topic Re: Script to automate the baseline configuration after initial palo alto deployment in General Topics

Script to automate the baseline configuration after initial palo alto deployment

SPG — Thu, 30 Dec 2021 14:25:40 GMT

Hello Guys,

I have prepared the "SET" commands which configure the baseline settings. I can able to run the full set command from CLI. I would like to know any options where I can run these command from a Linux machine where the system take the commands from the local script and loginto the palo alto and execute the commands.

Also need to print the output of each set of command like " executed password policy successfully" or Failed to executed password policy with the output comments"

No knowledge in python or any scripting language so need to make it simple and would like to know this process is possible ?

eg: Commands

set mgt-config password-complexity enabled yes
set mgt-config password-complexity minimum-length 12
set mgt-config password-complexity minimum-uppercase-letters 1
set mgt-config password-complexity minimum-lowercase-letters 1

set deviceconfig setting management idle-timeout 10
set deviceconfig setting management admin-lockout failed-attempts 5
set deviceconfig setting management admin-lockout lockout-time 5
set deviceconfig system snmp-setting access-setting version v3

Re: Script to automate the baseline configuration after initial palo alto deployment

OtakarKlier — Thu, 30 Dec 2021 15:49:16 GMT

Hello,

I'm not the best scripting guy, however have you heard of Palo Alto's Zero Touch Provisioning?

https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-firewalls/set-up-zero-touch-provisioning

Regards,

Re: Script to automate the baseline configuration after initial palo alto deployment

LAYER_8 — Thu, 30 Dec 2021 16:54:57 GMT

I'll do you one better. Pull our docker container to run IronSkillet (get it, hardened PANs?)

You are able to directly edit the config, add variables, among many other things (including generating set commands from a current config).

Re: Script to automate the baseline configuration after initial palo alto deployment

OtakarKlier — Thu, 30 Dec 2021 19:13:27 GMT

Hello,

Here is a zero day config to base things off of ;)...

https://live.paloaltonetworks.com/t5/general-articles/secure-day-one-configuration-not-for-the-faint-of-heart/ta-p/435501

Regards,

Re: Script to automate the baseline configuration after initial palo alto deployment

BPry — Thu, 30 Dec 2021 20:04:17 GMT

@SPG,

IronSkillet and zero day configurations are all a great option. I would personally really recommend that you look into learning some sort of scripting language for use in situations like this. Whether you choose to utilize Python, PowerShell, simple Bash scripts, or anything of the sort is up to you, but it's an invaluable tool to have in your toolbox.

What you're looking to do is pretty simple from a scripting aspect and easily done. It would actually be a great starter script to assist you in learning how to make basic scripts. While I'm personally impartial to Python and think that's a better scripting language to focus on from a network/security aspect, any scripting language can handle what you're looking to do.

Re: Script to automate the baseline configuration after initial palo alto deployment

SPG — Sun, 02 Jan 2022 07:30:29 GMT

Hello @BPry ,

Thanks for the advice and agree on learning some scripting language . Let me try the IronSkillet