topic Re: Is it possible to send a cli command via ssh to Panorama ? in General Topics

Is it possible to send a cli command via ssh to Panorama ?

gongya — Thu, 14 Mar 2024 03:01:02 GMT

I sent cli commands to a remote devices via ssh on many different vendors. Can I do this on Palo Alto? or only way to automate PAN firewalls is via API ?

thanks !!

Re: Is it possible to send a cli command via ssh to Panorama ?

gongya — Thu, 14 Mar 2024 04:10:43 GMT

I found this:
Palo doesn't have full bash CLI that is why Plink is not working

Re: Is it possible to send a cli command via ssh to Panorama ?

W_Rafalski — Thu, 14 Mar 2024 07:46:22 GMT

PAN has it's own semantics, like a Cisco. Language you use in CLI is a kind of abstraction layer above unix shell. Depending on your case, you can use many possibilities. PAN has it's own terraform providers for example.

Re: Is it possible to send a cli command via ssh to Panorama ?

gongya — Thu, 14 Mar 2024 15:03:31 GMT

thanks !!

Re: Is it possible to send a cli command via ssh to Panorama ?

BPry — Thu, 14 Mar 2024 17:28:07 GMT

@gongya,

Any particular reason why you don't want to use the API? Everything else is simply an abstraction from the API itself, and personally I recommend keeping abstraction layers as limited as possible when you're automating something. If you really want to utilize SSH netmiko will handle this well enough with some slight adjustments.

A really simple way to interact with the device from an automation standpoint would be to utilize pan-os-python assuming you're utilizing Python. This is again just an abstraction to the API, but it allows you to send commands the same way that you would through the CLI (additionally the API allows you to do the exact same thing).

Re: Is it possible to send a cli command via ssh to Panorama ?

gongya — Thu, 14 Mar 2024 19:26:46 GMT

The major reason is I do not want to embed password in the script. Also cli output is easy for me to parse.
I like to use ssh or putty for only connection and get the output. All the rest I will handle in python or perl.
I did customize the putty code to even hide the password from ps command.
What I did is writing a wrap in c and compile it into binary with the password in it, and only leave the binary in the server. it then is called in python or perl.

thanks !!