topic Re: Exporting translations for an IPAM system in General Topics

Exporting translations for an IPAM system

jsilvia — Wed, 03 Nov 2010 19:42:38 GMT

I've been working on automated scripts to export my firewall configurations, gather the NAT translations and reformat the exported data into the XML format used by my IPAM system.

I've managed to automate this on our Check Points by parsing the objects.C file directly from our firewall managers - however, chopping through the PA config isn't quite as trivial - until I took the advance admin class and learned about the nice little command "show running nat-policy"

My ultimate method for making this work would be use SSH with the remote command to hopefully run this command and output the XML ready for transformation.

Can anyone recommend a strategy for remotely executing the command "show running nat-policy" so that I can process it?

Thanks.

Re: Exporting translations for an IPAM system

kbrazil — Wed, 03 Nov 2010 23:56:11 GMT

Hello,

You might consider using the REST API: https://live.paloaltonetworks.com/docs/DOC-1031

With this API you can pull the configuration file in XML output, similar to the "show running nat-policy" command. Then you can parse it and pull out only the parts you would like. This might be easier than creating a script to login and run the command.

Cheers,

Kelly

Re: Exporting translations for an IPAM system

jsilvia — Thu, 04 Nov 2010 20:03:34 GMT

This is definitely a big help - now how do I get more information on building my xpath variable?

xpath=devices/entry/vsys/entry/rulebase/security

As I'm wanting the running NAt policy from vsys FEDMZ, I figure this gets me close:

xpath=devices/entry/FEDMZ/entry/running/nat-policy

or something like this... help!