topic Import Existing Security Policies from Panorama to Terraform code (Reverse Terraform for Palo Alto) in Automation/API Discussions

Import Existing Security Policies from Panorama to Terraform code (Reverse Terraform for Palo Alto)

GabrielMontiel — Mon, 21 Nov 2022 00:28:28 GMT

I created a script to reverse Terraform Security Policies from Panorama to be Managed by terraform

Currently only works with Security Policies, i'll be working in the future to work with the rest of the configuration in a panorama.

https://github.com/gabrielmontiel/PanosReverseTerraform

I hope you find this useful, feel free to collaborate on it too!

Re: Import Existing Security Policies from Panorama to Terraform code (Reverse Terraform for Palo Alto)

batd2 — Mon, 21 Nov 2022 10:38:47 GMT

@GabrielMontiel Very good idea. Thank you

Re: Import Existing Security Policies from Panorama to Terraform code (Reverse Terraform for Palo Alto)

JimmyHolland — Mon, 21 Nov 2022 10:43:48 GMT

Thanks @GabrielMontiel.

I see this uses an XML config file; if you have a live device you can also use Terraformer.

Re: Import Existing Security Policies from Panorama to Terraform code (Reverse Terraform for Palo Alto)

GabrielMontiel — Mon, 21 Nov 2022 17:41:12 GMT

Yes i just saw that terraformer had support for the panos terraform provider just recently, there's an issue with it though that the policies can not have a whitespace in the name. i guess its easier to pull request than to build it from scratch

Re: Import Existing Security Policies from Panorama to Terraform code (Reverse Terraform for Palo Alto)

nikoolayy1 — Tue, 21 Feb 2023 06:03:14 GMT

Nice! I still see Panorama as a nice system for monitoring many firewalls that can be used together with Terraform and as Palo Alto allows managing firewalls locally or with Panorama without issues with the Post and Pre rules for me Terraform in some cases can be added without the removal of Panorama, especially if you have many firewalls but maybe if you have small number in different cloud region locations and 1 Panorama is not enough because of the latency then going with Terraform could be answer.

https://registry.terraform.io/providers/PaloAltoNetworks/panos/latest/docs/resources/panorama_security_policy