topic REST API and host policies in Automation/API Discussions

REST API and host policies

JasonVonKrueger — Wed, 07 Feb 2018 16:37:14 GMT

We just got our first PA (3060) and I was doing some research on the REST API. What I would like to do is tie in our IP Address Management system for automation. Like when an IP address is freed, a process would connect to the PA and remove that host's entry in any policy it may be in. Or when we stand up a new public webserver, the process would insert that new host into the PA's https policy. Something like that.

I may sound as if I don't know what I'm doing. That's because I don't. 🙂

Thoughts and thanks.

-Roger

Re: REST API and host policies

vvenkatara — Wed, 07 Feb 2018 16:54:37 GMT

Hi Roger,

That seems like a perfectly reasonable workflow! While maybe not addressing your questions directly, I would like to point out some tools that can make the "HOW" easier, once you figure out the "WHAT".

We have developed ansible playbooks to automate a whole slew of tasks on the firewalls. Please take a look at the information I've attached and you might also find examples to suit your use case.

Thanks,

- Vinay

Documentation:

http://panwansible.readthedocs.io/en/master/

Live page (with tutorials):

https://live.paloaltonetworks.com/ansible

Private repo:

https://github.com/PaloAltoNetworks/ansible-pan

Tutorials:

https://www.youtube.com/watch?v=KozIozKhxAo&t=114s

https://www.youtube.com/watch?v=0OnKIcUCKJg

Ansible official:

https://www.ansible.com/integrations/networks/palo-alto

http://docs.ansible.com/ansible/list_of_network_modules.html#pano

Re: REST API and host policies

JasonVonKrueger — Wed, 07 Feb 2018 17:06:44 GMT

Hey Vinay! Thanks for your response. I was hoping for a more REST'ish solution. My co-worker is an Ansible freak and me using Ansible would make him too happy. Can't have that. 🙂

Nonetheless, I'll look at the links you sent. If Ansible is the best way to accomplish what I want, then Ansible it will be.

-Roger