Palo alto XML API not working

Jatin.Singh — Tue, 13 Apr 2021 04:09:42 GMT

The firewall internal interface used to have GP portal configured and then removed, we found the XML API does not work on the standard port 443. In web browser an API call returns the 404 error. Pcap shows that the firewall does not reply to the call. We need this for Clearpass integration, and when testing with a different port (with NAT) it works on browsers but not the Clearpass.

Could you please help with the troubleshooting.

It works on the public interface

we have GP portal running on the public interface so we are using port 4443 to access the API and NAT’ing it to a loopback interface on 443 with management profile.

We tried the similar setup on the internal interface and it works ok. But not port 443.

Followed this document

https://www.arubanetworks.com/assets/pso/TechNote_ArubaAndPaloAltoNetworksIntegration.pdf

Re: Palo alto XML API not working

jimzam — Tue, 13 Apr 2021 07:18:00 GMT

@Jatin.Singh

Captive Portal and the other standard user mapping methods might not work for certain types of user access. For example, the standard methods cannot add mappings of users connecting from a third-party VPN solution or users connecting to a 802.1x-enabled wireless network.

For such cases, you can use the PAN-OS XML API to capture login events and send them to the PAN-OS integrated User-ID agent.

See Send User Mappings to User-ID Using the XML API for details. - https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/user-id/user-id-concepts/user-mapping/xml-api

topic Re: Palo alto XML API not working in General Topics

Palo alto XML API not working

Re: Palo alto XML API not working