REST API and host policies

[JasonVonKrueger]

We just got our first PA (3060) and I was doing some research on the REST API.  What I would like to do is tie in our IP Address Management system for automation.  Like when an IP address is freed, a process would connect to the PA and remove that host's entry in any policy it may be in.  Or when we stand up a new public webserver, the process would insert that new host into the PA's https policy.  Something like that.

I may sound as if I don't know what I'm doing.  That's because I don't.  🙂

Thoughts and thanks.

 -Roger

[vvenkatara]

Hi Roger, 

That seems like a perfectly reasonable workflow! While maybe not addressing your questions directly, I would like to point out some tools that can make the "HOW" easier, once you figure out the "WHAT". 

We have developed ansible playbooks to automate a whole slew of tasks on the firewalls. Please take a look at the information I've attached and you might also find examples to suit your use case. 

Thanks,

- Vinay

Documentation:

http://panwansible.readthedocs.io/en/master/

Live page (with tutorials):  

https://live.paloaltonetworks.com/ansible

Private repo:

https://github.com/PaloAltoNetworks/ansible-pan

Tutorials: 

https://www.youtube.com/watch?v=KozIozKhxAo&t=114s

https://www.youtube.com/watch?v=0OnKIcUCKJg

Ansible official: 

https://www.ansible.com/integrations/networks/palo-alto

http://docs.ansible.com/ansible/list_of_network_modules.html#pano

[JasonVonKrueger]

Hey Vinay!   Thanks for your response.   I was hoping for a more REST'ish solution.  My co-worker is an Ansible freak and me using Ansible would make him too happy.  Can't have that.  🙂

Nonetheless, I'll look at the links you sent.  If Ansible is the best way to accomplish what I want, then Ansible it will be.

 -Roger