topic Re: Feature Request - Automatic Configuration Backup in General Topics

Feature Request - Automatic Configuration Backup

gafrol — Mon, 06 Dec 2010 08:46:24 GMT

Hi all,

pls add a feature to allow automatic and scheduled (daily,weekly,monthly) configuration backups to be made to local HD, remote ftp/tftp/scp server.

kind rgds

Roland

Re: Feature Request - Automatic Configuration Backup

nrice — Mon, 06 Dec 2010 23:58:58 GMT

In 4.0 you will have the ability to do a configuration export from Panorama. The feature is a daily export based on a 24hr hour entry using FTP. The archive is a TGZ of all managed devices config in XML format plus Panorama config.

In general, feature requests should be made through your local Sales Engineer who will lobby for their implementation.

Re: Feature Request - Automatic Configuration Backup

gafrol — Tue, 07 Dec 2010 07:51:00 GMT

I would like to see this feature on a box level not in panorama. Not all customers have panorama and panorama is not free...

Customers compare features with PAN and what they have right now and automatic backups are missing in PAN.

Re: Feature Request - Automatic Configuration Backup

James — Tue, 07 Dec 2010 08:26:26 GMT

In that case, you do have the option to use the XML API - with an off box scheduler to get the configuration

Thanks

James

Re: Feature Request - Automatic Configuration Backup

gafrol — Tue, 07 Dec 2010 08:28:52 GMT

I have been reading about this possibility, but that's too complicated compared to what the competition offers...

Roland

Re: Feature Request - Automatic Configuration Backup

migration — Tue, 07 Dec 2010 13:48:34 GMT

Automatic backup are RELEVANT not optional, especially in an MSP, when there are hundreds of different technologies.

This is the first question a prospect ask me when I go to explain PAN strengths.

XML API cannot be always a solution for any simple and foundamental task that competitors offer as a basic feature.

I hope you consider this as a feature that could be introduced in next (minor) release.

Thanks.

Re: Feature Request - Automatic Configuration Backup

James — Tue, 07 Dec 2010 22:47:06 GMT

That is correct - configuration back ups are indeed important. Hence the offer of another alternative in the mean time

Please contact your local Palo Alto Networks sales team in order to file the feature request.

Many Thanks for your continued feedback

James

Re: Feature Request - Automatic Configuration Backup

gafrol — Wed, 08 Dec 2010 07:52:24 GMT

I have forwarded the feature request to the local SE. So far no reply.... I hope it's not diverted to /dev/null.... or can I track the feature requests somewhere ?

Roland

Re: Feature Request - Automatic Configuration Backup

nrice — Wed, 08 Dec 2010 16:02:57 GMT

Your SE can and will track this and all feature requests and be able to lobby for those most frequently requested by customers.

Re: Feature Request - Automatic Configuration Backup

holmesw — Thu, 06 Jan 2011 19:25:32 GMT

The REST API is actually pretty simple to implement for getting a copy of the configuration.

#!/bin/sh
#
# Get a copy of the PAN firewall configuration using the REST API.
# This works with curl, but not wget. Create the contents of the key
# file by going to
# https://${HOST1}/esp/restapi.esp?type=keygen&user=${USER}&password=${PW}
# and using administrator credentials for USER and PW (password).
# The key file just needs the key, not the entire XML output of keygen.
#
HOST1=pafw1.example.com
HOST2=pafw2.example.com
KEY=$(cat pafw.key)
DATE=$(date +%Y%m%d)
#
URL1="https://${HOST1}/esp/restapi.esp?type=config&action=show&key=${KEY}"
URL2="https://${HOST2}/esp/restapi.esp?type=config&action=show&key=${KEY}"
echo $URL
#
curl --output ${HOST1}.${DATE}.xml --insecure $URL1
curl --output ${HOST2}.${DATE}.xml --insecure $URL2

Re: Feature Request - Automatic Configuration Backup

admedia — Tue, 12 Apr 2011 06:52:32 GMT

Hi,

I have Panorama 4.0.1 and the Palo Alto devices are on the Pan OS 3.1.4.

Is it still possible to get the PA device backups using Panorama daily config backup schedule option?

I am trying to configure it but I dont see any backups happening. Neither can I see any activity in the system logs for the schedule backup?

