Every vendor keeps evolving their products, and from time to time they release a “new revolutionary version.” Marketing always claims it’s a game changer in the industry 🙂
Palo Alto Networks just released PAN-OS 12.1.x (after 12.0.x). Marketing says it’s innovative software with quantum protection and other fancy words. Let’s skip the hype and look at features that actually make daily administration easier. I found a few interesting ones — let’s dig in.
Decryption
Decryption is necessary for visibility, but in practice it often breaks something. One common issue is an incomplete certificate chain on a website. A proper chain should always be RootCA → IntermediateCA → End Certificate. When the end certificate is missing part of the chain, the firewall doesn’t recognize the RootCA and treats the certificate as untrusted. Now, PAN-OS 12 can automatically fetch the missing intermediate certificates — just like browsers do — and complete the chain. This small change can save a lot of troubleshooting time.
Host Compliance Cloud Service
GlobalProtect includes a feature called HIP Checks, which monitors endpoint health: installed patches, disk encryption, endpoint protection, and more. Based on HIP results, you can allow or block access to resources. Until now, if an endpoint was non-compliant, finding out why was painful — you had to dig through logs. With PAN-OS 12, you can view this information directly in a dedicated web portal. Documentation is still thin, but it seems to require Strata Cloud Manager. This visibility makes troubleshooting HIP issues much faster.
DNS Security
DNS protection is critical — I’ve covered it before. PAN-OS has a dedicated DNS Security module that detects malicious dns behavior. Previously, anything identified by DNS Security appeared under Threat Logs only. You couldn’t see raw DNS queries — just the threat events. PAN-OS 12 adds a new DNS Security Logs section. Now you can view both regular DNS queries and threat events, which is valuable from a security and visibility standpoint.
Upgrade Health Check
The new Upgrade Check feature generates a health report before performing an upgrade. It validates multiple aspects — hardware, configuration, dependencies. Each issue includes a description and recommended remediation steps with links to documentation. In short, it helps you avoid surprises during an upgrade and plan remediation in advance.
There are some interesting improvements in PAN-OS 12 that make device maintenance a bit easier. Of course, it’s still early to upgrade production systems — better to wait for a more mature release. But once it stabilizes, it’s definitely worth considering.