Paloalto Onprem Firewall PA3250 - Create multiple objects and object-group - using automation

[visioner10]

 Hi All, I am newbie here. I am trying to achieve below goal using automation.

Problem statement: We have a frequent need to create at least 50 objects and 20 object-group for support purpose. We are supporting more than 30 Testing groups in our organization. On top of that, We also need to keep updating our Blacklisted IP object-group to add CISA and FBI newletter's malicious IP as part of our compliance.

I need to do this via automation. either using Terraform or RestApi or Azure DevOps CI/CD pipelines. Can you provide me some help with this issue?

#Terraform

#Automation

[nikoolayy1]

This could be usefull for you as a post how to use terraform and palo alto:

https://maniakacademy.medium.com/code-share-automate-palo-alto-next-generation-firewall-ngfw-using-t...

[JimmyHolland]

In addition to @nikoolayy1, the Terraform "provider" for PAN-OS is listed in Hashicorp's Terraform registry here: https://registry.terraform.io/providers/PaloAltoNetworks/panos/latest/docs with all the reference documentation. For that many objects, Terraform's "for_each" looping construct could be useful too.

Outside of Terraform, you mentioned the REST API, which is documented on every NGFW/Panorama at https://ngfw-or-panorama-hostname-or-ip-address/restapi-doc/, then use your own preferred language to script or program address object and group creation.

Either Terraform or REST API calls can be called through a pipeline like Azure DevOps.

Finally, consider External Dynamic Lists (EDLs) for your denylisting use case. The pipeline could update an EDL you host internally and then your Panorama/NGFW can point to that list: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/policy/use-an-external-dynamic-list-in-po...

Hope that helps!

[nikoolayy1]

If you managed to get the needed answers, please flag the question as answered.