Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
04-07-2018
02:00 PM
- last edited on
10-07-2020
08:08 AM
by
BPry
Hi community
In a lot of topics there are discussions and questions about PAN-OS enhancements and missing (not yet implemented) features. So far the PaloAlto Feature Request list isn't available to the public but in a lot of these existing topics feature request IDs (FR ID) are mentionned. Even knowing that PAN-OS is already a feature rich firewall operating system, there is always room for improvement, so I thought it might be helpful for others (and myself) to collect these existing public available FR IDs and summarize them in one topic.
| ID | Description | Additional Information/Workaround | Implemented in |
| 130 | Filter Logs by Adress Groups | - | - |
| 204 | Automatic rollback to last "good" configuration | - | - |
| 241 | SMTP authentication in Email server profile | - | - |
| 339 | Add negate function to all security policy columns | ||
| 776 | increase custom report limit beyound Top 500 | Also in FR ID 1636 and 1693 | - |
| 889 | Mac Address as match criteria in security policy | - | - |
| 913 | Preview response pages directly in the WebUI without having to download them | - | - |
| 919 | Support for ICAP (Internet Content Adaption Protocol) | - | - |
| 986 | Custom Reports for System logs | - | - |
| 1172 | Ignore usergroup from User-ID | - | - |
| 1225 | Participation of PA firewalls in Spannin Tree | - | - |
| 1370 | URL column length limit in Reports | - | - |
| 1696 | Include Interface IP in SNMP MIB | - | - |
| 2153 | Terminal Server Agent for Linux | - | - |
| 2287 | Different ACLs for https, snmp, ... | - | - |
| 2666 | VRRP Support for clusters between PA and other devices | - | - |
| 2924 | Optain Global Protect IP from DHCP Server | - | - |
| 3051 | User Activity Report Enhancement (detailed web-browsing statistics including time spent) | - | - |
| 3060 | DHCPv6 client support | - | - |
| 3495 | Custom reports for system Logs | - | - |
| 3591 | /31 subnetmask support for HA1 link | - | - |
| 4035 | Dedicated Log category for Global Protect | - | - |
| 4443 | Support for USB modems (3G/4G/5G ...) | - | - |
| 4454 | gray out policies with expired schedules | - | - |
| 4507 | Show current interface bandwidth in a dashboard widget and log over time. | - | Not a dashboard widget but throughbut statistics and other device health metrics are implemented in PAN-OS 8.1 |
| 4603 | Concurrent GP VPN session limit per User | - | - |
| 4669 | Generate system log upon schedule end | - | - |
| 4670 | Proactive notification for policies with soon expiring scheduled | - | - |
| 4788 | Block emails based on domains in "to", "cc" or "bcc", also log these in addition to only "to" and reply with smtp 541 when blocked | - | - |
| 4920 | Display SFP, SFP+ and QSFP serial number | - | - |
| 5000 | SCEP Server integrated in the firewall | - | - |
| 5078 | per-IP Traffic shaping | - | - |
| 5357 | Global Protect Agent Uninstall Password | - | - |
| 5612 | Automatically disable and remove policies with expired schedules | - | - |
| 5678 | Log the TLS version of websites and enable reporting about this | - | - |
| 5686 | DHCP Client Class-ID Setting | - | - |
| 5844 | BGP SNMP monitorings | - | - |
| 6186 | Log and report search keywords | - | - |
| 6548 | Customizable SMTP Response for Vulnerability Protection | - | - |
| 6609 | Add "Threat Email" to email subject when something malicious was detected and also log "cc" and "bcc" | - | - |
| 7365 | DHCPv6 Server support | - | - |
| 7654 | Support of DIPP with non-strict recognition by devices (Cisco ASA like) | - | - |
| 7832 | User-ID for Azure-AD authenticated users | - | - |
| 9113 | Integrated addressobjects for well-known cloud services | - | - |
| 9195 | OCSP stapling support for inbound decryption | - | - |
| 9285 | Custom configrable MFA integration | - | - |
| 9509 | DoH (DNS over HTTPS)/DoT (DNS over TLS) Support for DNS Sinkhole Feature | - | - |
| 9522 | App-ID for DoH (DNS over HTTPS) / DoT (DNS over TLS) | Custom App-ID for DoH | - |
| 9563 | Configurable Time when Global Protect Captive Portal Notification should be shown | Captive Portal Notification Delay | GlobalProtect 4.1 |
| 9958 | Azure Information Protection (AIP) Tag support for Data Filtering | Release Notes Content Version 8129 | PAN-OS 8.0 starting with Content Update 8129 |
| 10173 | Automatically open browser when Global Protects a Captive Portal and opens a configurable website | Automatically Launch Webpage in Default Browser Upon Captive Portal Detection | Global Protect 5.0.4 starting with Content Update 8181 |
