PAN-OS 7.1.5 and later releases
) The firewall has the following changes in how it times out IP address and user mapping information registered using the XML API. Unless you explicitly specify a timeout value in the API request, the firewall inherits the User-ID timeout value configured on the firewall (the
Enable User ID Timeout
Device > User Identification > User Mapping > Cache).
In releases earlier than PAN-OS 7.1.5, when you did not specify a timeout value, the firewall treated the value as 0, which meant that the IP address and user mapping never expired. If you want to preserve the same behavior and ensure that the mapping never expires, you must explicitly set the timeout value to 0 as shown in the following API request:
<entry name="domain\name2" ip="126.96.36.199" timeout="0"/>
Certain PAN-OS XML API configuration requests now return a different API error code to accurately indicate that the object specified by the XPath does not exist. Affected requests include
PAN-OS 7.1 and later releases:
<response code="7" status="success"><msg>Object doesn't exist</msg></response>
PAN-OS 7.0 and earlier releases (action=delete):
<response code="20" status="success"><msg>Object doesn't exist</msg></response>
PAN-OS 7.0 and earlier releases (action=get):
<response code="19" status="success"><msg>Object doesn't exist</msg></response>
On PA-7000 Series firewalls and Panorama, API requests for custom reports no longer support the synchronous (
) option. API requests now provide a job ID, which you can use to retrieve the report. Additionally, API requests for reports (
) are now processed asynchronously by default on all firewall platforms.