Paloalto Onprem Firewall PA3250 - Create multiple objects and object-group - using automation

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Paloalto Onprem Firewall PA3250 - Create multiple objects and object-group - using automation

L0 Member

 Hi All, I am newbie here. I am trying to achieve below goal using automation.

Problem statement: We have a frequent need to create at least 50 objects and 20 object-group for support purpose. We are supporting more than 30 Testing groups in our organization. On top of that, We also need to keep updating our Blacklisted IP object-group to add CISA and FBI newletter's malicious IP as part of our compliance.

 

I need to do this via automation. either using Terraform or RestApi or Azure DevOps CI/CD pipelines. Can you provide me some help with this issue?

#Terraform

#Automation

 

 

3 REPLIES 3

Cyber Elite
Cyber Elite

This could be usefull for you as a post how to use terraform and palo alto:

 

https://maniakacademy.medium.com/code-share-automate-palo-alto-next-generation-firewall-ngfw-using-t...

L5 Sessionator

In addition to @nikoolayy1, the Terraform "provider" for PAN-OS is listed in Hashicorp's Terraform registry here: https://registry.terraform.io/providers/PaloAltoNetworks/panos/latest/docs with all the reference documentation. For that many objects, Terraform's "for_each" looping construct could be useful too.

 

Outside of Terraform, you mentioned the REST API, which is documented on every NGFW/Panorama at https://ngfw-or-panorama-hostname-or-ip-address/restapi-doc/, then use your own preferred language to script or program address object and group creation.

 

Either Terraform or REST API calls can be called through a pipeline like Azure DevOps.

 

Finally, consider External Dynamic Lists (EDLs) for your denylisting use case. The pipeline could update an EDL you host internally and then your Panorama/NGFW can point to that list: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/policy/use-an-external-dynamic-list-in-po...

Hope that helps!

Help the community: "Like" helpful comments, and click "Accept as Solution" if you found your answer 🙂

Cyber Elite
Cyber Elite

If you managed to get the needed answers, please flag the question as answered.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!