Officially supported method for Panorama backup through API

cancel
Showing results for 
Search instead for 
Did you mean: 

Officially supported method for Panorama backup through API

L3 Networker

Dear Team, 

It's look like there are 2 methods for Panorama backup through API.

curl -o {{server_backup_file}} -k https://{{Panorama_IP_@}}/api/?type=export&category=configuration&key={{Panorama_API_key>}}

or

curl -k https://{{Panorama_IP_@}}/api/?type=op&cmd=<save><config><to>{{Panorama_backup_file}}</to></config></save>&key={{Panorama_API_key}}

then retrieve the file through SCP

But the outputs look different:

[admin@elkrsg01 ~]$ file backup*
backup_API80.xml: UTF-8 Unicode text, with very long lines
backup_SCP80.xml: XML 1.0 document, ASCII text

[admin@elkrsg01 ~]$ wc -lwc backup*
1112 1439 126998 backup_API80.xml
3986 4313 177296 backup_SCP80.xml
5098 5752 304294 total

Customer would like to know which method is fully supported?

 

Regards

Sam Prabhu

8 REPLIES 8

Cyber Elite
Cyber Elite

Hi @sprabhu

 

Does it need to be done by an API call? If not, probably the best way is the scheduled config export (https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface-help/panorama-web-interface/p... ). This way panorama daily saves the panorama configuration and all the configurations of the managed firewalls to an SCP or FTP server.

With the API I would use the export which you already mentionned or this one for the panorama config:

https://PANORAMA/api/?type=op&cmd=<show><config><running><%2Frunning><%2Fconfig><%2Fshow>

And the running config of the firewalls with the same save command but add this to the url to get the firewall running config:

&target=<device-serial-number>

 

Hi ,

 

Thank you for your response.

 

Since they plan to automate the solution with API, they'd like to do all things by API.

SCP or FTP scheduling on Panorama is not an option. They want to trigger by an orchestration server the backup. 

They just need to know which command is the best and if there is some issue later be sure that it will be supported.

 

Regards

Sam Prabhu

L3 Networker

Sorry to hit the way-back machine on this post, but I need to do this and have no idea how to start.  Can anyone step me though it?

L4 Transporter

@RobertShawver The API docs can be found here: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-panorama-api.html, and specifically the export request type of API call here: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-panorama-api/pan-os-xml-api-request-types/expor... 

Help the community: "Like" helpful comments, and click "Accept as Solution" if you found your answer 🙂

Thanks for your reply, here is my real issue though. Because of the log4j we had to move to 9.1.12-h3, but that broke the Schedule Config export. So I'd like to be able to automate the backup and export of the Panorama config because it still works via command line.

 

I can manually log into the Panorama via cli and run "scp export config-bundle to" the problem is, how do I automate that?

@RobertShawver First things first, ensure you have logged a ticket to get Scheduled Config Export investigated and fixed, let's make sure the root cause of the problem gets fixed.

Meanwhile, if you just want to automate/mimic the behaviour of a human logging in via SSH to the CLI and performing commands, you could look into using "expect" in a simple script: https://www.google.com/search?q=ssh+expect+script&oq=ssh+expect+script. You could run that script regularly using cron or something similar. Other methods to do the same thing are available in different programming languages too.

 

However, if you are going to need a regularly executing script, I would argue that using the API would be much cleaner than an expect script. Here is a very simple example below, AND PLEASE NOTE that API keys should be treated much more securely than shown in the example here where the API key is stored/hardcoded in a script, please use a vault or something similar to securely store credentials!

 

#!/bin/bash

# Variables
host="1.1.1.1"
key="your-PANOS-API-key-here"
filename="exported-running-config.xml"

# Export running config file
curl -k "https://$host/api/?key=$key&type=config&action=show" > $filename

 

Hope that helps

Help the community: "Like" helpful comments, and click "Accept as Solution" if you found your answer 🙂

Thanks!  The "fix" is coming with 9.1.13, but I'll wait till it's "preferred" before jumping on it only to find out that version breaks something else.  🙂

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!