topic How to create multiple policy objects using Panorama in General Topics

How to create multiple policy objects using Panorama

SunilGajjar — Thu, 12 Apr 2018 12:08:48 GMT

Is there any quick way to configure multiple policy objects on Panorama? especially looking to configure hundreds of fqdn objects to push them to firewalls managed through panorama so using GUI is quite a lot of work.

e.g. for standalone PA, it is quick using CLI commands

Re: How to create multiple policy objects using Panorama

Chacko42 — Thu, 12 Apr 2018 13:52:57 GMT

You could build up a cli-script or you can use the xml-api

https://live.paloaltonetworks.com/t5/Management-Articles/Add-a-Shared-Address-Object-Using-XML-API-to-Panorama/ta-p/69651

Re: How to create multiple policy objects using Panorama

SunilGajjar — Fri, 13 Apr 2018 05:10:27 GMT

Thanks for your reply. It looks to be a good solution for Shared objects.

Is there any similar method to create it for a specific Device Group?

Re: How to create multiple policy objects using Panorama

Chacko42 — Fri, 13 Apr 2018 06:37:23 GMT

Unfortunately I currently got no panorama at hand, but you can have a look for the api-calls at https://<panorama-ip/api

Maybe there is a "device group" branch on the same level as the "shared" branch.

Re: How to create multiple policy objects using Panorama

Remo — Fri, 13 Apr 2018 07:10:48 GMT

https://{panorama-ip}/api/?key={API-key}&type=config&action=set&xpath=/config/device-group[@name='{devicegroup-name}']/address/entry[@name='{object-name}'] &element=<ip-netmask>{ip-address/mask}</ip-netmask>

Re: How to create multiple policy objects using Panorama

kiwi — Fri, 13 Apr 2018 11:31:52 GMT

@SunilGajjar,

As Chacko42 & vsys_remo pointed out using XML_API can be an excellent way to do this.

If you're unfamiliar with how XML API works then check out the following XML API use case examples explained on the Live Community Blog (these might not match your exact use case but can definitely help you getting started with XML API) :

Export-the-security-rulebase-using-XML-API

XML-API-Use-Case-to-Add-amp-Delete-TS-Agents

The-Power-of-XML-API

Cheers !

-Kiwi.

Re: How to create multiple policy objects using Panorama

SunilGajjar — Mon, 16 Apr 2018 04:32:42 GMT

@kiwi @Remo @Chacko42

Thanks for your replies.

Re: How to create multiple policy objects using Panorama

SunilGajjar — Mon, 16 Apr 2018 05:03:12 GMT

@Chacko42

I have drilled it down through Panorama API browser to find out Devicegroup related Xpath at: /config/devices/entry[@name='{localhost.localdomain}']/device-group/entry[@name='{device-group name}]

It successfully worked using below API call (replace relevant values for variables within brackets {}):

https://{panorama-ip}/api/?key={API-Key}&type=config&action=set&xpath=/config/devices/entry[@name='{localhost.localdomain}']/device-group/entry[@name='{device-group name}']/address/entry[@name='{address-object-name}'] &element=<ip-netmask>{ip-address/mask}</ip-netmask>