Show Local Device Policies

[f1r3withf1r3]

Hi all,

I'm searching through the API browser on my PAN-OS 8 instance, and wondering where the syntax exists for exploring/getting the local policies per-physical device.

Or for clarity's sake - what API endpoint would return all of the local device's security policies. I am using some from Panorama globally, and cleaning up local security policies.

Not asking for someone to write a query for me, just point me to the right place in the API, please.

Any help appreciated!

[gfreeman · Accepted solution]

Policies on firewalls are located in `rulebase` under the vsys (for vsys1 below):

/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase

Policies on panorama are split between `pre-rulebase` and `post-rulebase` (for device group `Some group` below):

/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='Some group']/pre-rulebase

/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='Some group']/post-rulebase

[f1r3withf1r3]

Awesome, thanks so much @gfreeman!

[f1r3withf1r3]

@gfreeman, if I enter:

/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase

into the XPath search in the API browser, I get a 403 response of:

panCmsHandleDeviceContextReq: getRemoteContent() got response code 403

and same response if I try and submit:

/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='nameofmyfirewall']/rulebase

I'm a super user on my Panorama instance, and have 1 vsys in it, so not sure why that query when hitting submit isn't working.

Halps?

[f1r3withf1r3]

Ended up realizing my own fail - was using the URL for panorama and not the device I wanted to target (d'oh!)

For anyone seeing this later, here's a Powershell function I wrote to pull the information I was after:

Function Get-LocalDeviceSecurityPolicies($DeviceIP)
{
$response = Invoke-RestMethod "https://$DeviceIP/api/?key=$apiKey&type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security"
return $response.response.result.security.rules.entry
}