topic Re: Pushing from Panorama to firewall with API in General Topics

Pushing from Panorama to firewall with API

RogerMccarrick — Wed, 22 Aug 2018 22:11:29 GMT

I am trying to commit changes to a Panorama and then have changes pushed to the firewall making API calls from a powershell script.

Using the API I can:

add the firewall to the panorama
add the firewall to an existing template in the panorama
create a new device group on the panorama and add the firewall to it
Add rules (policies) to the device group.
Commit changes.

But I can't seem to push that template and policies to the firewall with the API.

Here is the powershell code I use to commit.

# Commit to Panorama
 Write-Host -foreground "Green" " Committing changes to Panorama"
 Write-Host ""
 $pancomURL = "https://panorama//api/?key=" + $panKey + "&type=commit&cmd=<commit></commit>"

 Invoke-WebRequest -uri $pancomURL

Here is what I try to push the changes:

# Push to device from Panorama
 Write-Host -foreground "Green" " Pushing changes from Panorama to Palo Alto"
 Write-Host ""
 $pancomURL = "https://panorama//api/?key=" + $panKey + 
 "&type=commit&action=all&cmd=<commit-all><shared-policy><device-group><entry name='" + $gpid + "'/></device-group></shared-policy></commit-all>"
 
 Invoke-WebRequest -uri $pancomURL

What is the correct syntax for the pushing to the firewall using the API?

thanks

Roger

Re: Pushing from Panorama to firewall with API

Remo — Wed, 22 Aug 2018 23:40:14 GMT

Pushing the policy:

https://PANORAMA/api/?key=APIKEY&type=commit&action=all&cmd=<commit-all><shared-policy><device-group><entry name="DEVICEGROUPNAME"/></device-group></shared-policy></commit-all>

Pushing the template stack:

https://PANORAMA/api/?key=APIKEY&type=commit&action=all&cmd=<commit-all><template-stack><name>TEMPLATESTACKNAME</name></template-stack></commit-all>

... in my tests these API calls are working ...

Re: Pushing from Panorama to firewall with API

RogerMccarrick — Wed, 22 Aug 2018 23:44:48 GMT

Thanks very much.

I just came across the template push. Trying it shortly.

Sometime the syntax seems inconsistent, like:

<device-group><entry name="DEVICEGROUPNAME"/></device-group>

<template-stack><name>TEMPLATESTACKNAME</name></template-stack>

in one it's entry name=, and in the other it's <name>.

But thanks again.

Roger

Re: Pushing from Panorama to firewall with API

RogerMccarrick — Wed, 22 Aug 2018 23:50:25 GMT

Alo, how do you change it to partial to only commit changes of the user?

thanks

Roger

Re: Pushing from Panorama to firewall with API

Remo — Thu, 23 Aug 2018 06:25:55 GMT

Hi @RogerMccarrick

My assumption why these commands are different is the following:

The devicegroupcommit is there already quite a while, then sometime the stack feature was added and with that a slightly new syntax (because they think it is easier this way?...). But to not break the existing implementations, the devicegroupcommit wasn't changed.

Partial commits are not possible so far with the API.

Regards,

Remo