topic Re: Feature Request List in General Topics

Feature Request List

Remo — Wed, 07 Oct 2020 15:08:29 GMT

Hi community

In a lot of topics there are discussions and questions about PAN-OS enhancements and missing (not yet implemented) features. So far the PaloAlto Feature Request list isn't available to the public but in a lot of these existing topics feature request IDs (FR ID) are mentionned. Even knowing that PAN-OS is already a feature rich firewall operating system, there is always room for improvement, so I thought it might be helpful for others (and myself) to collect these existing public available FR IDs and summarize them in one topic.

ID	Description	Additional Information/Workaround	Implemented in
130	Filter Logs by Adress Groups	-	-
204	Automatic rollback to last "good" configuration	-	-
241	SMTP authentication in Email server profile	-	-
339	Add negate function to all security policy columns
776	increase custom report limit beyound Top 500	Also in FR ID 1636 and 1693	-
889	Mac Address as match criteria in security policy	-	-
913	Preview response pages directly in the WebUI without having to download them	-	-
919	Support for ICAP (Internet Content Adaption Protocol)	-	-
986	Custom Reports for System logs	-	-
1172	Ignore usergroup from User-ID	-	-
1225	Participation of PA firewalls in Spannin Tree	-	-
1370	URL column length limit in Reports	-	-
1696	Include Interface IP in SNMP MIB	-	-
2153	Terminal Server Agent for Linux	-	-
2287	Different ACLs for https, snmp, ...	-	-
2666	VRRP Support for clusters between PA and other devices	-	-
2924	Optain Global Protect IP from DHCP Server	-	-
3051	User Activity Report Enhancement (detailed web-browsing statistics including time spent)	-	-
3060	DHCPv6 client support	-	-
3495	Custom reports for system Logs	-	-
3591	/31 subnetmask support for HA1 link	-	-
4035	Dedicated Log category for Global Protect	-	-
4443	Support for USB modems (3G/4G/5G ...)	-	-
4454	gray out policies with expired schedules	-	-
4507	Show current interface bandwidth in a dashboard widget and log over time.	-	Not a dashboard widget but throughbut statistics and other device health metrics are implemented in PAN-OS 8.1
4603	Concurrent GP VPN session limit per User	-	-
4669	Generate system log upon schedule end	-	-
4670	Proactive notification for policies with soon expiring scheduled	-	-
4788	Block emails based on domains in "to", "cc" or "bcc", also log these in addition to only "to" and reply with smtp 541 when blocked	-	-
4920	Display SFP, SFP+ and QSFP serial number	-	-
5000	SCEP Server integrated in the firewall	-	-
5078	per-IP Traffic shaping	-	-
5357	Global Protect Agent Uninstall Password	-	-
5612	Automatically disable and remove policies with expired schedules	-	-
5678	Log the TLS version of websites and enable reporting about this	-	-
5686	DHCP Client Class-ID Setting	-	-
5844	BGP SNMP monitorings	-	-
6186	Log and report search keywords	-	-
6548	Customizable SMTP Response for Vulnerability Protection	-	-
6609	Add "Threat Email" to email subject when something malicious was detected and also log "cc" and "bcc"	-	-
7365	DHCPv6 Server support	-	-
7654	Support of DIPP with non-strict recognition by devices (Cisco ASA like)	-	-
7832	User-ID for Azure-AD authenticated users	-	-
9113	Integrated addressobjects for well-known cloud services	-	-
9195	OCSP stapling support for inbound decryption	-	-
9285	Custom configrable MFA integration	-	-
9509	DoH (DNS over HTTPS)/DoT (DNS over TLS) Support for DNS Sinkhole Feature	-	-
9522	App-ID for DoH (DNS over HTTPS) / DoT (DNS over TLS)	Custom App-ID for DoH	-
9563	Configurable Time when Global Protect Captive Portal Notification should be shown	Captive Portal Notification Delay	GlobalProtect 4.1
9958	Azure Information Protection (AIP) Tag support for Data Filtering	Release Notes Content Version 8129	PAN-OS 8.0 starting with Content Update 8129
10173	Automatically open browser when Global Protects a Captive Portal and opens a configurable website	Automatically Launch Webpage in Default Browser Upon Captive Portal Detection	Global Protect 5.0.4 starting with Content Update 8181
10931	use logd disk space (33%) for elasric search in Panorama	Panorama disk space allocation	-
11012	Windows Server 2019 Support for User-ID Agent	-	User-ID Agent/PAN-OS 9.0.2
11153	Completely remove Global Protect 4.0 Design out of Global Protect 5+	-	-
11211	Forced Global Protect network rediscover after IP change	-	-
11251	Panorama High Availability: MFA using SAML (Okta)	-	-
11524	Use FIB for route monitoring instead of gateway of the route itself	-	-
11763	Include the username in the csv with the URL logs when running a user activity report	Download thelogs directly from the URL logs	-
11764	Allow for more "User Activity Report" customization - pie charts, different bar charts, color, tables, etc.	-	-
11765	WebUI Color/Theme changes (Dark mode)	already possible with some browser extensions (or maybe even directly in the browser) by modifying the css	-
12264	Reporting based on HIP match failures, specially which failed items	-	-
12783	Log E-Mail links forwarded to Wildfire	-	-
13046	Support gMSA accounts for User-IP-Mappings	-	-
13414	Negate source User	-	-
15246	Import/Export ACC and Dashboard Widgets.	-	-

