API for download Dynamic / Software updates

[marcin.sek]

Hi,

I need to automate downloading dynamic and software updates for my licensed products. 

Is there any API provided by PaloAlto to download updates?

best regards

[nigelswift]

/api/?type=op&cmd=<request><system><software><install><version>version_number</version></install></software></system></request>

will start an install assuming the version you have the version downloaded.

/api/?type=op&cmd=<request><system><software><download><version>version_number</version></download></software></system></request>

will start a download.

Both of those calls return a job ID, which can be queried with:

/api/?type=op&cmd=<show><jobs><id>JOB_ID</id></jobs></show>

That should cover most of the useful calls. Definitely check out the XML API guide below as well as the API browser (https://IP/api on a firewall from a browser).

https://www.paloaltonetworks.com/documentation/80/pan-os/xml-api

[jjosephs]

Hello @marcin.sek,

I used my browser to go to my firewall at https://192.168.1.46/api.

I think that you may be interested in this xpath to start with

/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/update-schedule

I got here by selecting, in this order:

1. Configuration Commands
2. Devices
3. localhost.localdomain
4. deviceconfig
5. system
6. update-schedule

Once you are on that page, you will see that you can futher explore the current settings associated with that which we would find in the UI under Device > Dynamic Updates.

I was not able to find in the API where one can view the software download information. I would caution against trying to schedule a software update, although I do understand that you might want to be able to remotely download, install, and reboot a firewall throught the API after you have identified a software version to which you want to upgrade.

[marcin.sek]

You answered how to download updates from firewall.

Thanks but not really helped.

Paloalto Firewall will be in closed network without access to internet. I have to write a script to automate updates. Script will download updates directly from producer and then manually moved (by cd or pendrive) to closed closed network and firewall should import those updates (also by script).

I need to download updates directly from "paloaltonetworks" and then import them to my firewall.

So is there any API that I could download software updates?

Best regards,

Andrzej Grymkowski

[OtakarKlier]

Hello,

Not sure if this would help, but will the PAN's be managed by a Panorama? Maybe have the Panorama have access to the internet and the PAN's get access only to the Panorama?

Just a thought.

[marcin.sek]

No, there wont by any Panorama.