topic Re: Can we get master key expiration via API? in Automation/API Discussions

Can we get master key expiration via API?

Steven_Lowry — Wed, 15 Sep 2021 12:25:52 GMT

Hi, I am just starting to explore pan-python and was wondering if there was a way to pull master key details (like expiration date) via the API, whether from Panorama or on an individual firewall?

Re: Can we get master key expiration via API?

JimmyHolland — Wed, 15 Sep 2021 13:01:43 GMT

Hi @Steven_Lowry,

First an FYI, pan-os-python is the successor to pan-python, and is your best resource for your Python work: https://github.com/PaloAltoNetworks/pan-os-python

You can call the API directly, targeting Panorama or an NGFW, to get that device's master key details:

https://{{host}}/api/?key={{key}}&type=op&cmd=<show><system><masterkey-properties/></system></show>

You can also target Panorama to get a managed NGFW's master key details, if you can't or don't want to target the NGFW directly:

https://{{host}}/api/?key={{key}}&type=op&cmd=<show><system><masterkey-properties/></system></show>&target={{ngfw-serial-number}}

Both the API calls above are examples of "op" (operational) commands. Within pan-os-python, op commands can be executed from the base module: https://pan-os-python.readthedocs.io/en/latest/module-base.html#panos.base.PanDevice.op

Hope this helps!

Re: Can we get master key expiration via API?

Steven_Lowry — Wed, 15 Sep 2021 13:11:14 GMT

Wow, this is very helpful, thank you so much I will give this a try 🙂

Re: Can we get master key expiration via API?

Steven_Lowry — Mon, 20 Sep 2021 21:17:55 GMT

Hi @JimmyHolland ,

Indeed I took your advice, read up on pan-os-python and tested a few scripts out. So far so good. I even read up on ElementTree (if only I knew what I was getting myself into before accepting this task lol). I have one question related to this which I was unable to find searching the community.

I can create a bash script to pull the list of devices from Panorama and then loop through that list to pull the master key from each device. However, I will need this all integrated with other scripts eventually so I need to do the same with Python. I was able to get the list of devices in Panorama and loop through them, but in the loop I have to log into each device separately to pass the OP command. I'm sure there's a way to do it directly through Panorama like with the curl command, except I can't seem to figure this out. This is how my code looks

pano = Panorama( {{ip-address}}, {{username}}, {{password}} ) devices = pano.refresh_devices(include_device_groups=False) for device in devices: fw = Firewall( {{ip-address}}, {{username}}, {{password}} ) system_settings = device.find("", SystemSettings) mk = fw.op('show system masterkey-properties') print('%s \t %s' %(system_settings.hostname, mk[0].find('expire-at').text))

I see that both variables 'device' and 'fw' are firewall objects, so I would have thought I could just do mk = device.op('show system masterkey properties') but when I do it spits out the below error. Would anyone have some feedback on this? Thank you.

PanXapiError: hostname argument required