topic Re: Panorama: why can't we edit Application settings in Device Groups? in Panorama Discussions

Panorama: why can't we edit Application settings in Device Groups?

fjwcash — Mon, 27 Jan 2020 22:24:40 GMT

Specifically, why can't we disable the SIP ALG in Panorama, in order to push that out to the firewalls? Even more specifically, why isn't that option available in the Panorama GUI?

It's a real pain having to manually change that on each individual firewall, and commit the change locally, instead of setting it once in a Device Group and having it inherited by all the firewalls.

Panorama 8.1.9-h4 and PanOS 8.1.12 on the firewalls.

Re: Panorama: why can't we edit Application settings in Device Groups?

kiwi — Tue, 28 Jan 2020 08:58:57 GMT

Hi @fjwcash ,

Good catch ... I haven't noticed that before.

I found that there's already a feature request for it.

Please reach out to your local SE and have him add your vote.

FR ID: 4081

Cheers !

-Kiwi.

Re: Panorama: why can't we edit Application settings in Device Groups?

fjwcash — Tue, 28 Jan 2020 17:01:00 GMT

Thanks! I've reached out to cast our vote. Let's see what comes of it. 😄

Re: Panorama: why can't we edit Application settings in Device Groups?

mgmrealj — Thu, 22 Apr 2021 03:49:32 GMT

Oh boy. I'm in need of disabling it on all firewalls this exact moment and just realized you can't do it from Panorama. Why is this even a feature request and not an automatic bug that needed fixing last year?

Re: Panorama: why can't we edit Application settings in Device Groups?

PeterSouthwick — Tue, 21 Sep 2021 15:46:14 GMT

I would like to add, how can this be done in a Prisma environment where Panorama cannot modify it, nor do you have access to the firewalls to see / modify it?

Re: Panorama: why can't we edit Application settings in Device Groups?

LAYER_8 — Tue, 21 Sep 2021 16:46:57 GMT

Is this a CLI-only command to disable SIP-ALG? May I introduce you to Palo's newest automation tool, SLI? Basically you would input a list of your NGFW MGT IPs (or pull them from PRA, see option 2), add username/password to the file, and then a different file would have a list of the CLI commands you wish to run and the tool will sequentially create the SSH access to each device outputting errors/success messages into a file for review after.

Indeed, it's a feature request to get into panorama for now, but I requested our automation team build this workaround for the time being as I had a customer that needed something similar.

SLI Development Branch

This is useful for commands for example, mass_ssh and mass_ssh_from_panorama.

mass_ssh asynchronous executes an inputted script file against multiple firewalls. These firewalls are either given as a list of IP addresses on the command line or given in a YAML inventory file. You can run the sli mass_ssh --help command to see examples of both the inputted script file and the YAML inventory file.

mass_ssh_from_panorama does the same thing except it gathers the NGFW list from a Panorama device. SLI will grab a list of all connected devices for a given Panorama device and then will optionally filter based on an inputted dictionary of key values. You can run the sli mass_ssh_from_panorama --help command to see examples of the input script file and the NGFW filter dictionary.

git clone https://github.com/PaloAltoNetworks/SLI
cd ./sli

python3 -m venv venv

source ./venv/bin/activate

git checkout -b develop origin/develop

pip install -e

Then create your template files, look at examples by typing mass_ssh_from_panorama --help. Hope this makes your life a little easier!