topic Re: Configuration Table Export csv by api? in Automation/API Discussions

Configuration Table Export csv by api?

ajr0 — Wed, 23 May 2018 15:16:52 GMT

I might be missing it however does anyone know if the configuration table export option [0] is available through the api?

my goal is to obtain this via api if that is an option. after going through the api browser and check export/show command I am not seeing this functionality anywhere.

[0] https://www.paloaltonetworks.com/documentation/81/pan-os/pan-os/firewall-administration/use-the-web-interface/export-configuration-table-data

Re: Configuration Table Export csv by api?

JoeAndreini — Wed, 23 May 2018 19:23:58 GMT

I do not have a direct answer to your question, but in the past (7.1.x, as it did not have an export to csv option) I have obtained the xml from the api and parsed it into a csv with a script - this may be an alternative for you.

Re: Configuration Table Export csv by api?

ajr0 — Thu, 24 May 2018 13:27:15 GMT

that might work, I was not able to satisfactorily use python3.x to convert it correctly, very likely it is my lack of knowledge though which is why I was trying this alternative method. have any literature you can share that may assist?

Re: Configuration Table Export csv by api?

JoeAndreini — Thu, 24 May 2018 15:59:06 GMT

I do not know what you have available in your environment, but I use PowerShell in windows 10 for my API work.

Powershell has a cmdlet Invoke-RestMethod that makes it relatively easy to run the API calls and store the resulting XML in a variable. This is important because Powershell will automatically parse the XML into a collection of collections, so each branch is a property of the branch above, like the x-path, allowing you to use a for loop to iterate throuhg each policy.

I have outlined the steps here https://live.paloaltonetworks.com/t5/General-Topics/Panorama-Security-Rules-Export-in-Human-Readable-Format-Excel/m-p/213293#M62070

once you have your XML as a variable (let's say $config) powershell represents xml as a collection of collections, so each "branch" in the XML is a property of it's parent, so for isntance $config.vsys.entry[0].ruleset.security.entry[1].name is the name of the second (computers count from 0) security policy in the ruleset of your first vsys (even in a single vsys firewall the vsys branch exists) $config.vsys.entry[0].ruleset.security.entry[1].action would be it's action (allow, deny, etc) $config.vsys.entry[0].ruleset.security.entry[100].name would be the 101st rule's name, etc

First, write some "pseudo-code" of what you want to do, the major steps, then you can try to figure out how to do them.

For instance:

for each $rule in $config

{

write $rule.name, $rule.from, $rule.to, $rule.source, $rule.dest, $rule.action to a file (you may have other properties that are valuable to you)

}

A few resources to get you started, if you are interested:

Palo API documentation: https://www.paloaltonetworks.com/documentation/80/pan-os/xml-api

Invoke-RestMethod, to make the API calls and get information from firewall: https://blogs.technet.microsoft.com/heyscriptingguy/2013/10/21/invokerestmethod-for-the-rest-of-us/

ForEach, to loop through items in a collection: https://blogs.technet.microsoft.com/heyscriptingguy/2014/04/28/basics-of-powershell-looping-foreach/

Export-CSV, to create your csv file once you have teh information you want to put in it: https://blogs.technet.microsoft.com/heyscriptingguy/2014/02/04/use-powershell-to-create-csv-file-to-...

Re: Configuration Table Export csv by api?

ajr0 — Thu, 24 May 2018 18:13:03 GMT

this is great info, I am restricted to python3.x at the moment but I will benefit from this.

thanks again!

Re: Configuration Table Export csv by api?

JoeAndreini — Fri, 25 May 2018 12:38:43 GMT

I have parsed xml with python on another project - it was difficult but doable if the format is predictable (the format of these configs is very predictable, thankfully)

Regarding your original query... Most of my sites run 7.1 so I cannot give specific guidance, but maybe there is a CLI version of the csv export that you could pass to the API as an "op" command?

Re: Configuration Table Export csv by api?

btorresgil — Fri, 25 May 2018 17:31:16 GMT

You could do this with Device Framework, which parses the API XML into python dictionaries that you can easily output via CSV. Here is a code example in python3: https://gist.github.com/btorresgil/0fa16f2e67de67e313e2f66f401c7c4b

The outputed fields are in alphabetical order, but you could change the order if you like.

Re: Configuration Table Export csv by api?

ajr0 — Fri, 25 May 2018 19:45:06 GMT

this is great, will spend time wrapping my head around this.

Thank you!

EDIT: after looking at some of this I was not even aware of this library, wow this is really great. Thank you again for sharing!