So far I found a few and I'll try to update this topic regularly. If you also know about existing requests, please write them here.

Regards,

Remo

Re: Feature Request List

OtakarKlier — Tue, 10 Apr 2018 21:46:00 GMT

Hello @Remo,

I agree, it would be nice if PAN made them public so we could vote on them?

Cheers!

Re: Feature Request List

BPry — Wed, 11 Apr 2018 13:47:05 GMT

@OtakarKlier,

From what I've seen from my SE, it appears to be a pretty clunky system; likely one of the reasons that Palo has chosen to keep it away form the public.

Re: Feature Request List

Remo — Wed, 11 Apr 2018 19:18:50 GMT

I think there are also other and probably even financial reasons why this list isn't public. This list completely public may cause wrong expectations as there is absolutely no guearantee that anything on that list will be implemented. And even when PaloAlto decides to implement a feature from that list - the first time this information becomes public is when a new PAN-OS is released. So even when you created a feature request you won't be notified when the decision is made for the implementation. And the financial reason might be something that it could prevent new deals because customers see that list, pick some IDs and then decides to wait for buying that product until this feature is included.

Yes, personally it would be cool to see that list but not really more. And from a conpany view I am sure this list will never be public.

With this post I simply tried to summarize the information that already made it to the public.

Re: Feature Request List

Remo — Thu, 31 May 2018 06:31:15 GMT

Addes FR ID 9195 - OCSP stapling support for inbound decryption

Re: Feature Request List

Remo — Thu, 31 May 2018 09:38:44 GMT

Addes FR ID 9285 - Custom configurable MFA integration

Re: Feature Request List

Remo — Wed, 25 Jul 2018 17:08:18 GMT

Added FR ID 986 - Custom Reports for System logs

Added FR ID 9113 - Integrated addressobjects for well-known cloud services

Re: Feature Request List

Brandon_Wertz — Thu, 26 Jul 2018 14:58:10 GMT

@Remo

@Remo wrote:
Added FR ID 986 - Custom Reports for System logs
Added FR ID 9113 - Integrated addressobjects for well-known cloud services

I'll be adding my company to these FRs. Especially considering support for global protect pretty much hinges on System logs.

