topic Re: How to Schedule Configuration Export without Panorama? in General Topics

How to Schedule Configuration Export without Panorama?

paloalto.nis — Tue, 30 Apr 2013 08:26:57 GMT

Hello,

I would like to know if it is possible to automatically export the configuration of my firewall without Panorama.

Thank you in advanexportce for your help.

Re: How to Schedule Configuration Export without Panorama?

ExclusiveNetworksGermany — Tue, 30 Apr 2013 08:39:02 GMT

There is no "official" Scheduler for automatic export yet. But you can ask your SE to sign the Feature Request for you.

Anyway there are some ways to trigger config Backups from external Server

1. Use the XML API

2. Or use remote ssh login (with public/private key for passwordless login) in a shell script on an external Server and execute backup commands:

scp export configuration to USER@SCPHOST:PATH

tftp export configuration to TFTPHOST

Cheers

Marco

Re: How to Schedule Configuration Export without Panorama?

minow — Wed, 07 Aug 2013 14:52:16 GMT

how do you backup the passwords also?

i have seen in the XML output that it shows this for a local user record:

<role-based>

</role-based>

</permissions>

but if i export the runing config from the webui then i get the "phash" in the right way

what do you suggests?

Re: How to Schedule Configuration Export without Panorama?

kprakash — Wed, 07 Aug 2013 15:29:38 GMT

Although the passwords are shown as a hashed value on the exported file, when you import back the file onto a firewall, the same passwords are maintained. As hashes are irreversible ( cannot be decrpypted ), the firewall computes the hash of the password that the user enters on the ssh or the gui, and if the hash of the password matches that of the running config, the PANFW identifies that the password is correct and lets you access the device.

Tested this out in the lab.

BR,

Karthik

Re: How to Schedule Configuration Export without Panorama?

minow — Wed, 07 Aug 2013 21:06:33 GMT

yes i know this. but i tried to performe a backup using the API.... and the file i get has ***** in the "phash" attribute as shown in my post.

do you have any suggestion how to enable PA to export the hashed password on the API exported file?

Re: How to Schedule Configuration Export without Panorama?

kfindlen — Wed, 07 Aug 2013 21:12:01 GMT

Is the user being utilized to authenticate to the API a superuser? A non-superuser account will cause the password hash to be removed from the output.

Re: How to Schedule Configuration Export without Panorama?

minow — Tue, 08 Oct 2013 05:31:34 GMT

That was the answer