topic Getting all Network Objects & Addresses via API in General Topics

Getting all Network Objects & Addresses via API

f1r3withf1r3 — Fri, 01 Sep 2017 19:07:21 GMT

Hi all,

In working with the PAN-OS API on v7, I have been trying to figure out the appropriate way to get all of the network objects and their associated addressesF15 recognized by my firewall.

Tried the following query but only seems to return an error code of 7, so I'm not sure if that means my query is malformed or if what I'm asking it for is the wrong request type:

Tried via Windows PowerShell:

Invoke-RestMethod -Method GET -Uri

"https://MYFIREWALL/api/?type=config&action=get&key=MYAPIKEY&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address-group"

If anyone could point me in the right direction, I would be greatly appreciative.

Re: Getting all Network Objects & Addresses via API

kiwi — Mon, 04 Sep 2017 08:58:21 GMT

Hi @f1r3withf1r3,

This might be of help to you :

How to Export Address and Address-group Objects Using PAN-OS API:

https://live.paloaltonetworks.com/t5/Tutorials/How-to-Export-Address-and-Address-group-Objects-Using-PAN-OS-API/ta-p/58622

Cheers !

-Kiwi

Re: Getting all Network Objects & Addresses via API

f1r3withf1r3 — Wed, 06 Sep 2017 14:53:29 GMT

Thanks @kiwi

Based on the documentation for that perl package, looks like its instructions are for linux admins.

While this is possible in my particular case, for the sake of future Googlers, is there any guide on making that work in Windows via CygWin/PAN-Perl/Excel?

Gluing that together is not readily understandable from the page initially provided. Any pointers would be helpful.

Re: Getting all Network Objects & Addresses via API

BPry — Wed, 06 Sep 2017 19:51:08 GMT

@f1r3withf1r3,

To the best of my knowledge PAN-perl is depreciated and really isn't recommended anymore, pan-python would be more of the direction most are taking, or Device Framework.

That being said if you are in a Windows envrioment I would really recommend simply learning the API before you start incorporating any of the other tools that Palo Alto and users have published for use in other languages. Knowing what the command you are issueing is actually doing on your system is something that I deam pretty essential.