You can now configure policies to reference more user groups. This is useful in environments where access control for each application or service is based on membership in a user group, and where the number of applications, services, and groups is increasing.

The number of distinct user groups that each firewall or Panorama can reference across all policies varies by model:

In this release, you will also find that error alerts for group mapping configurations are improved: the validation process now checks for errors in nested group lists. Nesting in this context describes group lists where individual list entries can also be group lists. The firewall and Panorama can validate group lists that are nested up to ten layers deep.