topic Re: Adding Multiple Individual IP addresses at one time. in General Topics

Adding Multiple Individual IP addresses at one time.

garethdoyle — Fri, 12 May 2017 17:03:07 GMT

In our environment we use tags on individual IP addresses for a few different things and then have policies in place to take those actions based on those tags.

Sometimes we have requests come in with a lot of indivudla IP addresses that we have to add and tag in multiple VSYS's. This is tedious and time consuming because the only way I know how to do it is manually, one at a time, adding each address and tagging it.

Is it possible to add multiple IP addresses and tag them at one time? I wouldn't mind doing it in individual VSYS's if needed.

Thanks.

Re: Adding Multiple Individual IP addresses at one time.

rmfalconer — Fri, 12 May 2017 17:19:44 GMT

You can use the CLI to add addresses and set a tag on them. You still have to create the script but can paste them all at once.

set vsys vsys2 address rf tag test fqdn rf.myco.local

set vsys vsys3 address rf1 tag test1 fqdn rf1.myco.local

Re: Adding Multiple Individual IP addresses at one time.

garethdoyle — Fri, 12 May 2017 17:38:28 GMT

I'm looking for exactly something like that, but that command doesn't work for me...

In order to hop into the right vsys I have to use this command:

set system setting target-vsys vsys2

From there I don't see anything similar to what you have.

What version of of PanOS are you running?

Re: Adding Multiple Individual IP addresses at one time.

rmfalconer — Fri, 12 May 2017 18:02:24 GMT

I'm on 7.1.6 but it looks like you aren't in config mode.

I prefer the set based CLI so the first command I run is:

set cli config-output-format set

Then type 'configure' to get to config mode, which is shown by the # symbol after the hostname.

user@firewall#

Then you can paste the config.

Re: Adding Multiple Individual IP addresses at one time.

garethdoyle — Fri, 12 May 2017 18:36:16 GMT

I only have the following commands available in configure mode:

check
edit
exit
find
quit
run
show
top
up

Re: Adding Multiple Individual IP addresses at one time.

rmfalconer — Fri, 12 May 2017 19:11:35 GMT

It looks like your account permissions in the CLI have been restricted. Admin roles can have different permissions for GUI and CLI.

Does your login account have a specific profile attached to it?

Re: Adding Multiple Individual IP addresses at one time.

garethdoyle — Fri, 12 May 2017 19:32:30 GMT

This was tried on a fully privileged account. I wonder if maybe that is just not available in PanOS 7.0.x

Re: Adding Multiple Individual IP addresses at one time.

BPry — Fri, 12 May 2017 19:44:13 GMT

@garethdoyle,

The listed options that you have would not be consistent with a fully privileged account on any version of the os. The 'set' command has been around since the beginning and without it you aren't going to be able to do any of this in the CLI as it appears your CLI is restricted. You may be allowed to change everything you want in the GUI, but it appears CLI is most definitely limited.

Re: Adding Multiple Individual IP addresses at one time.

garethdoyle — Fri, 12 May 2017 19:48:44 GMT

Thanks for that, there may be something else at play.

As a separate question, would a PA-200 have this functionality?

Thanks.

Re: Adding Multiple Individual IP addresses at one time.

rmfalconer — Fri, 12 May 2017 20:02:01 GMT

I just created a user with the devicereader CLI permissions and I see the exact options you do in config mode.

Yes, the set commands work on any hardware version.

Re: Adding Multiple Individual IP addresses at one time.

garethdoyle — Fri, 12 May 2017 20:02:03 GMT

When I test in my PA-200 as the admin account I don't see these commands either. Also running 7.0.x ... Interestingly weird.

Re: Adding Multiple Individual IP addresses at one time.

rmfalconer — Fri, 12 May 2017 20:07:39 GMT

Is the admin account Dynamic or Role Based?

Re: Adding Multiple Individual IP addresses at one time.

garethdoyle — Fri, 12 May 2017 20:24:28 GMT

I'm not sure what that means.. It is the default admin account and even still has the default admin/admin password.

Re: Adding Multiple Individual IP addresses at one time.

rmfalconer — Fri, 12 May 2017 21:04:50 GMT

On the admin account, there is a section for 'Administrator Type'. The choices are Dynamic or Role Based.