topic Re: Paloalto Onprem Firewall PA3250 - Create multiple objects and object-group - using automation in Automation/API Discussions

Paloalto Onprem Firewall PA3250 - Create multiple objects and object-group - using automation

visioner10 — Mon, 30 May 2022 00:35:43 GMT

Hi All, I am newbie here. I am trying to achieve below goal using automation.

Problem statement: We have a frequent need to create at least 50 objects and 20 object-group for support purpose. We are supporting more than 30 Testing groups in our organization. On top of that, We also need to keep updating our Blacklisted IP object-group to add CISA and FBI newletter's malicious IP as part of our compliance.

I need to do this via automation. either using Terraform or RestApi or Azure DevOps CI/CD pipelines. Can you provide me some help with this issue?

#Terraform

#Automation

Re: Paloalto Onprem Firewall PA3250 - Create multiple objects and object-group - using automation

nikoolayy1 — Fri, 02 Sep 2022 14:07:54 GMT

This could be usefull for you as a post how to use terraform and palo alto:

https://maniakacademy.medium.com/code-share-automate-palo-alto-next-generation-firewall-ngfw-using-terraform-d8e6fef32845

Re: Paloalto Onprem Firewall PA3250 - Create multiple objects and object-group - using automation

JimmyHolland — Mon, 12 Sep 2022 11:13:04 GMT

In addition to @nikoolayy1, the Terraform "provider" for PAN-OS is listed in Hashicorp's Terraform registry here: https://registry.terraform.io/providers/PaloAltoNetworks/panos/latest/docs with all the reference documentation. For that many objects, Terraform's "for_each" looping construct could be useful too.

Outside of Terraform, you mentioned the REST API, which is documented on every NGFW/Panorama at https://ngfw-or-panorama-hostname-or-ip-address/restapi-doc/, then use your own preferred language to script or program address object and group creation.

Either Terraform or REST API calls can be called through a pipeline like Azure DevOps.

Finally, consider External Dynamic Lists (EDLs) for your denylisting use case. The pipeline could update an EDL you host internally and then your Panorama/NGFW can point to that list: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/external-dynamic-list

Hope that helps!

Re: Paloalto Onprem Firewall PA3250 - Create multiple objects and object-group - using automation

nikoolayy1 — Thu, 13 Oct 2022 21:25:11 GMT

If you managed to get the needed answers, please flag the question as answered.