Can we get master key expiration via API?

[Steven_Lowry]

Hi, I am just starting to explore pan-python and was wondering if there was a way to pull master key details (like expiration date) via the API, whether from Panorama or on an individual firewall?

[JimmyHolland · Accepted solution]

Hi @Steven_Lowry,

First an FYI, pan-os-python is the successor to pan-python, and is your best resource for your Python work: https://github.com/PaloAltoNetworks/pan-os-python

You can call the API directly, targeting Panorama or an NGFW, to get that device's master key details:

https://{{host}}/api/?key={{key}}&type=op&cmd=<show><system><masterkey-properties/></system></show>

You can also target Panorama to get a managed NGFW's master key details, if you can't or don't want to target the NGFW directly:

https://{{host}}/api/?key={{key}}&type=op&cmd=<show><system><masterkey-properties/></system></show>&target={{ngfw-serial-number}}

Both the API calls above are examples of "op" (operational) commands. Within pan-os-python, op commands can be executed from the base module: https://pan-os-python.readthedocs.io/en/latest/module-base.html#panos.base.PanDevice.op

Hope this helps!

[Steven_Lowry]

Wow, this is very helpful, thank you so much I will give this a try 🙂

[Steven_Lowry]

Hi @JimmyHolland ,

Indeed I took your advice, read up on pan-os-python and tested a few scripts out.  So far so good.  I even read up on ElementTree (if only I knew what I was getting myself into before accepting this task lol).  I have one question related to this which I was unable to find searching the community.

I can create a bash script to pull the list of devices from Panorama and then loop through that list to pull the master key from each device.  However, I will need this all integrated with other scripts eventually so I need to do the same with Python.  I was able to get the list of devices in Panorama and loop through them, but in the loop I have to log into each device separately to pass the OP command.  I'm sure there's a way to do it directly through Panorama like with the curl command, except I can't seem to figure this out.  This is how my code looks

pano = Panorama( {{ip-address}}, {{username}}, {{password}} )
devices = pano.refresh_devices(include_device_groups=False)

for device in devices:
    fw = Firewall( {{ip-address}}, {{username}}, {{password}} )
    system_settings = device.find("", SystemSettings)
    mk = fw.op('show system masterkey-properties')
    print('%s \t %s' %(system_settings.hostname, mk[0].find('expire-at').text))

I see that both variables 'device' and 'fw' are firewall objects, so I would have thought I could just do mk = device.op('show system masterkey properties') but when I do it spits out the below error.  Would anyone have some feedback on this?  Thank you.

PanXapiError: hostname argument required