topic Re: API/CLI - how to access subset of devices by tag assigned to them? in Panorama Discussions

API/CLI - how to access subset of devices by tag assigned to them?

DDmchk — Mon, 01 Nov 2021 09:19:32 GMT

Hi there,
I'm going to use device's tags to have another dimension beside of template/device groups.
I've assigned a tag to subset of devices (using Panorama>Managed devices WebUI), but I'm really lost how I can get access/filter devices by this tag in CLI/API (except WebUI - search/filter them on or when selecting scope to push).
When I'm using Panorama XML API to get all connected devices, I didn't get any mention of the tag in response text.
I've also looked into CLI commands that will show the tag assigned, but found only commands related to traffic tagging, not device tags.
Any idea how to get this done on CLI/API?
P.S. Panorama running PanOS 10.0.7

Re: API/CLI - how to access subset of devices by tag assigned to them?

nikoolayy1 — Thu, 13 Jan 2022 11:25:28 GMT

You may play with shared objects Manage Unused Shared Objects (paloaltonetworks.com)

You may also configure the firewall locally and import it:

How to add a locally managed firewall to panorama management (paloaltonetworks.com)

Still good to note is that better make a template stack with templates that you use on every firewall and then more specific ones specifically for firewalls

Templates and Template Stacks (paloaltonetworks.com)

Device Group Hierarchy (paloaltonetworks.com)

Re: API/CLI - how to access subset of devices by tag assigned to them?

KennySwetnam — Thu, 24 Oct 2024 18:25:53 GMT

This is probably far too late of a response. But I was searching for the same thing and ultimately used the web-mgmt interface debug to find it:

CLI From configure - show mgt-config devices <serial number> vsys vsys1 tag API /api/?type=config&action=get&xpath=/config/mgt-config/devices/entry[@name='<serial_number>']/vsys/entry[@name='vsys1']/tags