GlobalProtect CLI and XML API Changes

CLI and XML API changes to GlobalProtect™ features in PAN-OS® 8.1.
PAN-OS® 8.1 has the following CLI and XML API changes for GlobalProtect™ features:
Feature
Change
Host information profiles (HIP) for antivirus and anti-spyware
The commands for displaying and configuring antivirus and anti-spyware matching criteria are now consolidated under anti-malware matching criteria:
  • PAN-OS 8.0 and earlier releases:
    #
    show
    [shared]
    profiles hip-objects
    <name>
    [antivirus | anti-spyware]
    *
    #
    show
    [vsys <name>]
    profiles hip-objects
    <name>
    [antivirus | anti-spyware]
    *
    #
    set
    [shared]
    profiles hip-objects
    <name>
    [antivirus | anti-spyware]
    *
    #
    set
    [vsys <name>]
    profiles hip-objects
    <name>
    [antivirus | anti-spyware]
    *
  • PAN-OS 8.1 release:
    #
    show
    [shared]
    profiles hip-objects
    <name>
    anti-malware *
    #
    show
    [vsys <name>]
    profiles hip-objects
    <name>
    anti-malware *
    #
    set
    [shared]
    profiles hip-objects
    <name>
    anti-malware *
    #
    set
    [vsys <name>]
    profiles hip-objects
    <name>
    anti-malware *
Host information profiles (HIP) for disk encryption
The commands for configuring disk encryption matching criteria changed:
PAN-OS 8.0
#
set
[shared]
profiles hip-objects
<name>
disk-encryption criteria encrypted-locations
<name>
encryption-state
{is | is-not}
{full | none | not-available | partial}
#
set
[vsys <name>]
profiles hip-objects
<name>
disk-encryption criteria encrypted-locations
<name>
encryption-state
{is | is-not}
{full | none | not-available | partial}
PAN-OS 8.1
#
set
[shared]
profiles hip-objects
<name>
disk-encryption criteria encrypted-locations
<name>
encryption-state
{is | is-not}
{encrypted | partial | unencrypted | unknown}
#
set
[vsys <name>]
profiles hip-objects
<name>
disk-encryption criteria encrypted-locations
<name>
encryption-state
{is | is-not}
{encrypted | partial | unencrypted | unknown}
GlobalProtect satellites
Subnet masks were never applicable to GlobalProtect satellite gateways and therefore the option to enter a subnet mask is deprecated in PAN-OS 8.1:
  • PAN-OS 8.0 and earlier releases:
    #
    set
    [vsys <name>]
    global-protect global-protect-portal
    <name>
    satellite-config configs
    <name>
    gateways
    <name>
    ip
    [ipv4 | ipv6]
    <ip/netmask>
  • PAN-OS 8.1 release:
    #
    set
    [vsys <name>]
    global-protect global-protect-portal
    <name>
    satellite-config configs
    <name>
    gateways
    <name>
    ip
    [ipv4 | ipv6]
    <value>

Recommended For You