Wildcards in rest api configuration query?

cancel
Showing results for 
Search instead for 
Did you mean: 

Wildcards in rest api configuration query?

L2 Linker

Hi,

 

I'm trying to write a reporting tool that will go throguh various device groups and identify rules that have certain keywords (change numbers in my case) in the description.

 

I'm querying panorama configuration and using rest api directly from python (e.g. requests module or pan.xapi)

 

For example, this query works perfectly for me and as a result I get two rules returned back, if description contains only one string CHG99646:

 

/config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='Perth']/pre-rulebase/security/rules/entry[description="CHG99646"]

 
<response status="success" code="19">
<result total-count="2" count="2">
13 REPLIES 13

Unfortinately, PANOS doesn't provide API features to search for objects and such. The XPath is oringally designed to name a 'path' in the XML rather than doing searches.

 

Why does it take so long to get the condicate config ? Bandwidth issue or PANOS is too slow ? It should be instant almost

Config is 18MB in size

 

$ ./rt.py

Start

/config/devices

End request, returned XML in 28.5243420601

Size in bytes: 18714100

Converting XML to DICT

End xmltodict

Done

Finished conversion 44.2015681267

 

And palo alto Panorama is located on the other side of the world (accessing it over WAN)

 

What is your config size that you are normally downloading when you say it is almost instant?

Even if it was instant I still have about 18 seconds to convert XML to Dictionary but I could live with that (if only was instant as you say 🙂 🙂 )

 

 

I quit using XML to dictionary/json/arrays a long time ago : it's way too slow. I parse XML directly with libxml and alike.

 

In your case, to solve your bandwidth issues, I would have a middleware/application-proxy that would be excuted in the same datacenter as the firewall/panorama. This mini-API of yours would be able to acess the firewall without any bandwidth or latency constraint and would then just return the pieces of interest to you.

 

client requests MiddleAPI.getAllRulesMatchingX -> 

  MiddleAPI requests PAN_API.getFullConfigDump

  MiddleAPI parse XML, filters records of interest, add a 'loc' property

  MiddleAPI sends answer to client

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!