Management Features

Learn about the new management features introduced in PAN-OS 9.0.
New Management FeatureDescription
Cortex Data Lake Logging for Firewalls without Panorama
Palo Alto Networks Cortex Data Lake provides cloud-based, centralized log storage and aggregation for firewalls and services. With Cortex Data Lake, Palo Alto Networks takes care of the ongoing maintenance and monitoring of your logging infrastructure so that you can focus on your business.
Until PAN-OS 9.0.2, Panorama was required to onboard firewalls to Cortex Data Lake and to view logs stored in Cortex Data Lake. Now, with PAN-OS 9.0.2 and later releases, you can enable non-Panorama managed firewalls to securely connect and send logs to Cortex Data Lake.
PA-220 and PA-800 Series firewalls do not support Cortex Data Lake logging without Panorama—for these firewalls, continue to use Panorama to enable Cortex Data Lake logging.
Enforcement of Description, Tag and Audit Comment
As your team creates and modifies rules, the rationale for creating or modifying rules are lost over time. To capture the reason for rule creation and modification, you can now require a description, tag, or audit comment to maintain rule revision history for auditing. For example, if you are creating a new app-based security policy rule to replace a port-based rule, enforce these rule creation elements to ensure that the rule is appropriately grouped, and that the administrator describes the purpose of the rule.
Rule Changes Archive
When you create or modify policy rules, you now have revision history to audit changes. To track and analyze how your policy rules have evolved over time, you can review the audit comment history and see differences between two rule versions. Combined with the new Enforcement of Rule Description, Tag and Audit Comment (see above), you can enforce audit comments with every rule creation and modification to ensure that the audit comment history is maintained for your policy rulebases.
Tag Based Rule Groups
Visually group related rules using a new group tag to efficiently manage large sets of related rules within any policy rulebase. You can use any tag as a group tag to organize related rules so that you can easily move, clone, or delete the rules in the selected group. This allows you to visually see the organizational changes that are happening to your rulebase, and increase the efficiency of managing large sets of rules.
Policy Match and Connectivity Tests from the Web Interface
Validate policy configuration changes of one or more firewalls directly from the web interface to ensure network traffic matches the policy rules as expected. In addition to validating policy, you can also test that firewalls can reach network resources. With the ability to run test commands on the web interface, you can avoid over-provisioning administrator roles with CLI access while still giving administrators a way to determine firewalls are configured correctly.
Rule Usage Filtering
When auditing your rulebase, you can now filter and quickly identify unused rules to manage policy rules. Removing unused rules improves your security posture by reducing the proliferation of rules. For example, when transitioning from port-based rules to App-ID based rules, this information enables you to assess whether your App-ID based rules are matched instead of your port-based rules so that you can remove the unused rules.
Objects Capacity Improvements on the PA-5220 and the PA-3200 Series Firewalls
To help you scale your deployment and ease the migration to Palo Alto Networks firewalls, the PA-5220 and the PA-3200 Series firewalls have increased capacities for several objects, including increases in the number of address objects, address groups, service groups, service objects, zones, and policy rules.
API Key Lifetime
If you are using the firewall or Panorama APIs to enable programmatic access, you can now specify the API key lifetime to match the automation task duration and control the validity period for an authenticated and secure connection between the firewall/Panorama and the automation program or service. Because each API call requires the API key, using a key with a limited lifetime allows you to enforce key rotation at a regular cadence to safeguard your network and adhere to compliance standards. You can also expire all API keys simultaneously, if you suspect accidental exposure or a leak.
PAN-OS REST API for a Simplified Automation/Integration Experience
In addition to the existing XML API, the firewalls and Panorama now support a REST API for a more simplified API integration. With the REST API, the firewall is represented as a set of resources with URIs on which you can perform operations that allow you to easily map firewall tasks to the API interface. For example, Security policy is represented as a REST resource with URI /restapi/9.0/Policies/SecurityRules and has a list of operations that includes list, create, edit, delete, move, and rename. The REST API provides the flexibility to use JSON and XML data formats in API requests and responses, and supports versioning for backward compatibility with future PAN-OS releases. The initial release of this API allows you to manage the configuration of policies and objects on the firewall and Panorama and provides reference documentation that is built in to the product.
Universally Unique Identifiers for Policy Rules
To simplify auditing, searching, reporting, and tracking for configuration changes to rules, universally unique identifiers (UUIDs) are created for all policy rulebases that you create on the firewall or push from Panorama. If you rename or delete the rule, the UUID ensures that the rule’s history of changes is maintained. The UUID can pinpoint the rule across multiple rulebases containing thousands of rules that may have similar or identical names, and simplifies automation and integration for rules into third-party systems (such as ticketing or orchestration) that do not support names.
Temporary Master Key Expiration Extension
You can now extend the lifetime of the master key directly from the firewall or from Panorama until your next available maintenance window. If the master key is due to expire before your planned maintenance window, the key extension allows the firewall to remain operational and continue securing your network.
Real-Time Enforcement and Expanded Capacities for Dynamic Address Groups
To enforce security policy for entities such as IoT devices, virtual workloads, and containers that have bursts of traffic or short lifecycles, the firewalls can now update the list of registered IP addresses within a dynamic address group in real time. This enhancement enables the firewall to register IP addresses that match the tags you have defined in dynamic address groups and instantly apply policy as soon as the endpoint is online, and then unregister the IP addresses automatically based on a time limit that you configure. And to make it easier for you to monitor and troubleshoot these registered IP addresses, Panorama and the firewall now include a new IP-Tag log. Lastly, to handle a larger volume of entities, select firewall models now have up to five-times more capacity for registered IP addresses.

Related Documentation