Using Salt Proxy to edit password in config on Palo Alto firewall PA-220

ThomasEikeland — Wed, 14 Dec 2022 08:42:53 GMT

Hi, I am trying to use Salt to automate a config upload process. The problem is that the salt module for palo alto, called panos, needs access to the firewall on tcp443. "The panos proxy leverages the XML API functionality on the Palo Alto firewall. The Salt proxy must have access to the Palo Alto firewall on HTTPS (tcp/443)." from salt.proxy.panos (saltproject.io)

Is this something I need to allow on the firewall itself? I have tried to find a setting concerning this in the salt setup, but i have not found anything and that suggests to me that it needs to be done on the firewall itself. Keep in mind I know next to nothing about palo alto so i would appreciate that any answers are explained as simple as possible.

Re: Using Salt Proxy to edit password in config on Palo Alto firewall PA-220

BPry — Wed, 14 Dec 2022 17:48:09 GMT

@ThomasEikeland,

Correct. Since it uses the XML API to update things you'll need to actually allow the salt proxy to access the firewall's management interface. This is generally restricted through both security policy, but also through the permitted-ip settings as well.

topic Using Salt Proxy to edit password in config on Palo Alto firewall PA-220 in General Topics

Using Salt Proxy to edit password in config on Palo Alto firewall PA-220

Re: Using Salt Proxy to edit password in config on Palo Alto firewall PA-220