Save firewall device state from Panorama (API)

brisonjf — Fri, 30 Jul 2021 12:39:49 GMT

I try to backup all the device states of firewalls managed by a Panorama, and to download these device states on the server where the script is run.

When I try to backup using the firewall API itself, it is working (the output file is indeed the device state).

When I try to backup using the Panorama API (with the serial number of the firewall in my command line), the output is an XML file stating that the device state has been created successfully.

I can across an old post describing the very same issue:

https://live.paloaltonetworks.com/t5/automation-api-discussions/export-firewall-device-state-file-through-panorama-using-api/td-p/218101

Are there now some options to achieve this goal? Or are there other automatic options to save all device states at once on a regular basis? I'd like to avoid direct access to firewalls (because of closed firewall ports and/or permissions).

Thank you.

Re: Save firewall device state from Panorama (API)

PersonalPA220 — Wed, 27 Jul 2022 21:16:36 GMT

It can be done but it's rather awkward. The trick is to transform the CLI command to run as an XML request in this format:

CLI: scp export configuration from MyBackup.xml to user@<scphost>:/path

API: https://<firewall>/api/?key=apikey&type=op&cmd=

</backupuser@10.5.4.3:c:/fw-configs/fw1-config.xml></to></device_state_cfg.tgz></from></configuration></export></scp>

There probably exists examples of an uglier, more kludgy syntax than this but you'd have to reference 1970s mainframe manuals to find it. Why can't the command be fit between single tags? Be that as it may, if you are executing the commands against Panorama, you would want to append the "&target=device_serial_number" to the end of the request URL and iterate through the device serial numbers that Panorama manages.

I was warned that my post has been changed because it claims there was invalid HTML in the body. The change isn't obvious to me so I hope what was posted is reasonably close to what I entered.

topic Save firewall device state from Panorama (API) in Automation/API Discussions

Save firewall device state from Panorama (API)

Re: Save firewall device state from Panorama (API)