topic Re: Adding address objects and tagging them via CLI. in General Topics

Adding address objects and tagging them via CLI.

Gareth.Doyle — Fri, 05 Jan 2018 23:00:34 GMT

In my network we tag certain IP addresses for various reasons on our Palo Alto's. Sometimes we will get a large batch of these that need to be done and manually creating an address object and then tagging it via the GUi can be time consuming (to say the least).

I'm wondering if there is a way to add these object groups and tag them via the CLI.

I'm running a Panorama with an HA pair of physical boxes if that makes a difference.

Thanks.

Re: Adding address objects and tagging them via CLI.

kiwi — Mon, 08 Jan 2018 09:27:39 GMT

Hi @Gareth.Doyle,

I think you want to use the set address / address-group commands in CLI (in configuration mode) :

> configure

# set address
# set address <name> tag  [ <tag1> <tag2>... ]
# set address-group <name> tag  [ <tag1> <tag2>... ]

Hope this helps !

-Kiwi.

Re: Adding address objects and tagging them via CLI.

reaper — Mon, 08 Jan 2018 09:38:57 GMT

Have you considered using API to inject these IPs in tagged dynamic objects?

Sample API workflow for Dynamic Address Objects

Re: Adding address objects and tagging them via CLI.

TerjeLundbo — Tue, 09 Jan 2018 11:07:22 GMT

Like this

set vsys vsys1 address <address object> tag <tag> ip-netmask x.x.x.x/32

And if you want to add it to a group

set address-group <address group> <address object>

Re: Adding address objects and tagging them via CLI.

Gareth.Doyle — Tue, 23 Jan 2018 02:07:51 GMT

I ended up using this method:

set cli config-output-format set
configure

set device-group <device_group_name > address < address_object_name> ip-netmask <ip_address/netmask>
set device-group < device_group_name> address < adsdress_object_name > tag <tag_name>

Thanks!