GlobalProtect Changes in PAN-OS 8.1

PAN-OS® 8.1 has the following changes in default behavior for GlobalProtect™ features:
Feature
Change
GlobalProtect gateway agent
The Client Settings > Split Tunnel tab has been split into two separate tabs: Access Route and Domain and Application. Use the Access Route tab to include or exclude specific destination IP subnet traffic from the VPN tunnel. Use the Domain and Application tab to include or exclude software as a service (SaaS) or public cloud applications from the VPN tunnel.
You can now add up to 100 DNS suffixes to the GlobalProtect gateway configuration (NetworkGlobalProtectGateways<gateway-config>AgentNetwork ServicesDNS Suffix).
HIP categories
The Antivirus and Anti-Spyware HIP categories are now deprecated and superseded by the Anti-Malware HIP category in PAN-OS® 8.1. The Anti-Malware category enables HIP matching based on both the antivirus and anti-spyware coverage on GlobalProtect endpoints.

Related Documentation