topic Re: Manage policies using CLI from a computer in General Topics

Manage policies using CLI from a computer

LCMember4427 — Fri, 26 Sep 2014 09:12:28 GMT

Hi,

We need to programmatically toggle our PA500's GUI setting "Policies / Captive Portal / My_CP_Policy / Action" between "no-captive-portal" and "web-form" from a windows server.

I assume that this is possible using CLI remotely, but where can I find documentation how to setup everything for a task like this?

Thanks a lot for help on this

regards Tor

Re: Manage policies using CLI from a computer

reaper — Fri, 26 Sep 2014 09:38:47 GMT

Hi Tor

you could accomplish this with an API or an expect script, but would you mind elaborating on why you need to toggle the setting for a single policy, maybe there's a different way to achieve what you need

Finding API Commands

Re: Manage policies using CLI from a computer

LCMember4427 — Fri, 26 Sep 2014 10:04:19 GMT

This is for a high school environment. We switch on user auth for network access when some classes are having tests or exams. Memberships in certain AD user groups govern the network access (intranet only, LMS site on internet etc) according to policies.

However I don't want to bug my users with the CP login dialog unless some class is really needing to restrict access. That's why I need to switch the CP policy action between web form and none.

Re: Manage policies using CLI from a computer

torm — Fri, 26 Sep 2014 12:26:33 GMT

If you're just going to do it manually from the CLI, you can just go to configure mode and use the following command "set rulebase captive-portal rules MY_CP_Policy action no-captive-portal" (command will vary a bit if you have enabled vsys on your device).

Then trigger a commit.

If you are going to use the API, you could easily find the restapi url using the API-browser at https://firewallIIP/api

It will be somehting like this: /api/?type=config&action=set&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/captive-portal/rules/entry[@name='MY_CP_Policy']/action/member[@name='no-captive-portal']

Re: Manage policies using CLI from a computer

hshah — Fri, 26 Sep 2014 14:49:35 GMT

Hello IKT,

Please refer bellow CLI guide, it has all required configuration command.

https://live.paloaltonetworks.com/docs/DOC-6601

Let me know for additional queries.

Regards,

hardik Shah

Re: Manage policies using CLI from a computer

Retired Member — Fri, 26 Sep 2014 15:15:11 GMT

I think API will be the best solution for that.