| 10931 | use logd disk space (33%) for elasric search in Panorama | Panorama disk space allocation | - |
| 11012 | Windows Server 2019 Support for User-ID Agent | - | User-ID Agent/PAN-OS 9.0.2 |
| 11153 | Completely remove Global Protect 4.0 Design out of Global Protect 5+ | - | - |
| 11211 | Forced Global Protect network rediscover after IP change | - | - |
| 11251 | Panorama High Availability: MFA using SAML (Okta) | - | - |
| 11524 | Use FIB for route monitoring instead of gateway of the route itself | - | - |
| 11763 | Include the username in the csv with the URL logs when running a user activity report | Download thelogs directly from the URL logs | - |
| 11764 | Allow for more "User Activity Report" customization - pie charts, different bar charts, color, tables, etc. | - | - |
| 11765 | WebUI Color/Theme changes (Dark mode) | already possible with some browser extensions (or maybe even directly in the browser) by modifying the css | - |
| 12264 | Reporting based on HIP match failures, specially which failed items | - | - |
| 12783 | Log E-Mail links forwarded to Wildfire | - | - |
| 13046 | Support gMSA accounts for User-IP-Mappings | - | - |
| 13414 | Negate source User | - | - |
| 15246 | Import/Export ACC and Dashboard Widgets. | - | - |
So far I found a few and I'll try to update this topic regularly. If you also know about existing requests, please write them here.
Regards,
Remo
08-10-2018 05:51 AM
I have one FR ID: 7832: User-ID needs to support Azure AD authenicated users. I have no idea what the status is, other than the SE stating it is a "highly requested feature" Saidly, they do not seem to be in much of a hurry as this was requested in January. I would like to see something more like Uservoice. Let people vote on items and then service can comment and commit to them based on their rating. I see a lot of providers using this service now.
08-10-2018 06:27 AM
Thanks @jharlow, FR ID 7832 is also added to the list.
Regarding the implementation status: New features are normally added in new major and some also in minor releases (so in x.0 and x.1 releases). This process takes a lot of time even for "highly requested" features. Maybe you are lucky and this one will make it into PAN-OS 9.0.
(Some of the FR IDs on the list are already there for more than 4 years)
09-06-2018 12:01 PM
@Remo wrote:Added FR ID 9522 - App-ID for DoH (DNS over HTTPS) / DoT (DNS over TLS)
Workaround/Custom App-ID is available here: https://live.paloaltonetworks.com/t5/Custom-Signatures/Custom-App-ID-for-DNS-over-https/td-p/229784/
09-10-2018 07:34 AM
Added FR ID 9958 - Azure Information Protection (AIP) Tag support for Data Filtering
10-12-2018 12:10 PM
Added FR ID 9563 - Configurable Time when Global Protect Captive Portal Notification should be shown
Added FR ID 10173 - Automatically open browser when Global Protects a Captive Portal and opens a configurable website
10-30-2018 05:27 AM
@Aiace wrote:Add FR#241 SMTP authentication in Email server profile.
Thanks.
Thanks for the input. FR ID 241 added to the list.
11-12-2018 10:19 PM
FR Name: Display SFP, SFP+ and QSFP serial number
FR ID: 4920
11-13-2018 06:47 AM
Is there a FR for GP where you have split-tunneling disabled yet, users are able to access local home network?
11-13-2018 09:40 AM
@Brandon_Wertz wrote:Is there a FR for GP where you have split-tunneling disabled yet, users are able to access local home network?
You want to route everything into the tunnel (0.0.0.0/0) but the local connected network should still be reachable? If I understand this correctly, this is already possible because the directly connected network has a higher priority than the default route propagated by GP (at least this is the case with windows)
11-13-2018 09:48 AM
@Netrun wrote:FR Name: Display SFP, SFP+ and QSFP serial number
FR ID: 4920
Added this one to the list, thanks.
12-04-2018 09:48 AM
2287 - Not sure the name in PA:s systems. But it is to have a more flexible loopbackfilter (at the moment, you cant have different subnets in the acl for snmp and https for example)
03-07-2019 11:24 AM
Updated FR ID 9563 (Configurable Time when Global Protect Captive Portal Notification should be shown). It is implemented in Global Protect 4.1 but requires at least Content Update 8118-5277 on the firewall to configure it. More Information you can find here: Captive Portal Notification Delay
03-09-2019 08:58 AM
@Remo wrote:Added FR ID 9958 - Azure Information Protection (AIP) Tag support for Data Filtering
Support was added in PAN-OS 8.0 starting with content update version 8129.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