Re: Feature Request List

Remo — Thu, 26 Jul 2018 15:24:50 GMT

@Brandon_Wertz

For 986 I will also add at least 5 companies 😉

The only reason I haven't done this since I know about this FR is that I was thinking about placing a new FR for a completely new Global Protect log category. What do you think?

Re: Feature Request List

Brandon_Wertz — Thu, 26 Jul 2018 19:12:40 GMT

I woudl agree 100%. Maybe even a ACC dashboard item?

Re: Feature Request List

Remo — Thu, 26 Jul 2018 20:11:33 GMT

@Brandon_Wertz wrote:
I woudl agree 100%. Maybe even a ACC dashboard item?

Exactly. Once global protect logs are in their own category, I think PaloAlto has a lot more flexibility to do whatever with these logs: ACC, Custom Reports, dedicated menuentries in the monitor tab, correlation events, ...

Re: Feature Request List

Remo — Sat, 04 Aug 2018 08:47:37 GMT

Added FR ID 2153 - Terminal Server Agent for Linux

Added FR ID 4035 - Dedicated Log category for Global Protect

Added FR ID 9509 - DoH (DNS over HTTPS)/DoT (DNS over TLS) Support for DNS Sinkhole Feature

Re: Feature Request List

Remo — Sat, 04 Aug 2018 08:50:34 GMT

Added FR ID 9522 - App-ID for DoH (DNS over HTTPS) / DoT (DNS over TLS)

Re: Feature Request List

jsalmans — Sun, 05 Aug 2018 19:44:52 GMT

We opened one at some point for DIPP NAT options some time ago:

FR ID: 7654

Requesting support of DIPP with non-strict recognition by devices.

This was basically to request features to allow DIPP NAT to be used more like the ASA's implementation of PAT (best effor port usage and sticky NAT).

Re: Feature Request List

Remo — Mon, 06 Aug 2018 20:08:40 GMT

@jsalmans wrote:
We opened one at some point for DIPP NAT options some time ago:

FR ID: 7654
Requesting support of DIPP with non-strict recognition by devices.

This was basically to request features to allow DIPP NAT to be used more like the ASA's implementation of PAT (best effor port usage and sticky NAT).

Thanks, FR ID 7654 is added to the list

Re: Feature Request List

jharlow — Fri, 10 Aug 2018 12:51:22 GMT

I have one FR ID: 7832: User-ID needs to support Azure AD authenicated users. I have no idea what the status is, other than the SE stating it is a "highly requested feature" Saidly, they do not seem to be in much of a hurry as this was requested in January. I would like to see something more like Uservoice. Let people vote on items and then service can comment and commit to them based on their rating. I see a lot of providers using this service now.

Re: Feature Request List

Remo — Fri, 10 Aug 2018 13:27:17 GMT

Thanks @jharlow, FR ID 7832 is also added to the list.

Regarding the implementation status: New features are normally added in new major and some also in minor releases (so in x.0 and x.1 releases). This process takes a lot of time even for "highly requested" features. Maybe you are lucky and this one will make it into PAN-OS 9.0.

(Some of the FR IDs on the list are already there for more than 4 years)

Re: Feature Request List

Remo — Thu, 06 Sep 2018 19:01:24 GMT

@Remo wrote:
Added FR ID 9522 - App-ID for DoH (DNS over HTTPS) / DoT (DNS over TLS)

Workaround/Custom App-ID is available here: https://live.paloaltonetworks.com/t5/Custom-Signatures/Custom-App-ID-for-DNS-over-https/td-p/229784/

Re: Feature Request List

Remo — Mon, 10 Sep 2018 14:34:39 GMT

Added FR ID 9958 - Azure Information Protection (AIP) Tag support for Data Filtering

Re: Feature Request List

Remo — Fri, 12 Oct 2018 19:10:04 GMT

Added FR ID 9563 - Configurable Time when Global Protect Captive Portal Notification should be shown

Added FR ID 10173 - Automatically open browser when Global Protects a Captive Portal and opens a configurable website