Focus

PAN-OS® Release Notes

GlobalProtect CLI and XML API Changes

Table of Contents

GlobalProtect CLI and XML API Changes

CLI and XML API changes to GlobalProtect™ features in PAN-OS® 8.1.

PAN-OS® 8.1 has the following CLI and XML API changes for GlobalProtect™ features:

Feature	Change
Host information profiles (HIP) for antivirus and anti-spyware	The commands for displaying and configuring antivirus and anti-spyware matching criteria are now consolidated under anti-malware matching criteria: PAN-OS 8.0 and earlier releases: # show `[shared]` profiles hip-objects `<name>` `[antivirus \| anti-spyware]` * # show `[vsys <name>]` profiles hip-objects `<name>` `[antivirus \| anti-spyware]` * # set `[shared]` profiles hip-objects `<name>` `[antivirus \| anti-spyware]` * # set `[vsys <name>]` profiles hip-objects `<name>` `[antivirus \| anti-spyware]` * PAN-OS 8.1 release: # show `[shared]` profiles hip-objects `<name>` anti-malware * # show `[vsys <name>]` profiles hip-objects `<name>` anti-malware * # set `[shared]` profiles hip-objects `<name>` anti-malware * # set `[vsys <name>]` profiles hip-objects `<name>` anti-malware *
Host information profiles (HIP) for disk encryption	The commands for configuring disk encryption matching criteria changed: PAN-OS 8.0 # set `[shared]` profiles hip-objects `<name>` disk-encryption criteria encrypted-locations `<name>` encryption-state `{is \| is-not}` `{full \| none \| not-available \| partial}` # set `[vsys <name>]` profiles hip-objects `<name>` disk-encryption criteria encrypted-locations `<name>` encryption-state `{is \| is-not}` `{full \| none \| not-available \| partial}` PAN-OS 8.1 # set `[shared]` profiles hip-objects `<name>` disk-encryption criteria encrypted-locations `<name>` encryption-state `{is \| is-not}` `{encrypted \| partial \| unencrypted \| unknown}` # set `[vsys <name>]` profiles hip-objects `<name>` disk-encryption criteria encrypted-locations `<name>` encryption-state `{is \| is-not}` `{encrypted \| partial \| unencrypted \| unknown}`
GlobalProtect satellites	Subnet masks were never applicable to GlobalProtect satellite gateways and therefore the option to enter a subnet mask is deprecated in PAN-OS 8.1: PAN-OS 8.0 and earlier releases: # set `[vsys <name>]` global-protect global-protect-portal `<name>` satellite-config configs `<name>` gateways `<name>` ip `[ipv4 \| ipv6]` `<ip/netmask>` PAN-OS 8.1 release: # set `[vsys <name>]` global-protect global-protect-portal `<name>` satellite-config configs `<name>` gateways `<name>` ip `[ipv4 \| ipv6]` `<value>`

Feature

Change

Host information profiles (HIP) for antivirus and anti-spyware

The commands for displaying and configuring antivirus and anti-spyware matching criteria are now consolidated under anti-malware matching criteria:

PAN-OS 8.0 and earlier releases:

# show [shared] profiles hip-objects <name> [antivirus | anti-spyware] *

# show [vsys <name>] profiles hip-objects <name> [antivirus | anti-spyware] *

# set [shared] profiles hip-objects <name> [antivirus | anti-spyware] *

# set [vsys <name>] profiles hip-objects <name> [antivirus | anti-spyware] *

PAN-OS 8.1 release:

# show [shared] profiles hip-objects <name> anti-malware *

# show [vsys <name>] profiles hip-objects <name> anti-malware *

# set [shared] profiles hip-objects <name> anti-malware *

# set [vsys <name>] profiles hip-objects <name> anti-malware *

Host information profiles (HIP) for disk encryption

The commands for configuring disk encryption matching criteria changed:

PAN-OS 8.0

# set [shared] profiles hip-objects <name> disk-encryption criteria 
encrypted-locations <name> encryption-state {is | is-not} {full | none | not-available | partial}

# set [vsys <name>] profiles hip-objects <name> disk-encryption criteria 
encrypted-locations <name> encryption-state {is | is-not} {full | none | not-available | partial}

PAN-OS 8.1

# set [shared] profiles hip-objects <name> disk-encryption criteria 
encrypted-locations <name> encryption-state {is | is-not} {encrypted | partial | unencrypted | unknown}

# set [vsys <name>] profiles hip-objects <name> disk-encryption criteria 
encrypted-locations <name> encryption-state {is | is-not} {encrypted | partial | unencrypted | unknown}

GlobalProtect satellites

Subnet masks were never applicable to GlobalProtect satellite gateways and therefore the option to enter a subnet mask is deprecated in PAN-OS 8.1:

PAN-OS 8.0 and earlier releases:

# set [vsys <name>] global-protect global-protect-portal <name> satellite-config 
configs <name> gateways <name> ip [ipv4 | ipv6] <ip/netmask>

PAN-OS 8.1 release:

# set [vsys <name>] global-protect global-protect-portal <name> satellite-config 
configs <name> gateways <name> ip [ipv4 | ipv6] <value>

Decryption CLI and XML API Changes

Management CLI and XML API Changes

PAN-OS® Release Notes

GlobalProtect CLI and XML API Changes

GlobalProtect CLI and XML API Changes

Recommended For You