Re: Feature Request - Automatic Configuration Backup

triitech — Wed, 13 Apr 2011 11:09:14 GMT

Will be implemented this feature in PAN directly instead of Panorama, I think that would be great to have a feature like this, many customers ask for this indeed.

Re: Feature Request - Automatic Configuration Backup

Thorsten — Wed, 15 Jun 2011 19:54:30 GMT

We would like to have this on shell, not panorama.

on others we do with ssh and authorized_keys (eg. f5, juniper, ...)

Re: Feature Request - Automatic Configuration Backup

rapoint_person — Wed, 25 Jan 2012 08:58:30 GMT

Agree that a scheduler on-box would be nice. However, ssh-key auth is available from 4.1. This means that you can automate backups by adding a cron job on an external box. Simple enough.

Re: Feature Request - Automatic Configuration Backup

dru — Wed, 04 Apr 2012 18:35:51 GMT

Have you any success with ssh-key method? We're attempting to do this, but when issuing commands from the remote box, it does not appear the remote shell is not receiving the command. If logging in using regular ssh, it works. Does PA's ssh daemon prevent remote execution? Or am I missing something that can be configured to accomplish this?

Re: Feature Request - Automatic Configuration Backup

sslicense — Mon, 08 Apr 2013 07:06:09 GMT

Hi, any update here and suggestion?

Where is the running-config.xml path in PANOS?

I use scp in Linux server, but it fail:

scp abc@paloaltofirewall:/opt/pancfg/mgmt/device-state /home/paloalto_cfg_backup

Re: Feature Request - Automatic Configuration Backup

zarina — Tue, 09 Apr 2013 00:39:01 GMT

here is the path for running config:

/opt/pancfg/mgmt/factory/running-config.xml

Re: Feature Request - Automatic Configuration Backup

sslicense — Tue, 09 Apr 2013 05:04:40 GMT

Try it but seems still not working, here is the result:

................

debug1: SSH2_MSG_NEWKEYS received

debug1: SSH2_MSG_SERVICE_REQUEST sent

debug1: SSH2_MSG_SERVICE_ACCEPT received

debug1: Authentications that can continue: publickey,password,keyboard-interactive

debug1: Next authentication method: publickey

debug1: Trying private key: /home/cpcnet/.ssh/identity

debug1: Trying private key: /home/cpcnet/.ssh/id_rsa

debug1: Offering public key: /home/cpcnet/.ssh/id_dsa

debug1: Server accepts key: pkalg ssh-dss blen 434

debug1: read PEM private key done: type DSA

debug1: Authentication succeeded (publickey).

debug1: channel 0: new [client-session]

debug1: Entering interactive session.

debug1: Sending command: scp -v -f /opt/pancfg/mgmt/factory/running-config.xml

It hang after "debug1: Sending command: scp -v -f /opt/pancfg/mgmt/factory/running-config.xml"

Any idea?

Re: Feature Request - Automatic Configuration Backup

jochristian — Tue, 09 Apr 2013 07:40:46 GMT

Hello,

If you install panxapi (part of the PAN-perl package, PAN-perl-20121110.tar.gz) you can do a backup of the configuration this way:

(From 'man panxapi')

Generate an API key.

$ panxapi -l admin:admin -h 172.29.9.122 -k

keygen: success

API key: "0RgWc42Oi0vDx2WRUIUM6A=="

Create a .panrc file with the API key.

$ echo 'hostname=172.29.9.122' >.panrc

$ echo 'api_key=0RgWc42Oi0vDx2WRUIUM6A==' >>.panrc

Retrieve the active configuration and write it to a file.

$ panxapi -srx >fw-backup.xml

show: success

Of course this can then be put into a crontab job which automatically does a backup every day.

If you put it into a script you can also script it to put timestamps on the backup files.

This should also work (if you don't want to use .panrc): panxapi -l admin:password -h 172.29.9.122 -srx > fw-backup.xml

Jo Christian

Re: Feature Request - Automatic Configuration Backup

paultsang — Wed, 10 Apr 2013 02:07:46 GMT

Hi Christian,

Thanks for your suggestion, I will try it today.

By the way, my PAN is 5.0 and where can I download the version you suggested(PAN-perl-20121110.tar.gz)? I can only download older version.

Thanks,

Paul